Lucene search
+L

99377 matches found

OSV
OSV
•added 2026/07/15 5:50 p.m.•23 views

CVE-2026-62948 OpenWrt odhcpd/LuCI: unauthenticated DHCPv6 client can inject lease-file lines via FQDN hostname → stored XSS in the LuCI admin UI

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefileswritestate6 and statefileswritestate4 without escaping, allowing newline injection of forged lease lin...

9.6CVSS6.1AI score
SaveExploits0References7
CVE
CVE
•added 2026/07/15 4:50 p.m.•50 views

CVE-2026-62378

RustFS Console is affected in versions 0.1.7–0.1.10. The vulnerability lies in the components/object/preview-modal.tsx and components/object/pdf-viewer.tsx extension-based PDF preview path, which can render HTML content uploaded as .pdf, enabling a stored XSS in the management console. This can l...

9CVSS6AI score0.0049EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment
•added 2026/07/15 4:50 p.m.•19 views

CVE-2026-62378 RustFS Console: Critical Stored XSS in Preview Modal leading to Administrative Account Takeover

RustFS Console is a web management console for the RustFS distributed file system. From 0.1.7 until 0.1.10, the RustFS Console components/object/preview-modal.tsx and components/object/pdf-viewer.tsx extension-based PDF preview path can render HTML content uploaded as .pdf, allowing stored...

9CVSS6AI score0.0049EPSS
SaveExploits0References3
OSV
OSV
•added 2026/07/15 4:50 p.m.•12 views

CVE-2026-62378 RustFS Console: Critical Stored XSS in Preview Modal leading to Administrative Account Takeover

RustFS Console is a web management console for the RustFS distributed file system. From 0.1.7 until 0.1.10, the RustFS Console components/object/preview-modal.tsx and components/object/pdf-viewer.tsx extension-based PDF preview path can render HTML content uploaded as .pdf, allowing stored...

9CVSS6AI score
SaveExploits0References5
EUVD
EUVD
•added 2026/07/15 4:50 p.m.•22 views

EUVD-2026-44728

RustFS Console is a web management console for the RustFS distributed file system. From 0.1.7 until 0.1.10, the RustFS Console components/object/preview-modal.tsx and components/object/pdf-viewer.tsx extension-based PDF preview path can render HTML content uploaded as .pdf, allowing stored...

9CVSS6AI score0.0049EPSS
SaveExploits1References3
Cvelist
Cvelist
•added 2026/07/15 4:50 p.m.•61 views

CVE-2026-62378 RustFS Console: Critical Stored XSS in Preview Modal leading to Administrative Account Takeover

RustFS Console is a web management console for the RustFS distributed file system. From 0.1.7 until 0.1.10, the RustFS Console components/object/preview-modal.tsx and components/object/pdf-viewer.tsx extension-based PDF preview path can render HTML content uploaded as .pdf, allowing stored...

9CVSS0.0049EPSS
SaveExploits0References3
attackerkb
attackerkb
•added 2026/07/15 4:50 p.m.•25 views

CVE-2026-62378

RustFS Console is a web management console for the RustFS distributed file system. From 0.1.7 until 0.1.10, the RustFS Console components/object/preview-modal.tsx and components/object/pdf-viewer.tsx extension-based PDF preview path can render HTML content uploaded as .pdf, allowing stored...

9CVSS6AI score0.0049EPSS
SaveExploits0References4Affected Software1
Cvelist
Cvelist
•added 2026/07/15 4:37 p.m.•55 views

CVE-2026-1562 Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.

Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting XSS vulnerability in a user interface component. Requires a high privileged user with a developer role...

4.6CVSS0.00242EPSS
SaveExploits0References1
CVE
CVE
•added 2026/07/15 4:37 p.m.•48 views

CVE-2026-1562

The CVE-2026-1562 entry concerns Pega Platform versions 8.1.0 through 25.1.2 with a Stored Cross‑site Scripting (XSS) vulnerability in a user interface component. The flaw arises in a UI component and requires a high-privilege user with a developer role to exploit. Affected versions and impact ar...

4.8CVSS6.1AI score0.00242EPSS
SaveExploits0References1Affected Software1
OSV
OSV
•added 2026/07/15 3:58 p.m.•15 views

BIT-PROMETHEUS-2026-40179 Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer

Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the Prometheus web UI where metric names and label values are injected into innerHTML without...

6.1CVSS5.9AI score0.00313EPSS
SaveExploits1References4
OSV
OSV
•added 2026/07/15 3:56 p.m.•13 views

BIT-DISCOURSE-2026-55424 Discourse: Topic featured link susceptible to stored XSS

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a topic "featured link" was not sufficiently normalized and escaped before being rendered in the topic list, allowing a user who can set a featured link to inject JavaScript when default Content...

7.4CVSS6.1AI score0.00415EPSS
SaveExploits0References10
OSV
OSV
•added 2026/07/15 3:56 p.m.•14 views

BIT-DISCOURSE-2026-53963 Discourse: Stored-XSS in 2FA delete confirmation modal

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a malicious second factor name on an attacker-controlled account was not escaped in the delete confirmation dialog, allowing stored cross-site scripting when an administrator impersonated that...

9CVSS6.1AI score0.00735EPSS
SaveExploits0References10
NVD
NVD
•added 2026/07/15 12:18 p.m.•19 views

CVE-2026-56398

Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type is inferred from file extension rather than Content-Type header, allowing SVG files to bypass the profile image validator and be stored as data URIs...

9CVSS0.00635EPSS
SaveExploits1References2
OSV
OSV
•added 2026/07/15 11:25 a.m.•20 views

CVE-2026-56398 Open WebUI - Stored Cross-Site Scripting via OAuth Picture Claim SVG Data URI

Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type is inferred from file extension rather than Content-Type header, allowing SVG files to bypass the profile image validator and be stored as data URIs...

8.5CVSS6.2AI score
SaveExploits0References4
attackerkb
attackerkb
•added 2026/07/15 9:01 a.m.•15 views

CVE-2026-58077

Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics 5.0.2 - The Joomla extension 4Analytics is vulnerable to an unauthenticated stored XSS. A specially crafted unauthenticated request may result in website takeover under some circumstances...

8.7CVSS5.2AI score0.00436EPSS
SaveExploits0References2Affected Software1
Cvelist
Cvelist
•added 2026/07/15 9:01 a.m.•55 views

CVE-2026-58077 Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2

Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics 5.0.2 - The Joomla extension 4Analytics is vulnerable to an unauthenticated stored XSS. A specially crafted unauthenticated request may result in website takeover under some circumstances...

8.7CVSS0.00436EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
•added 2026/07/15 12:00 a.m.•31 views

PT-2026-58891

The Joomla extension 4Analytics is vulnerable to an unauthenticated stored XSS in relation to the AI analysis feature...

8.6CVSS6.1AI score0.00436EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/07/15 12:00 a.m.•40 views

PT-2026-60228

Name of the Vulnerable Software and Affected Versions RustFS Console versions 0.1.7 through 0.1.9 Description The web management console allows stored cross-site scripting XSS because the PDF preview path in components/object/preview-modal.tsx and components/object/pdf-viewer.tsx can render HTML...

9CVSS4.8AI score0.0049EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2026/07/15 12:00 a.m.•35 views

PT-2026-60235

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.1 Splunk Enterprise versions prior to 10.2.5 Splunk Enterprise versions prior to 10.0.8 Splunk Enterprise versions prior to 9.4.13 Splunk Cloud Platform versions prior to 10.5.2605.0 Splunk Cloud Platfo...

6.5CVSS6.1AI score0.00324EPSS
SaveExploits0References6
Packet Storm
Packet Storm
•added 2026/07/15 12:00 a.m.•82 views

📄 xxl-job Cross Site Scripting

A persistent cross site scripting vulnerability exists in xxl-job-admin JobInfoController.java where the addressList parameter accepts unsanitized URL‑encoded JavaScript. xxl-job versions prior to 3.4.0 are affected. Description Summary A stored Cross‑Site Scripting vulnerability exists in...

6.1CVSS5.7AI score0.0042EPSS
SaveExploits1
Rows per page
Query Builder