CVE-2026-12682 Stored XSS in Ankaref's LIBRID/LIBREF

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Stored XSS. This issue affects LIBRID/LIBREF: from 2.01.0.2183 through 10092026. NOTE: The vendor was contacted early about this disclosu...

CVE-2026-12682

Ankaref Innovation and Technology Inc. LIBRID/LIBREF is affected by a Stored XSS vulnerability caused by improper input neutralization during web page generation. The issue affects versions from 2.01.0.2183 through 10092026 . The CVSS v3.1 score is 5.4 (Medium) with a network attack vector, low c...

EUVD-2026-75452

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Stored XSS. This issue affects LIBRID/LIBREF: from 2.01.0.2183 through 10092026. NOTE: The vendor was contacted early about this disclosu...

CVE-2026-88921 MISP: Unescaped HTML Injection in PDF Report Element Rendering

MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for rendering MISP element references attributes, objects, and tags into inline HTML during PDF report export via the convertmarkdowntopdf module. The attribute, objectAttribute,...

CVE-2026-12683 Stored XSS Yönetim panel in Ankaref's LIBRID/LIBREF

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Stored XSS. This issue affects LIBRID/LIBREF: from 2.01.0.2183 through 10092026. NOTE: The vendor was contacted early about this disclosu...

EUVD-2026-75447

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Stored XSS. This issue affects LIBRID/LIBREF: from 2.01.0.2183 through 10092026. NOTE: The vendor was contacted early about this disclosu...

CVE-2026-12683

CVE-2026-12683 is a Stored XSS vulnerability in the management panel (Yönetim panel) of Ankaref Innovation and Technology Inc. LIBRID/LIBREF , caused by improper neutralization of input during web page generation. The issue affects versions 2.01.0.2183 through 10092026 . The CVSS 3.1 score is 5.4...

CVE-2026-88868

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is affected by a stored cross-site scripting vulnerability in the LiveLinks plugin . The root cause is that the title and description fields are stored without sanitization. An attacker holding canStream permission can inject maliciou...

CVE-2026-88868 AVideo LiveLinks Stored XSS via title and description fields

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LiveLinks plugin where title and description fields are stored without sanitization. A user with canStream permission can inject malicious scripts that execute in the browser...

EUVD-2026-75419

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the ADServer plugin's log.php endpoint that fails to escape the label parameter before storage. An unauthenticated attacker can inject malicious HTML through the label parameter,...

CVE-2026-88869 AVideo AD_Server Stored XSS via log.php label parameter

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the ADServer plugin's log.php endpoint that fails to escape the label parameter before storage. An unauthenticated attacker can inject malicious HTML through the label parameter,...

EUVD-2026-75418

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LiveLinks plugin where title and description fields are stored without sanitization. A user with canStream permission can inject malicious scripts that execute in the browser...

CVE-2026-88869

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is affected by a stored cross-site scripting (XSS) vulnerability in the AD_Server plugin 's log.php endpoint. The endpoint fails to escape the label parameter before storage, allowing an unauthenticated attacker to inject malicious HT...

CVE-2026-88867

WWBN AVideo (up to commit c3edcc274c389816d434acadac07ee78eaf330c1 ) is affected by a stored cross-site scripting (XSS) vulnerability. The endpoint objects/categoryAddNew.json.php passes the POST parameters name and iconClass into Category::setName() and Category::setIconClass() without sanitizat...

EUVD-2026-75417

WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-site scripting vulnerability. objects/categoryAddNew.json.php passes the POST parameters name and iconClass to Category::setName and Category::setIconClass, which store the values...

CVE-2026-88867 WWBN AVideo Stored XSS via Category Name and Icon Class

WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-site scripting vulnerability. objects/categoryAddNew.json.php passes the POST parameters name and iconClass to Category::setName and Category::setIconClass, which store the values...

EUVD-2026-75416

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to encode the User-Agent header before storing it in login history. Attackers with any valid login account can inject malicious scripts in...

CVE-2026-88866

WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1 ) contains a stored cross-site scripting vulnerability in the LoginControl plugin . The plugin fails to encode the User-Agent header before storing it in the login history. An attacker with any valid login account can inject mal...

CVE-2025-65754

CVE-2025-65754 : Algernon 1.17.4におけるStored XSS 説明 Algernon v1.17.4は、攻撃者が巧妙に細工されたペイロードをファイル名に注入することで任意のコードを実行できるクロスサイトスクリプティング（XSS）の脆弱性の影響を受けます。 影響を受けるプロジェクト : Algernon - 1.17.4 プロジェクトメンテナ : Alexander F. Rødseth xyproto 脆弱性タイプ : クロスサイトスクリプティング（XSS） 攻撃ベクトル :...

CVE-2025-65676

CVE-2025-65676 Classroomio LMS 0.1.13における格納型クロスサイトスクリプティング（XSS）の脆弱性により、認証された攻撃者が細工されたSVGカバー画像を介して任意のコードを実行可能です。発見者：Rivek Raj Tamang（RivuDon）、シッキム州、インド。 影響を受ける製品：ClassroomIO 影響を受けるバージョン：0.1.13 発見者：Rivek Raj Tamang RivuDon、シッキム州、インド 脆弱性の詳細 格納型クロスサイトスクリプティング 概要 Classroomio...