PT-2026-104806

The email media type OAuth form passes the Authorization endpoint value to window.open without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who...

CVE-2025-29094-Multiple-Stored-Cross-Site-Scripting-XSS

CVE-2025-29094-Multiple-Stored-Cross-Site-Scripting-XSS 本仓库揭示在 Motivian Content Management System v.41.0.0 中发现的安全漏洞。 CVE-2025-29094：多个存储型跨站脚本（XSS） 该漏洞已按照负责任披露实践向供应商报告，并提交给 MITRE，MITRE 分配了临时 CVE ID。在 45 天披露期到期后，相关细节现已公开。 基本信息 标题： Motivian 存储型跨站脚本（XSS） 漏洞类型： 存储型 XSS 产品供应商： Motivian 产品： Motivian...

CVE-2020-12625

CVE-2020-12625: Cross-Site Scripting mediante adjunto HTML malicioso en Roundcube Webmail Existe una vulnerabilidad de Cross-Site Scripting XSS en las versiones de Roundcube anteriores a 1.4.4, 1.3.11 y 1.2.10. Al aprovechar el elemento XML "" en un correo con un adjunto "text/html", un atacante...

Hacking-pdf.js-vulnerability

🚨 CVE-2024-4367：PDF.js 中的任意 JavaScript 执行 本项目演示并分析了 CVE-2024-4367 ，这是 Mozilla 的 PDF.js 库中的一个高严重性漏洞，由于字体处理代码中类型检查不当，导致任意 JavaScript 执行。我们的研究展示了如何通过恶意构造的 PDF 在 Electron 应用等上下文中执行 JavaScript，可能升级为远程代码执行。 🔗 GitHub 仓库 ：Hacking-pdf.js-vulnerability 📖 项目概述 CVE ID ：CVE-2024-4367 严重性 ：高（CVSS v3.1 评分：8.8）...

detect-cve-2024-4367

检测 CVE-2024-4367 用于检测 PDF.js 中 CVE-2024-4367 任意 JavaScript 执行的快速简陋 YARA 规则。 使用 $ yara explpdfjscve20244367.yar pocgeneralizedCVE-2024-4367.pdf EXPLPDFJSCVE20244367 pocgeneralizedCVE-2024-4367.pdf 致谢 POC 和披露来自 https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js/...

CVE-2026-105090

Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The survey-level Custom Head Scripts feature did not enforce the documented Manage permission boundary. A workspace member holding only readWrite permission could configure Custom Head Scripts on a survey, an operation the documentatio...

EUVD-2026-91874

Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The survey-level Custom Head Scripts feature did not enforce the documented Manage permission boundary. A workspace member holding only readWrite permission could configure Custom Head Scripts on a survey, an operation the documentatio...

CVE-2026-105090: Incorrect Authorization

Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The survey-level Custom Head Scripts feature did not enforce the documented Manage permission boundary. A workspace member holding only readWrite permission could configure Custom Head Scripts on a survey, an operation the documentatio...

https-nj.gov---CVE-2019-8331

https-nj.gov---CVE-2019-8331 Informe de vulnerabilidad del sitio oficial de Nueva Jersey Bootstrap 4.0.0 Encontrado en https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js Información de vulnerabilidad: Medium 28236 XSS en las propiedades data-template, data-content y data-title de...

PT-2026-104403

Name of the Vulnerable Software and Affected Versions Tinypool versions prior to 2.1.2 Description Tinypool reads the filename from a caller-supplied options object in the pool.runtask, options function without verifying if the property is an own property of the object. This allows a polluted...

EUVD-2026-91021

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, GetSimpleCMS-CE is vulnerable to stored Cross-Site Scripting XSS in the "Theme to Components" functionality admin/components.php via the title parameter. The...

CVE-2026-71542 GetSimple CMS: Stored Cross-Site Scripting (XSS) via the "title" parameter in admin/components.php

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, GetSimpleCMS-CE is vulnerable to stored Cross-Site Scripting XSS in the "Theme to Components" functionality admin/components.php via the title parameter. The...

Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

SummaryWhen enablejsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instea...

PYSEC-2026-4113 Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

Summary When enablejsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation inste...

BIT-DISCOURSE-2026-91122 Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting...

EUVD-2026-90578

MISP contains a reflected cross-site scripting XSS vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed directly into inline JavaScript within the rendered HTML response without any sanitization or type enforcement. An attacker who c...

CVE-2026-103662

A reflected cross-site scripting (XSS) vulnerability exists in the MISP legacy taxonomy tag management confirmation forms (specifically the add tag and disable tag forms). The flaw is caused by the application echoing a user-supplied tag name value from the request into the rendered HTML output w...

CVE-2026-103662 MISP Reflected XSS in Taxonomy Tag Confirmation Forms

MISP contains a reflected cross-site scripting XSS vulnerability in the legacy taxonomy tag management confirmation forms add tag and disable tag. The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site...

CVE-2026-103662 MISP Reflected XSS in Taxonomy Tag Confirmation Forms

MISP contains a reflected cross-site scripting XSS vulnerability in the legacy taxonomy tag management confirmation forms add tag and disable tag. The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site...

EUVD-2026-90545

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Referer header in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping on the 'search-query' dynamic tag. When an ad block's code...