Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080

This module provides a better UI for managing and selecting Media entities in a folder structure. The module doesn't sufficiently sanitize the names and descriptions of media items and folders when they are displayed in the media browser, resulting in a stored cross-site scripting XSS...

Plone 4.3.x < 5.2.5 Multiple Vulnerabilities (HF 20210518)

The version of Plone installed on the remote host is 4.3.x prior to 5.2.5. It is, therefore, affected by the following vulnerabilities: - Plone CMS has a stored Cross-Site Scripting XSS vulnerability in the user fullname property and the file upload functionality. CVE-2021-3313 -...

Plone 3.3.x < 4.3.7 Multiple Vulnerabilities (HF 20150910)

The version of Plone installed on the remote host is 3.3.x prior to 4.3.7. It is, therefore, affected by the following vulnerabilities: - Plone allows remote attackers to add a new member to a Plone site with registration enabled, without acknowledgment of site administrator CVE-2015-7315 -...

Plone 5.2.3 XSS

The version of Plone installed on the remote host is 5.2.3. It is, therefore, affected by a stored cross-site scripting XSS vulnerability within the site-controlpanel due to improper validation of user-supplied input before returning it to users. An authenticated, remote attacker can exploit this...

Plone < 4.2.6 / 4.3.x < 4.3.2 Multiple Vulnerabilities (HF 20130618)

The version of Plone installed on the remote host is prior to 4.3.2. It is, therefore, affected by the following vulnerabilities: - traverser.py allows remote attackers with administrator privileges to cause a denial of service infinite loop and resource consumption via unspecified vectors relate...

Plone 2.5.x < 2.5.5 / 3.x < 3.3.6 / 4.x < 4.0.4 / 4.1.x < 4.1.1 Multiple Vulnerabilities (HF 20110531)

The version of Plone installed on the remote host is 2.5.x prior to 2.5.5, 3.x prior to 3.3.6, 4.x prior to 4.0.4, 4.1.x prior to 4.1.1. It is, therefore, affected by the following vulnerabilities: - Cross-site scripting XSS vulnerability allows remote attackers to inject arbitrary web script or...

MiracleLinux 9 : php:8.2 (AXSA:2026-1328:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1328:01 advisory. PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions CVE-2026-7258 PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting...

Plone < 3.0.4 XSS

The version of Plone installed on the remote host is prior to 3.0.4. It is, therefore, affected by a cross-site scripting XSS vulnerability in the LiveSearch module due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this...

Plone < 2.5.3 XSS

The version of Plone installed on the remote host is prior to 2.5.3. It is, therefore, affected by a cross-site scripting XSS vulnerability, in the skins/plonetemplates/defaulterrormessage.pt due to improper validation of the typename parameter to Members/ipa/createObject before returning it to...

CVE-2026-16486

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSIS.php. Performing a manipulation of the argument day results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be...

CVE-2026-16486 SourceCodester Class and Exam Timetabling System BSIS.php cross site scripting

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSIS.php. Performing a manipulation of the argument day results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be...

CVE-2026-16486

SourceCodester Class and Exam Timetabling System 1.0 contains a cross-site scripting vulnerability in an unknown part of /BSIS.php as a result of manipulating the day parameter. The issue can be triggered remotely and has publicly available exploit code. Affected product is the SourceCodester Cla...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the sanitization process when SVG reference elements such as or are included in the overridden allowed tags. An attacker can execute arbitrary scripts or load external resources by crafting SVG elements with...

CVE-2026-16485

SourceCodester Class and Exam Timetabling System 1.0 suffers a cross-site scripting (XSS) vulnerability in /class.php via manipulation of the day parameter. The issue can be exploited remotely and the exploit has been disclosed publicly. No additional technical details (such as exact payloads, af...

CVE-2026-16485 SourceCodester Class and Exam Timetabling System class.php cross site scripting

A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /class.php. Such manipulation of the argument day leads to cross site scripting. The attack can be launched remotely. The exploit has been...

CVE-2026-52475

Cross Site Scripting vulnerability in aiflowy = 2.1.2 allows a remote attacker to obtain sensitive information via the UploadController.java file...

CVE-2026-47685

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the unauthenticated inventory service endpoint /service/inventory.php persists client-supplied values without sanitization, and the Host Management Inventory page...

CVE-2026-47689 FOGProject has stored XSS via unescaped inventory data in buildRow() rendered on Group Inventory tab

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the buildRow method in fogpage.class.php substitutes data values into HTML table cell templates using strreplace without any HTML escaping. An unauthenticated...

CVE-2026-47689

FOGProject prior to versions 1.5.10.1832 and 1.6.0-beta.2313 is vulnerable to stored XSS. The buildRow() function in fogpage.class.php inserts data into HTML templates via str_replace() without escaping. An unauthenticated attacker who knows a registered host’s MAC address can POST malicious inve...

CVE-2026-47687

FOGProject vulnerability CVE-2026-47687: an unauthenticated attacker who knows a registered host MAC can post a crafted sysproduct to /service/inventory.php, causing the selectForm() helper to render unescaped input in option labels. This stored value is eventually displayed when an administrator...