CVE-2026-27621

CVE-2026-27621: TypiCMS Core has Stored Cross-Site Scripting XSS via SVG File Upload Overview Field| Details ---|--- CVE ID| CVE-2026-27621 Severity| MEDIUM Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products typicms/core versions: 16.1.7 CWE Classification CWE-79: Improper...

CVE-2026-97635

The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent Zero Web UI session...

CVE-2026-78071

Stored XSS via Location Title in DPCalendar Free DPCalendar Free ≤ 10.11.2 — Author-Role User Bypasses Content Review to Inject Persistent XSS via Location Title, Triggered on Hover by Any Visitor -orange SUMMARY The $location-title field is rendered without htmlspecialchars in...

EUVD-2026-108272

The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent Zero Web UI session...

CVE-2026-97635

The Agent Zero Web UI versions prior to 1.15 are vulnerable to Cross-Site Scripting (XSS) due to improper sanitization of user-provided input in chat messages and file uploads . When the application reproduces content in the chat interface, injected JavaScript executes within the context of the v...

CVE-2026-97635 Agent Zero Web UI XSS

The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent Zero Web UI session...

CVE-2026-22804

Termix Stored XSS PoC GHSA-m3cv-5hgp-hv35 This repository contains a Proof of Concept PoC exploit for the Stored Cross-Site Scripting XSS vulnerability in Termix, which can lead to Local File Inclusion LFI in the Electron environment and Session Hijacking. Vulnerability Details Advisory :...

CVE-2025-67263

CVE-2025-67263 - Stored cross-site scripting XSS in Abacre Retail Point of Sale 14.0.0.396 Abacre Retail Point of Sale 14.0.0.396 is affected by a stored cross-site scripting XSS vulnerability in the Clients module. The application fails to properly sanitize user-supplied input stored in the Name...

CVE-2025-63307

CVE-2025-63307 – Authenticated Stored Cross-site Scripting XSS in laravel-file-manager v3.3.1 🧭 Overview An authenticated Stored Cross-site Scripting XSS vulnerability in laravel-file-manager v3.3.1 and below allows attackers with access to the file manager interface to inject and persist arbitra...

CVE-2025-45805

CVE-2025-45805 Poc Of CVE-2025-45805 Affected Product: Doctor Appointment Management System Vendor: phpgurukul Version: 1.0 Vulnerability Type: Stored Cross-Site Scripting XSS Description: An authenticated doctor user can inject arbitrary JavaScript code into the doctor profile field name/employe...

CVE-2026-115513

OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a Candidate, Company, Contact, Job Order, or List name/title field, which is stored unsanitized and later rendered unescaped in...

AgentZero XSS

RISK EVALUATION The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent Zero Web UI...

1CRM-CVE

1CRM-CVE 1CRM Software Vulnerability Vulnerabilities List CVE-2019-14221: Stored Cross Site Scripting...

CVE-2025-63735-Ruckus-Unleashed-Reflected-XSS

CVE-2025-63735 – Reflected XSS in Ruckus Unleashed 200.13.6.1.319 Summary A reflected cross-site scripting XSS vulnerability exists in Ruckus Unleashed 200.13.6.1.319 via the name parameter to the captive-portal endpoint selfguestpass/guestAccessSubmit.jsp. Vendor Ruckus Wireless Product...

CVE-2024-46982-Reproduction

Getting Started 1. Install Node.js LTS 2. npm install 3. npm run build 4. npm run start Exploitation 1: Stored XSS via Cache Poisoning 1. Send the following HTTP request Attack Request using any HTTP client. GET /poc?nextDataReq=1 HTTP/1.1 Host: localhost:3000 User-Agent: alert'XSS'...

EUVD-2026-107417

Nuxt server islands render useHeadSafe input without sanitisation...

CVE-2025-64027

Product Info Snipe-IT is a free and open-source IT asset management system FOSS built on Laravel. It provides hardware asset tracking, software license management, accessories, and consumables inventory features for IT operations teams. It is actively maintained and updated frequently. Summary A...

CVE-2026-115513 OpenCATS before 0.12.0 Stored XSS via MRU Navigation Panel

OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a Candidate, Company, Contact, Job Order, or List name/title field, which is stored unsanitized and later rendered unescaped in...

CVE-2026-115513

The software OpenCATS before version 0.12.0 is vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is the unsanitized storage and subsequent unescaped rendering of fields such as Candidate, Company, Contact, Job Order, or List name/title. The malicious payload is executed via t...

FuguHub-8.1-Reflected-SVG-XSS-CVE-2025-65790

CVE-2025-65790 - FuguHub 8.1 Reflected SVG XSS Reflected Cross-Site Scripting XSS via SVG Rendering in FuguHub https://vulners.com/cve/CVE-2025-65790 This repository documents a Reflected Cross-Site Scripting XSS vulnerability in FuguHub 8.1 , where SVG files containing inline JavaScript are...