1047379 matches found
CVE-2026-73374 Stored Cross-Site Scripting (XSS) via Unescaped CNA Reference Tags in vulnerability-lookup
A stored cross-site scripting XSS vulnerability existed in Vulnerability-Lookup in the rendertagbadges Jinja filter used to display reference tags associated with vulnerability records. Values from containers.cna.references.tags were directly interpolated into HTML badge elements and the resultin...
CVE-2026-73374
CVE-2026-73374 describes a stored XSS in Vulnerability-Lookup’s render_tag_badges Jinja filter. Values from containers.cna.references[].tags[] were interpolated into HTML badge markup and wrapped with MarkupSafe.Markup, bypassing Jinja escaping. An authenticated user with vulnerability:create/mod...
CVE-2026-73374
A stored cross-site scripting XSS vulnerability existed in Vulnerability-Lookup in the rendertagbadges Jinja filter used to display reference tags associated with vulnerability records. Values from containers.cna.references.tags were directly interpolated into HTML badge elements and the resultin...
CVE-2026-57858
Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID without sanitization. Attackers can close th...
CLSA-2026-1786539981 TuxCare security update for DOMPurify (10 CVEs)
TuxCare rebuilt DOMPurify to address 10 CVEs. Fixed in 2.3.0-tuxcare.1...
WordPress M.Anh theme <= 1.7 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme M.Anh versions = 1.7...
WordPress GiveWP plugin < 4.16.6 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Asim Alshaya in WordPress Plugin GiveWP versions 4.16.6...
CVE-2026-57858 Cal.com Cal.diy 6.2.0 Stored XSS via BookingPageTagManager Analytics Tracking ID
Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID without sanitization. Attackers can close th...
CVE-2026-57858
CVE-2026-57858 affects Cal.com Cal.diy (versions 2.1.1–6.2.0). The stored XSS arises in BookingPageTagManager through an unsanitized analytics tracking ID, allowing an authenticated event owner to inject JavaScript that can run in visitors’ browsers. Reported impact includes potential session coo...
EUVD-2026-57195
Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID without sanitization. Attackers can close th...
CVE-2026-57858
Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID without sanitization. Attackers can close th...
CVE-2026-57858 Cal.com Cal.diy 6.2.0 Stored XSS via BookingPageTagManager Analytics Tracking ID
Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID without sanitization. Attackers can close th...
CVE-2026-70560
Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...
dvwa-rce-finding-chain
DVWA Finding Chain: Stored XSS to Persistent RCE A pentes...
CVE-2026-70560
CVE-2026-70560 affects Ultimate POS (Stock Management & Point of Sale). A stored XSS vulnerability allows low-privileged authenticated users to inject arbitrary HTML/script by submitting a malicious payload in the user first-name field during account creation. When such a user with a low-privileg...
CVE-2026-70560 Ultimate POS Stored XSS via First Name Field in Leave Notifications
Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...
EUVD-2026-57170
Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...
CVE-2026-70560
Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...
WordPress Business Directory plugin <= 6.4.25 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Minhyeok Lee in WordPress Plugin Business Directory versions = 6.4.25...
WordPress Maspik – Spam blacklist plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ivaylo Atanassov in WordPress Plugin Maspik – Spam blacklist versions = 2.9.1...