Mitel ShoreTel 19.46.1802.0 Devices - Cross-Site Scripting

Mitel ShoreTel 19.46.1802.0 devices and their conference component are vulnerable to an unauthenticated attacker conducting reflected cross-site scripting attacks via the PATHINFO variable to index.php due to insufficient validation for the timezone object in the HOMEMEETING& page. id:...

CVE-2026-123094

A flaw was found in Huginn. The application improperly handles OAuth service display names, resulting in a stored cross-site scripting XSS vulnerability. An authenticated attacker can exploit this issue by registering an account with crafted display names or email addresses and sharing it globall...

CVE-2026-118255

A flaw was found in Highcharts Grid. The component fails to validate URL schemes in credit links, allowing an attacker who controls the grid configuration to inject a malicious JavaScript link. When a user clicks the link, arbitrary script executes within the origin of the hosting web application...

CVE-2026-118254

A flaw was found in Highcharts Grid. The component renders pagination language strings directly into the Document Object Model DOM as markup rather than plain text. An attacker who controls the grid's language configuration can exploit this vulnerability to execute arbitrary scripts in the contex...

CVE-2026-120497

Stored cross-site scripting XSS in the HTML report generator in the aidlc-traceability CLI in AWS AI-DLC Workflows before 2026-07-03 might allow an actor who can modify a project's AI-DLC artifact files to execute arbitrary script in the browser of a user who opens a generated HTML traceability...

CVE-2026-120497 Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows

Stored cross-site scripting XSS in the HTML report generator in the aidlc-traceability CLI in AWS AI-DLC Workflows before 2026-07-03 might allow an actor who can modify a project's AI-DLC artifact files to execute arbitrary script in the browser of a user who opens a generated HTML traceability...

EUVD-2026-115369

Stored cross-site scripting XSS in the HTML report generator in the aidlc-traceability CLI in AWS AI-DLC Workflows before 2026-07-03 might allow an actor who can modify a project's AI-DLC artifact files to execute arbitrary script in the browser of a user who opens a generated HTML traceability...

PT-2026-135658

Name of the Vulnerable Software and Affected Versions aidlc-traceability CLI in AWS AI-DLC Workflows versions prior to 2026-07-03 Description A stored cross-site scripting XSS issue exists in the HTML report generator. An attacker capable of modifying a project's AI-DLC artifact files can execute...

text4shell-poc

CVE-2022-42889 PoC Test Application This is a vulnerable application developed as a Proof of Concept for the vulnerability CVE-2022-42889. Maven Installation In order to run this you will need: JDK 17 or above Maven 1. Clone the git repo git clone https://github.com/securekomodo/text4shell-poc.gi...

CVE-2024-39248

Exploit Title: SimpCMS v0.1 - Cross Site Scripting XSS CVE: CVE-2024-39248 Exploit Author: Jason Jacobs 0xjasonjacobs - Twitter Vendor Homepage: https://sourceforge.net/projects/simpcms/ Vulnerable endpoint: /SimpCMS/admin.php A cross-site scripting XSS vulnerability in SimpCMS v0.1 allows...

CVE-2023-49984

CVE-2023-49984 School Fees Management System v1.0 - Cross-Site Scripting XSS Vulnerability in "name" field/parameter on "/management/settings" Description : A cross-site scripting XSS vulnerability in the component "/management/settings" of School Fees Management System v1.0 allows attackers to...

CVE-2023-49986

CVE-2023-49986 School Fees Management System v1.0 - Cross-Site Scripting XSS Vulnerability in "name" parameter on "addnewparent" Description : A cross-site scripting XSS vulnerability in the component “addnewparent” of School Fees Management System 1.0 allow attackers to execute arbitrary web...

OpenNebula-CVE-2025-56534

OpenNebula-CVE-2025-56534 Exploit Title : OpenNebula 6.10.0.1 - Stored XSS Cross-site Scripting in the custom authenticator driver Exploit Author : Mark Artamonov Vendor Homepage : https://opennebula.io/ Tested Version : OpenNebula 6.10.0.1 Affected Versions : OpenNebula Proof of Concept : Fix :...

CVE-2023-49983

CVE-2023-49983 School Fees Management System v1.0 - Cross-Site Scripting XSS Vulnerability in "name" field/parameter on "/management/class" Description : A cross-site scripting XSS vulnerability in the component "/management/class" of School Fees Management System v1.0 allows attackers to execute...

CVE-2023-49987

CVE-2023-49987 School Fees Management System v1.0 - Cross-Site Scripting XSS Vulnerability in "tname" parameter on "newterm" Description : A cross-site scripting XSS vulnerability in the component “newterm” of School Fees Management System 1.0 allow attackers to execute arbitrary web scripts or...

CVE-2026-116796

A flaw was found in Highcharts. An attacker who can supply chart text configurations can execute arbitrary script in a victim's browser session. The library fails to validate URL schemes on certain Scalable Vector Graphics SVG anchor link attributes, allowing malicious JavaScript links to persist...

WordPress Akismet 3.1.4 Cross Site Scripting

WordPress Akismet plugin versions 2.5.0 through 3.1.4 contain a stored cross site scripting vulnerability. This proof of concept submits a crafted payload that executes when viewed by an administrator. https://packetstorm.news/download/238548...

WordPress Content Egg Cross Site Scripting

WordPress Content Egg versions before 11.9.0 contain a stored cross site scripting vulnerability that lets Contributor-level users enqueue unescaped content through an administrator-owned import preset. https://packetstorm.news/download/238560...

Improper Encoding or Escaping of Output

Overview vue-i18n is an Internationalization plugin for Vue.js Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the sanitizeTranslatedHtml function in packages/shared/src/sanitize.ts, which fails to neutralize srcdoc attributes in translation message...

Improper Encoding or Escaping of Output

Overview petite-vue-i18n is a Vue I18n lite version Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the sanitizeTranslatedHtml function in packages/shared/src/sanitize.ts, which fails to neutralize srcdoc attributes in translation messages. An...