Lucene search
+L

1050104 matches found

CVE
CVE
added 2026/04/01 12:00 a.m.34 views

CVE-2026-30526

CVE-2026-30526 affects SourceCodester Zoo Management System v1.0. The vulnerability is located on the login page in the msg parameter, where user-supplied content is echoed back without proper HTML encoding/sanitization, enabling a reflected XSS via a crafted URL. The connected documents confirm ...

6.1CVSS6AI score0.00252EPSS
SaveExploits1References1Affected Software1
OpenVAS
OpenVAS
added 2026/04/01 12:00 a.m.9 views

Mageia: Security Advisory (MGASA-2026-0075)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

7.5CVSS5.9AI score0.00665EPSS
SaveExploits2References4
Amazon
Amazon
added 2026/04/01 12:00 a.m.19 views

Medium: golist

Issue Overview: url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which t...

7.5CVSS7.1AI score0.00728EPSS
SaveExploits0
CNNVD
CNNVD
added 2026/04/01 12:00 a.m.20 views

CI4MS 跨站脚本漏洞

CI4MS is an open-source blog page management tool developed by Ci4MS. Versions of CI4MS prior to 0.31.0.0 contained a cross-site scripting vulnerability. This vulnerability stemmed from the improper cleaning of user input when adding pages through the menu management feature, which could lead to...

9.1CVSS5.7AI score0.00307EPSS
SaveExploits1References2
CNNVD
CNNVD
added 2026/04/01 12:00 a.m.17 views

Cisco Integrated Management Controller(IMC) 跨站脚本漏洞

The Cisco Integrated Management Controller IMC is a set of software developed by Cisco Corporation in the United States, used for managing UCS Unified Computing System environments. This software supports HTTP and SSH access, and allows operations such as starting, stopping, and restarting server...

4.8CVSS5.7AI score0.00237EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/04/01 12:00 a.m.21 views

PT-2026-29432

XenForo before 2.3.10 and before 2.2.19 is vulnerable to stored cross-site scripting XSS in structured text mentions, primarily affecting legacy profile post content. An attacker can inject malicious scripts through crafted mentions that are stored and executed when other users view the content...

6.4CVSS5.8AI score0.00165EPSS
SaveExploits1References4
Positive Technologies
Positive Technologies
added 2026/04/01 12:00 a.m.12 views

PT-2026-29670

Summary The sanitization pipeline for FAQ content is: 1. Filter::filterVar$input, FILTER SANITIZE SPECIAL CHARS — encodes , ", ', & to HTML entities 2. html entity decode$input, ENT QUOTES | ENT HTML5 — decodes entities back to characters 3. Filter::removeAttributes$input — removes dangerous HTML...

6.1CVSS5.9AI score0.00241EPSS
SaveExploits1References5
Vulnrichment
Vulnrichment
added 2026/04/01 12:00 a.m.6 views

CVE-2026-29598

Multiple stored cross-site scripting XSS vulnerabilities in the submitadduser.asp endpoint of DDSN Interactive Acora CMS v10.7.1 allow attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the First Name and Last Name parameters...

6AI score0.0016EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/04/01 12:00 a.m.23 views

PT-2026-29625

Name of the Vulnerable Software and Affected Versions: CI4MS versions prior to 0.31.0.0 Description: CI4MS is a CodeIgniter 4-based CMS skeleton. Prior to version 0.31.0.0, the application renders user-controlled input unsafely within the logs interface, leading to a stored DOM Blind XSS scenario...

9.1CVSS6.2AI score0.0038EPSS
SaveExploits1References9
OSV
OSV
added 2026/03/31 11:28 p.m.13 views

GHSA-RX4H-526Q-4458 SiYuan: Stored XSS in Attribute View Gallery/Kanban Cover Rendering Allows Arbitrary Command Execution in Desktop Client

Summary An attacker who can place a malicious URL in an Attribute View mAsse field can trigger stored XSS when a victim opens the Gallery or Kanban view with “Cover From - Asset Field” enabled. The vulnerable code accepts arbitrary https URLs without extensions as images, stores the...

9CVSS6.7AI score0.00489EPSS
SaveExploits1References5
OSV
OSV
added 2026/03/31 11:27 p.m.6 views

GHSA-MG36-WVCR-M75H Nuxt OG Image is vulnerable to reflected XSS via query parameter injection into HTML attributes

Product: Nuxt OG Image Version: 6.1.2 CWE-ID: CWE-79: Improper Neutralization of Input During Web Page Generation Description: Incorrect parsing of GET parameters leads to the possibility of HTML injection and JavaScript code injection. Impact: Client-Side JavaScript Execution Exploitation...

6.1CVSS6AI score0.00216EPSS
SaveExploits1References3
Github Security Blog
Github Security Blog
added 2026/03/31 11:22 p.m.15 views

AVideo has Stored XSS via Unescaped Plugin Configuration Values in Admin Panel

Summary The AVideo admin panel renders plugin configuration values in HTML forms without applying htmlspecialchars or any other output encoding. The jsonToFormElements function in admin/functions.php directly interpolates user-controlled values into textarea contents, option elements, and input...

6.1CVSS6.3AI score0.00217EPSS
SaveExploits1References4Affected Software1
Github Security Blog
Github Security Blog
added 2026/03/31 11:12 p.m.15 views

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Summary Graby's cleanupXss function configures htmLawed with conflicting settings: safe=1 which removes combined with 'elements' = '+iframe-meta' which re-enables . htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is render...

6AI score
SaveExploits0References4Affected Software1
OSV
OSV
added 2026/03/31 10:48 p.m.14 views

GHSA-98GW-W575-H2PH phpMyFAQ is Vulnerable to Stored XSS via Unsanitized Email Field in Admin FAQ Editor

Summary An unauthenticated attacker can submit a guest FAQ with an email address that is syntactically valid per RFC 5321 quoted local part yet contains raw HTML — for example "alert1"@evil.com. PHP's FILTERVALIDATEEMAIL accepts this email as valid. The email is stored in the database without HTM...

6.4CVSS5.9AI score0.00262EPSS
SaveExploits1References4
NVD
NVD
added 2026/03/31 10:16 p.m.12 views

CVE-2026-34448

SiYuan is a personal knowledge management system. Prior to version 3.6.2, an attacker who can place a malicious URL in an Attribute View mAsse field can trigger stored XSS when a victim opens the Gallery or Kanban view with “Cover From - Asset Field” enabled. The vulnerable code accepts arbitrary...

9CVSS0.00489EPSS
SaveExploits1References3
Vulnrichment
Vulnrichment
added 2026/03/31 9:50 p.m.9 views

CVE-2026-34605 SiYuan: Reflected XSS via SVG namespace prefix bypass in SanitizeSVG ( getDynamicIcon, unauthenticated )

SiYuan is a personal knowledge management system. From version 3.6.0 to before version 3.6.2, the SanitizeSVG function introduced in version 3.6.0 to fix XSS in the unauthenticated /api/icon/getDynamicIcon endpoint can be bypassed by using namespace-prefixed element names such as . The Go HTML5...

8.6CVSS5.7AI score0.00469EPSS
SaveExploits1References3
ATTACKERKB
ATTACKERKB
added 2026/03/31 9:47 p.m.9 views

CVE-2026-34585

SiYuan is a personal knowledge management system. Prior to version 3.6.2, a vulnerability allows crafted block attribute values to bypass server-side attribute escaping when an HTML entity is mixed with raw special characters. An attacker can embed a malicious IAL value inside a .sy document,...

8.6CVSS6.4AI score0.00343EPSS
SaveExploits1References4Affected Software1
Vulnrichment
Vulnrichment
added 2026/03/31 9:47 p.m.8 views

CVE-2026-34585 SiYuan: Stored XSS in imported .sy.zip content leads to arbitrary command execution

SiYuan is a personal knowledge management system. Prior to version 3.6.2, a vulnerability allows crafted block attribute values to bypass server-side attribute escaping when an HTML entity is mixed with raw special characters. An attacker can embed a malicious IAL value inside a .sy document,...

8.6CVSS6.4AI score0.00343EPSS
SaveExploits1References3
OSV
OSV
added 2026/03/31 9:47 p.m.15 views

CVE-2026-34585 SiYuan: Stored XSS in imported .sy.zip content leads to arbitrary command execution

SiYuan is a personal knowledge management system. Prior to version 3.6.2, a vulnerability allows crafted block attribute values to bypass server-side attribute escaping when an HTML entity is mixed with raw special characters. An attacker can embed a malicious IAL value inside a .sy document,...

8.6CVSS6.3AI score
SaveExploits0References5
CVE
CVE
added 2026/03/31 9:47 p.m.29 views

CVE-2026-34585

SiYuan prior to version 3.6.2 is affected. A crafted IAL value inside a .sy document packaged as a .sy.zip can bypass server-side attribute escaping during Import, causing an HTML context break and stored XSS. In the Electron desktop client, this XSS can execute JavaScript with Node/Electron priv...

8.6CVSS6.4AI score0.00343EPSS
SaveExploits1References3Affected Software1
Rows per page
Query Builder