CVE-2026-66912 Stored Cross-Site Scripting in Zimbra

Zimbra is vulnerable to Stored Cross-Site Scripting XSS via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containing a malicious From header with an embedded JavaScript...

CVE-2026-66912

The Zimbra mail server is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient sanitization of the From email header value. An attacker can send a crafted email containing a malicious JavaScript payload in the header. When a victim opens this message in the Classic UI and clicks Re...

EUVD-2026-112942

Zimbra is vulnerable to Stored Cross-Site Scripting XSS via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containing a malicious From header with an embedded JavaScript...

CVE-2026-66912: Synacor Zimbra Collaboration: Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in…

Zimbra is vulnerable to Stored Cross-Site Scripting XSS via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containing a malicious From header with an embedded JavaScript...

PT-2026-132283

Zimbra is vulnerable to Stored Cross-Site Scripting XSS via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containing a malicious From header with an embedded JavaScript...

CVE-2026-89075 MOVEit Transfer Local Disclosure of Session Information Vulnerability

Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

CVE-2026-89075 MOVEit Transfer Local Disclosure of Session Information Vulnerability

Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

CVE-2026-89075

Progress MOVEit Transfer is affected by an Insecure Storage of Sensitive Information vulnerability (CWE-922). The issue specifically impacts versions before 2025.1.6 and versions from 2026.0.0 before 2026.0.4 . This vulnerability allows for the local disclosure of session information . Exploitati...

CVE-2026-76972

Due to a Cross-Site Scripting XSS vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application. If an authenticated victim accesses a page that displays this stored content, the injected input is processed...

CVE-2026-89117 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal...

CVE-2026-89117 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal...

CVE-2026-76972 Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence

Due to a Cross-Site Scripting XSS vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application. If an authenticated victim accesses a page that displays this stored content, the injected input is processed...

CVE-2026-76972 Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence

Due to a Cross-Site Scripting XSS vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application. If an authenticated victim accesses a page that displays this stored content, the injected input is processed...

CVE-2026-76972

A Cross-Site Scripting (XSS) vulnerability exists in SAP Manufacturing Integration and Intelligence (CWE-79). The root cause is the improper neutralization of input during web page generation, allowing an attacker to store malicious content that is subsequently rendered by the application. If an ...

EUVD-2026-98185

Due to a Cross-Site Scripting XSS vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application. If an authenticated victim accesses a page that displays this stored content, the injected input is processed...

PT-2026-111129

Name of the Vulnerable Software and Affected Versions SAP Manufacturing Integration and Intelligence affected versions not specified Description A Cross-Site Scripting XSS flaw allows an attacker to store malicious content that the application later renders. When an authenticated user accesses a...

PT-2026-111142

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Enterprise Portal affected versions not specified Description An unauthenticated attacker can inject malicious scripts into a URL parameter. These scripts are reflected in the server response and executed in the browser of a user...

CVE-2026-76972: Improper Neutralization of Input During Web Page Generation

Due to a Cross-Site Scripting XSS vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application. If an authenticated victim accesses a page that displays this stored content, the injected input is processed...

CVE-2026-104073

A flaw was found in NetBox. An authenticated user with permission to create custom links can exploit a template injection vulnerability to access sensitive session information and Application Programming Interface API tokens. When a victim views an object containing the malicious link, their...

PT-2026-95348

Name of the Vulnerable Software and Affected Versions T-Systems TAO 2.0 affected versions not specified Description A stored Cross-Site Scripting XSS issue exists in the profile management functionality. An authenticated user can inject malicious HTML or JavaScript into personal data fields. This...