4322 matches found
CVE-2026-48543: Improper Neutralization of Input During Web Page Generation
Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the web form description field. Attackers can craft a web form...
CVE-2026-48541: Improper Neutralization of Input During Web Page Generation
Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the person name field. Attackers can craft a person name containing...
CVE-2026-48540: Improper Neutralization of Input During Web Page Generation
Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers can craft a lead title containing...
PT-2026-98261
Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers can craft a lead title containing...
PT-2026-98264
Name of the Vulnerable Software and Affected Versions Krayin CRM versions prior to 2.2.7 Description Authenticated attackers can execute arbitrary JavaScript in the browsers of other users via a stored client-side template injection. By injecting Vue.js template expressions into the web form...
PT-2026-98263
Name of the Vulnerable Software and Affected Versions Krayin CRM versions prior to 2.2.7 Description Authenticated attackers can execute arbitrary JavaScript in the browsers of other users via a stored client-side template injection. By injecting Vue.js template expressions into the product name...
PT-2026-98145
Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0 Description An authenticated user with file-management access can upload malicious XML and XSLT Extensible Stylesheet Language Transformations attachments. The API endpoint 'GET /api/v1/object type/id/files/fil...
CVE-2026-96755
Versions 8.14.0 through 8.28.1 of orval are vulnerable to a code injection vulnerability within the @orval/effect generator. The root cause is the improper conversion of OpenAPI schema defaults into template literals . An attacker can inject arbitrary JavaScript expressions by including ${...} sy...
Cross-site Scripting (XSS)
Overview org.apache.sling:org.apache.sling.xss is a package for providing XSS protection based on the OWASP AntiSamy and OWASP Java Encoder libraries. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the getValidHref function. An attacker can execute arbitrary...
EUVD-2026-84953
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary JavaScript in an authenticated user's browser due to improper neutralization of HTML input...
PT-2026-97412
Name of the Vulnerable Software and Affected Versions orval versions prior to 8.29.0 Description The software fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. This allows attackers to inject arbitrary JavaScript code via a...
CVE-2026-96759: Improper Control of Generation of Code
orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can inject arbitrary JavaScript code through a crafted operationId in an OpenAPI specification that executes when generated hooks are called...
CVE-2026-18131
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to a cross-site scripting (XSS) flaw due to the improper neutralization of HTML input (CWE-79). This vulnerability could allow a remote attacker to execute arbitrary JavaScript in an authenticated user's browser. The impac...
PT-2026-96721
Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.47 Description A reflected cross-site scripting XSS issue exists in the AnalystDataController::viewForObject action. The method accepts a parent object type parameter from the URL without validation and passes it to...
PT-2026-97088
Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description Improper neutralization of HTML input allows a remote attacker to execute arbitrary JavaScript within the browser of an authenticated user...
PT-2026-96722
Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description A reflected cross-site scripting XSS issue exists in the attribute histogram view. The $selectedTypes variable, derived from the URL path segment, is interpolated directly into a JavaScript arra...
EUVD-2026-83994
CuteNews v.2.1.2 is vulnerable to Cross Site Scripting XSS. Improper neutralization of the referer value 2.0.1 allows a remote attacker to execute arbitrary JavaScript in the context of an authenticated user's session via a javascript: URI rendered as an unsanitized clickable link on the msginfo...
CVE-2026-82890
IBM Guardium Data Protection 12.2 is vulnerable to improper neutralization of input during web page generation , allowing a remote authenticated attacker to execute arbitrary JavaScript code . The CVSS 3.1 score is 5.9 (MEDIUM) , with high attack complexity and low privileges required. No specifi...
CVE-2026-82890: Improper Neutralization of Input During Web Page Generation
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary JavaScript code due to improper neutralization of input during web page generation...