Lucene search
+L

99309 matches found

OSV
OSV
added 2026/07/14 3:17 p.m.17 views

AZL-92321 CVE-2026-58475 affecting package sip 4.19.25-13

Sustainable Irrigation Platform SIP through version 5.2.16 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by supplying malicious script payloads within program names submitted via HTTP requests. Attackers can exploit the...

6.1CVSS6AI score0.00311EPSS
SaveExploits3References1
Cvelist
Cvelist
added 2026/07/14 3:07 p.m.38 views

CVE-2026-52838 Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS

Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 allow administrators to define a custom "booking disabled" message through the booking settings page. That value is stored in the disablebookingmessage setting via a rich-text editor and later passed directly to the...

2.6CVSS0.00243EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/07/14 3:07 p.m.11 views

CVE-2026-52838 Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS

Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 allow administrators to define a custom "booking disabled" message through the booking settings page. That value is stored in the disablebookingmessage setting via a rich-text editor and later passed directly to the...

2.6CVSS6.1AI score0.00243EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/14 3:07 p.m.18 views

CVE-2026-52838 Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS

Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 allow administrators to define a custom "booking disabled" message through the booking settings page. That value is stored in the disablebookingmessage setting via a rich-text editor and later passed directly to the...

2.6CVSS6.1AI score
SaveExploits0References4
CVE
CVE
added 2026/07/14 3:05 p.m.45 views

CVE-2026-9292

Technical details about CVE-2026-9292 are not publicly available in the provided documents; monitor for updates.

8.4CVSS6.2AI score0.00527EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/07/14 3:05 p.m.16 views

CVE-2026-9292 Rockwell Automation FactoryTalk® DataMosaix™ Private Cloud - Stored Cross-Site Scripting

A Stored Cross-Site Scripting security issue exists within FactoryTalk® DataMosaix™ Private Cloud. The vulnerability stems from improper neutralization of user-supplied input within the Workflows configuration. An authenticated attacker with high privileges can inject malicious scripts that are...

8.4CVSS6.2AI score0.00527EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/14 2:44 p.m.30 views

CVE-2026-58479

CVE-2026-58479 affects Sustainable Irrigation Platform (SIP) 5.x, specifically via the optional cli_control plugin. The vulnerability enables remote code execution (RCE) by storing a malicious payload through the plugin’s HTTP endpoint and then activating the associated irrigation station. The ro...

9.8CVSS6.3AI score0.04404EPSS
SaveExploits2References2Affected Software1
Vulnrichment
Vulnrichment
added 2026/07/14 2:19 p.m.14 views

CVE-2026-58475 Sustainable Irrigation Platform 5.2.16 Stored XSS via Program Name

Sustainable Irrigation Platform SIP through version 5.2.16 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by supplying malicious script payloads within program names submitted via HTTP requests. Attackers can exploit the...

6.1CVSS6.3AI score0.00311EPSS
SaveExploits3References2
Cvelist
Cvelist
added 2026/07/14 2:19 p.m.47 views

CVE-2026-58475 Sustainable Irrigation Platform 5.2.16 Stored XSS via Program Name

Sustainable Irrigation Platform SIP through version 5.2.16 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by supplying malicious script payloads within program names submitted via HTTP requests. Attackers can exploit the...

6.1CVSS0.00311EPSS
SaveExploits3References2
attackerkb
attackerkb
added 2026/07/14 2:19 p.m.13 views

CVE-2026-58475

Sustainable Irrigation Platform SIP through version 5.2.16 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by supplying malicious script payloads within program names submitted via HTTP requests. Attackers can exploit the...

6.1CVSS6.3AI score0.00311EPSS
SaveExploits3References3
EUVD
EUVD
added 2026/07/14 2:19 p.m.20 views

EUVD-2026-43681

Sustainable Irrigation Platform SIP through version 5.2.16 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by supplying malicious script payloads within program names submitted via HTTP requests. Attackers can exploit the...

6.1CVSS6.3AI score0.00311EPSS
SaveExploits3References2
CVE
CVE
added 2026/07/14 2:19 p.m.29 views

CVE-2026-58475

CVE-2026-58475 affects Sustainable Irrigation Platform (SIP) v5.2.16, where an attacker can store arbitrary JavaScript in program names via HTTP requests due to lack of output encoding. This stored XSS can render in browsers of any user viewing affected pages. Exploitation details from the ZerOSc...

6.1CVSS6.3AI score0.00311EPSS
SaveExploits3References2Affected Software1
OSV
OSV
added 2026/07/14 8:45 a.m.10 views

BIT-GRAFANA-2026-8595 Stored XSS in the table panel (TableNG)

A user with Editor permissions can craft a dashboard whose table TableNG panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard stored cross-site scripting...

6.8CVSS6AI score0.0024EPSS
SaveExploits0References2
Patchstack
Patchstack
added 2026/07/14 7:07 a.m.21 views

WordPress bbp style pack plugin <= 6.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Catalin Oancea 0x4D5A in WordPress Plugin bbp style pack versions = 6.4.5...

6.4CVSS6.1AI score0.00331EPSS
SaveExploits0References1Affected Software1
NVD
NVD
added 2026/07/14 6:16 a.m.17 views

CVE-2025-15665

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.1 does not escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end the value is passed through doshortcode, which echoes non-shortcode content verbatim, allowing users with...

5.4CVSS0.00226EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/14 6:00 a.m.34 views

CVE-2025-15665

The Ultimate Before After Image Slider & Gallery WordPress plugin, in versions prior to 4.7.1 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to escape the value of the BEAF Slider widget's shortcode field before it is output on the front end. Because the valu...

6.1AI score0.00226EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/14 6:00 a.m.51 views

CVE-2025-15665 BEAF < 4.7.1 - Admin+ Stored XSS via Widget Shortcode Field

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.1 does not escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end the value is passed through doshortcode, which echoes non-shortcode content verbatim, allowing users with...

0.00226EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/07/14 6:00 a.m.20 views

EUVD-2025-210458

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.1 does not escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end the value is passed through doshortcode, which echoes non-shortcode content verbatim, allowing users with...

5.4CVSS6.1AI score0.00226EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/14 2:16 a.m.16 views

CVE-2026-7640

The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute of the customer-area-protected-content shortcode in all versions up to, and including, 8.3.5. This is due to insufficient input sanitization and output escaping on the shortcode...

6.4CVSS0.00331EPSS
SaveExploits0References5
NVD
NVD
added 2026/07/14 2:16 a.m.18 views

CVE-2026-11390

The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Site Logo Title and Single Author Box Widgets in all versions up to, and including, 1.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

6.4CVSS0.00438EPSS
SaveExploits0References9
Rows per page
Query Builder