121 matches found
CVE-2026-54714 Logto: XSS via unescaped RelayState in SAML auto-submit form
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, @logto/core reflected the SAML RelayState, SAMLResponse, and actionUrl into a Logto-origin auto-submit HTML form in packages/core/src/saml-application/SamlApplication/utils.ts without HTML-attribute...
CVE-2026-37700
Cross Site Scripting vulnerability in MaxSite CMS v.109.2 allows a remote attacker to obtain sensitive information via the Backend page file upload endpoint used by adminpage...
EUVD-2026-14494
AVideo vulnerable to Stored XSS via htmlentitydecode Reversing xssesc Sanitization in Channel About Field...
CVE-2026-33683
WWBN AVideo is an open source video platform. In versions up to and including 26.0, a sanitization order-of-operations flaw in the user profile "about" field allows any registered user to inject arbitrary JavaScript that executes when other users visit their channel page. The xssesc function...
CVE-2025-8303 XSS in EKA Software's Real Estate Script V5 (With Doping Module – Store Module – New Language System)
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in EKA Software Computer Information Advertising Services Ltd. Real Estate Script V5 With Doping Module – Store Module – New Language System allows Cross-Site Scripting XSS. This issue affects...
PT-2026-7105
In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible...
CVE-2018-19525
An issue was discovered on Systrome ISG-600C, ISG-600H, and ISG-800W 1.1-R2.1TRUNK-20180914.bin devices. There is CSRF via /ui/?g=objkeywordsadd and /ui/?g=objkeywordsaddsave with resultant XSS because of a lack of csrf token validation...
CVE-2016-10873
The wp-database-backup plugin before 4.3.3 for WordPress has XSS...
PT-2025-49822
Name of the Vulnerable Software and Affected Versions pxc PortCfg.php affected versions not specified Description An XSS issue exists in the pxc PortCfg.php file. An unauthenticated remote attacker can potentially trick an authenticated user into clicking a malicious link, allowing the attacker t...
CVE-2024-46336
kashipara School Management System 1.0 is vulnerable to Cross Site Scripting XSS via /clientuser/feedback.php...
EUVD-2011-3316
Malware in sbrugna...
EUVD-2021-1269
Malware in sbrugna...
EUVD-2018-17434
Malware in sbrugna...
EUVD-2017-16551
Malware in sbrugna...
EUVD-2020-18285
Malware in sbrugna...
EUVD-2021-1193
Malware in sbrugna...
EUVD-2021-1240
Malware in sbrugna...
EUVD-2018-3437
Malware in sbrugna...