EUVD-2026-72956

An authenticated stored cross-site scripting XSS vulnerability in the Column Management component of ClassCMS 1CMS v5.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the title field...

PT-2026-87172

An authenticated stored cross-site scripting XSS vulnerability in the Column Management component of ClassCMS 1CMS v5.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the title field...

CVE-2026-52307

An authenticated stored cross-site scripting XSS vulnerability in the Column Management component of ClassCMS 1CMS v5.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the title field...

CVE-2026-52307

An authenticated stored cross-site scripting XSS vulnerability in the Column Management component of ClassCMS 1CMS v5.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the title field...

Exploit for CVE-2026-36392

CVE-2026-36392: Stored XSS in RISE CRM Item Title Field Su...

CVE-2026-86278 SourceCodester Syllabus-Aligned Learning Management & Examination System manage_subjects.php cross site scripting

A vulnerability was found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The affected element is an unknown function of the file managesubjects.php. The manipulation of the argument msg/title/content results in cross site scripting. The attack may be performed fr...

CVE-2026-86278 SourceCodester Syllabus-Aligned Learning Management & Examination System manage_subjects.php cross site scripting

A vulnerability was found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The affected element is an unknown function of the file managesubjects.php. The manipulation of the argument msg/title/content results in cross site scripting. The attack may be performed fr...

VulnCheck KEV: CVE-2025-6068

The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-caption-title & data-caption-description HTML attributes in all versions up to, and including, 2.4.31 due to insufficient input...

CVE-2026-38961

Cross-Site Scripting XSS vulnerability in the RSS Widget of Netgate pfSense Plus versions 26.03, 25.11.1 and pfSense CE version 2.8.1 allows remote authenticated attackers to inject arbitrary JavaScript via malicious content in an RSS feed title. The injected script executes in the browser of any...

CVE-2026-38961

Cross-Site Scripting XSS vulnerability in the RSS Widget of Netgate pfSense Plus versions 26.03, 25.11.1 and pfSense CE version 2.8.1 allows remote authenticated attackers to inject arbitrary JavaScript via malicious content in an RSS feed title. The injected script executes in the browser of any...

CVE-2026-38961

A Cross-Site Scripting (XSS) vulnerability exists in the RSS Widget of Netgate pfSense Plus (versions 26.03, 25.11.1) and pfSense CE (version 2.8.1). The root cause is insufficient sanitization of feed title data before it is rendered in the widget. This allows remote authenticated attackers to i...

CVE-2026-38961

Cross-Site Scripting XSS vulnerability in the RSS Widget of Netgate pfSense Plus versions 26.03, 25.11.1 and pfSense CE version 2.8.1 allows remote authenticated attackers to inject arbitrary JavaScript via malicious content in an RSS feed title. The injected script executes in the browser of any...

PT-2026-85780

CVE-2026-38961: Stored XSS in Netgate pfSense RSS Widget versions 26.03, 25.11.1, CE 2.8.1. Malicious feed titles execute JS for any authenticated user viewing the dashboard. CVSS: N/A. Unpatched—restrict RSS access now. Details: https://t.co/XaOt7Xazw4 cybersecurit valtersit CVE CVEAlert infosec...

SiYuan: Cross-boundary metadata disclosure via getBlockInfo (publish mode): reader-reachable document title/root info for publish-forbidden docs; sibling getDocInfo is filtered

CVE: This vulnerability corresponds to CVE-2026-68585. Summary The /api/block/getBlockInfo endpoint returns document root metadata including the document title rootTitle for a block in a publish-forbidden document, with no publish-access check. Its sibling /api/block/getDocInfo applies the...

CVE-2026-82024

LearnPress WordPress Plugin before 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers with the Instructor role to inject persistent malicious payloads by submitting unsanitized input into quiz question answer title fields. Attackers can store arbitrary...

EUVD-2026-70651

LearnPress WordPress Plugin before 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers with the Instructor role to inject persistent malicious payloads by submitting unsanitized input into quiz question answer title fields. Attackers can store arbitrary...

CVE-2026-85106

A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/app/artifacts/index.tsx of the component Link Title Fetch. Such manipulation of the argument url leads to server-side request forgery. The attack can be launch...

EUVD-2026-70413

A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/app/artifacts/index.tsx of the component Link Title Fetch. Such manipulation of the argument url leads to server-side request forgery. The attack can be launch...

CVE-2026-85106 NousResearch hermes-agent Link Title Fetch index.tsx fetchLinkTitle server-side request forgery

A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/app/artifacts/index.tsx of the component Link Title Fetch. Such manipulation of the argument url leads to server-side request forgery. The attack can be launch...

CVE-2026-85106

A server-side request forgery (SSRF) vulnerability exists in NousResearch hermes-agent 0.18.0 , specifically in the fetchLinkTitle function within the file apps/desktop/src/app/artifacts/index.tsx (component: Link Title Fetch). Manipulating the url argument allows a remote attacker with low privi...