CVE-2023-31851

CVE-2023-31851 Existe um ataque de cross-site scripting XSS refletido na interface de gerenciamento baseada na web do Cudy LT400. A página /cgi-bin/luci/admin/network/wireless/status possui XSS refletido através do parâmetro iface. Os métodos de exploração envolvem o envio de uma requisição...

CVE-2023-31779

CVE-2023-31779 XSS Armazenado no Wekan Descrição : Existe uma vulnerabilidade de XSS Armazenado no recurso "Reação a comentário". Um atacante com privilégios de usuário no quadro kanban pode executar código JavaScript nos navegadores dos usuários que abrirem o cartão com a reação maliciosa. Impac...

CVE-2024-55040-Sensaphone-XSS

SENSAPHONE भेद्यता प्रकटीकरण सारांश सितंबर 2024 के मध्य में, मैंने Sensaphone Web600 Monitoring System में मध्यम से निम्न गंभीरता की कई सुरक्षा समस्याओं की पहचान की, जिसमें सिस्टम सेटअप, प्रोफ़ाइल और ज़ोन विकल्पों में संग्रहीत क्रॉस-साइट स्क्रिप्टिंग XSS कमजोरियाँ शामिल हैं। दूरस्थ प्रमाणित हमलाव...

CVE-2024-42009-roundcube-xss

CVE-2024-42009 — PoC de XSS Armazenado no Roundcube Webmail 1.6.6 Apenas para testes de segurança autorizados, ambientes CTF e pesquisa educacional. Usar esta ferramenta contra sistemas que você não possui ou sem permissão por escrito é ilegal sob o Computer Misuse Act 1990 Reino Unido, a CFAA EU...

CVE-2025-51860

CVE-2025-51860 Описание уязвимости TelegAI, веб-приложение для создания и общения с AI-персонажами, уязвимо к хранимому межсайтовому скриптингу XSS в компоненте чата и компоненте контейнера персонажей. Злоумышленник может добиться произвольного выполнения клиентских сценариев, создав AI-персонажа...

CVE-2026-78414

A cross-site scripting (XSS) vulnerability exists in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 (Linux, Windows, macOS). An adjacent-network attacker who controls a rogue Nx server on the same network segment can set that server's site name to a script p...

EUVD-2026-64898

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...

CVE-2026-39915 TIM Flow < 26.0.6 CRLF Injection via rt Parameter

TIM Flow before 26.0.6 contains a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers and response body content by embedding unsanitized carriage return and line feed sequences in the rt URL parameter, which is reflected into Set-Cookie response headers...

EUVD-2026-64892

TIM Flow before 26.0.6 contains a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers and response body content by embedding unsanitized carriage return and line feed sequences in the rt URL parameter, which is reflected into Set-Cookie response headers...

CVE-2026-66421-OpenClaw-Dashboard-Stored-XSS-via-lastMessage-Session-Field

نشرة أمنية: برمجة نصية عبر المواقع مخزنة من خلال رسائل الوكيل تؤدي إلى سرقة رمز الجلسة openclaw-dashboard العنوان: XSS مخزنة في لوحة تحكم OpenClaw عبر حقل الجلسة lastMessage معرّف CVE: CVE-2026-66421 https://github.com/tugcantopaloglu/openclaw-dashboard الملخص يعرض جدول الجلسات في الصفحة الرئيسية...

PT-2026-80899

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...

CVE-2026-73084 Activepieces: Reflected Cross-Site Scripting in OAuth Redirect Endpoint

Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafted request to /api/redirect with a malicious code value can...

CVE-2026-73084 Activepieces: Reflected Cross-Site Scripting in OAuth Redirect Endpoint

Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafted request to /api/redirect with a malicious code value can...

PT-2026-70358

Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafted request to /api/redirect with a malicious code value can...

CVE-2026-71249

299Ko's public contact form plugin/contact/controllers/ContactController.php, home sets raw POST field values name, firstname, email, message into the page template with no sanitization. The template engine's variable output function common/Template.php, showvar echoes values with no...

EUVD-2026-53322

299Ko's public contact form plugin/contact/controllers/ContactController.php, home sets raw POST field values name, firstname, email, message into the page template with no sanitization. The template engine's variable output function common/Template.php, showvar echoes values with no...

CVE-2026-71249

299Ko's public contact form plugin/contact/controllers/ContactController.php, home sets raw POST field values name, firstname, email, message into the page template with no sanitization. The template engine's variable output function common/Template.php, showvar echoes values with no...

CVE-2026-70492

Open WebUI had a stored XSS vulnerability in KaTeX render-fallback: between 0.10.0 and 0.11.0, KaTeX errors could be rendered via HTML (via {@html}) in rendered messages, allowing script execution in viewers’ browsers and risking session token theft and potential admin account takeovers. Affected...

CVE-2026-70492 Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, src/lib/components/chat/Messages/Markdown/KatexRenderer.svelte could store and render a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. Th...

CVE-2026-70486

Open WebUI (self-hosted AI platform) versions 0.9.0–0.11.0 contain a Same-Origin/XSS risk in the terminal file-preview iframe: the serveUrl iframe branch granted allow-same-origin and allow-scripts for HTML files from the app origin, enabling an authenticated user with terminal server access to r...