8219 matches found
CVE-2026-15948
The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-17209
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting...
CVE-2026-17209 IBM Db2 Mirror for i is affected by multiple vulnerabilities
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting...
CVE-2026-17209
IBM Db2 Mirror for i 7.4–7.6 is affected by CVE-2026-17209: the GUI could be exploited by a remote authenticated attacker to execute arbitrary scripts via cross-site scripting. This aligns with the IBM bulletin listing multiple vulnerabilities in Db2 Mirror for i; the CVSS base score is 6.3 (Medi...
CVE-2026-17209 IBM Db2 Mirror for i is affected by multiple vulnerabilities
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting...
CVE-2026-17209
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting...
EUVD-2026-58607
The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute...
CVE-2026-19794
The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute...
PT-2026-72104
Name of the Vulnerable Software and Affected Versions IBM Db2 Mirror for i versions 7.4 through 7.6 Description Remote authenticated attackers can execute arbitrary scripts due to cross-site scripting, a flaw where malicious scripts are injected into trusted websites. Recommendations At the momen...
CVE-2026-17209: Improper Neutralization of Input During Web Page Generation
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting...
CVE-2026-18099 IBM i is Affected By Multiple Vulnerabilities in Navigator for i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary script code due to improper neutralization of user-controlled input...
CVE-2026-18099
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary script code due to improper neutralization of user-controlled input...
LibreNMS: Reflected XSS via Proxmox instance/vmid GET parameters injected into document.title JavaScript assignment
Summary LegacyController.php:75 writes the page title into a document.title JS assignment using string interpolation. apps/proxmox.inc.php pushes $vars'instance' and $vars'vmid' GET params, only striptags applied directly into $pagetitle. A single quote terminates the JS string, executing arbitra...
Cross-site Scripting (XSS)
Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the document.title assignment in JavaScript, where user-supplied GET parameters are...
CVE-2026-16066
The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page...
CVE-2026-18099: Improper Neutralization of Input During Web Page Generation
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary script code due to improper neutralization of user-controlled input...
PT-2026-70223
Name of the Vulnerable Software and Affected Versions @swc/html versions prior to 1.15.47-nightly-20260729.1 swc html minifier versions prior to 59.0.0 Description The minifyJson processing in crates/swc html minifier/src/lib.rs fails to implement the escape json for html script behavior when...
CVE-2026-57279
Cybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of a user logged in to the product...
CVE-2026-57279
Cybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of a user logged in to the product...