50 matches found
CVE-2026-35208
CVE-2026-35208 affects lichess.org: an Unsanitized Stream Title Injection occurs in the streamer workflow where approved streamers can inject HTML into the /streamer page and the Live streams widget by providing a title, which is rendered in the UI as-is. CSP blocks inline scripts, but the vulner...
CVE-2026-32243
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an attacker with the ability to create shared AI conversations could inject arbitrary HTML and JavaScript via crafted...
GHSA-H2XQ-H7F9-VH6C XWiki Blog Application home page vulnerable to Stored XSS via Post Title
Impact The Blog Application is vulnerable to Stored Cross-Site Scripting XSS via the Blog Post Title. The vulnerability arises because the post title is injected directly into the HTML tag without proper escaping. An attacker with permissions to create or edit blog posts can inject malicious...
CVE-2026-28355
Canarytokens help track activity and actions on a network. Versions prior to sha-7ff0e12 have a Self Cross-Site Scripting vulnerability in the "PWA" Canarytoken, whereby the Canarytoken's creator can attack themselves or someone they share the link with. The creator of a PWA Canarytoken can inser...
CVE-2026-28355
The CVE-2026-28355 entry covers a Self Cross-Site Scripting (XSS) vulnerability in the Canarytokens “PWA” Canarytoken. Affected component is the title field of the PWA token; versions prior to sha-7ff0e12 allow the creator to inject JavaScript that executes when the installation page is visited b...
CVE-2026-28355
Canarytokens help track activity and actions on a network. Versions prior to sha-7ff0e12 have a Self Cross-Site Scripting vulnerability in the "PWA" Canarytoken, whereby the Canarytoken's creator can attack themselves or someone they share the link with. The creator of a PWA Canarytoken can inser...
CVE-2026-27701 LiveCodes vulnerable to JavaScript Injection via untrusted PR title in i18n-update-pull workflow
LiveCode is an open-source, client-side code playground. Prior to commit e151c64c2bd80d2d53ac1333f1df9429fe6a1a11, LiveCode's i18n-update-pull GitHub Actions workflow is vulnerable to JavaScript injection. The title of the Pull Request associated with the triggering issue comment is interpolated...
GitLab Enterprise Edition（EE）和GitLab Community Edition（CE） 安全漏洞
GitLab Enterprise Edition EE and GitLab Community Edition CE are both products of the American company GitLab. GitLab Enterprise Edition is a content management system. GitLab Community Edition is a community version of GitLab. There were security vulnerabilities in versions prior to 18.6.6,...
PT-2026-5134
Name of the Vulnerable Software and Affected Versions PodcastGenerator version 3.2.9 Description A stored cross-site scripting XSS issue exists in the 'Create New Live Item' functionality. This allows remote attackers to inject arbitrary script or HTML through the 'TITLE', 'SHORT DESCRIPTION', an...
CVE-2018-25132 MyBB Trending Widget Plugin 1.2 - Cross-Site Scripting
MyBB Trending Widget Plugin 1.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through thread titles. Attackers can modify thread titles with script payloads that will execute when other users view the trending widget...
Salvo is vulnerable to reflected XSS in the list_html function
Summary The function listhtml generates an file view of a folder which includes a render of the current path, in which its inserted in the HTML without proper sanitation, leading to reflected XSS. The request path is decoded and normalized in the matching stage but is not inserted raw in the HTML...
CVE-2023-53977 myBB Forums 1.8.26 Stored Cross-Site Scripting via Forum Management
myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the forum management system that allows authenticated administrators to inject malicious scripts when creating new forums. Attackers can exploit this vulnerability by inserting script payloads in the forum title field when...
EUVD-2013-5155
Malware in sbrugna...
CVE-2025-52132
The Mocca Calendar application before 2.15 for XWiki allows XSS via a title to the view event page...
CVE-2024-37395
REDCap 13.1.9.x stores XSS in the Public Survey page: authenticated users can inject scripts via the Survey Title and Survey Instructions. The vulnerability triggers when the survey is accessed via its public link. Remediation is to update to 14.2.1 or later (per the CVE description). The connect...
CVE-2024-42699
Summary: CVE-2024-42699 is a Cross-Site Scripting (XSS) vulnerability in Alkacon OpenCMS 17.0, exploitable via the Create/Modify article image field title sub-field. The root cause is insufficient input sanitization allowing an attacker to inject JavaScript that is stored and later reflected to u...
Exploit for Improper Validation of Specified Type of Input in Servicenow
CVE-2024-4879-ServiceNow ServiceNow is a platform for busi...
PT-2022-26169 · Flarum · Flarum
Name of the Vulnerable Software and Affected Versions: Flarum versions 1.5.0 through 1.6.1 Description: The issue arises from Flarum's page title system, which allowed page titles to be converted into HTML DOM nodes when pages were rendered. This enabled an attacker to inject malicious HTML marku...
CVE-2022-43170
A stored cross-site scripting XSS vulnerability in the Dashboard Configuration feature index.php?module=dashboardconfigure/index of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter after clicking "Ad...