CVE-2026-112066

The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website...

EUVD-2026-104873

The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website...

CVE-2026-112066 Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)

The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website...

CVE-2026-112066

The sgalinski Cookie Consent (sg_cookie_optin) extension is vulnerable to a Missing Authorization flaw during the JSON import of cookie consent configurations. Specifically, the import process fails to validate the backend user's permissions, allowing non-admin backend users with module access to...

BIBLIOsoft BIBLIOpac 2008 - Cross-Site Scripting

BIBLIOsoft BIBLIOpac 2008 contains a cross-site scripting vulnerability via the db or action parameter to bin/wxis.exe/bibliopac/, which allows a remote attacker to inject arbitrary web script or HTML. id: CVE-2018-16139 info: name: BIBLIOsoft BIBLIOpac 2008 - Cross-Site Scripting author:...

Xinuo Openserver 5/6 - Cross-Site scripting

Xinuo formerly SCO Openserver versions 5 and 6 allows remote attackers to inject arbitrary web script or HTML tag via the parameter 'section' and is vulnerable to reflected cross-site scripting. id: CVE-2020-25495 info: name: Xinuo Openserver 5/6 - Cross-Site scripting author: 0xAkoko severity:...

Rukovoditel <= 3.2.1 - Cross Site Scripting

A stored cross-site scripting XSS vulnerability in the Global Lists feature /index.php?module=globallists/lists of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking "Add". id:...

PT-2026-118303

The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website...

EUVD-2026-96321

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.57.3...

CVE-2026-78210

In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the required authorization...

Check Point Gaia Operating System (sk1000171)

The remote host is missing a hotfix for the Gaia Operating System. It is, therefore, affected by a vulnerability as referenced in the sk1000171 advisory. - A path traversal and arbitrary file upload vulnerability in Check Point Security Management Server, Multi-Domain Security Management Server,...

CVE-2026-102831

A flaw was found in JupyterLab. This vulnerability allows Cross-Site Scripting XSS when pasting notebook cells from the system clipboard, as the application fails to clear trusted metadata flags from imported cell data. A remote attacker could exploit this by enticing a user to paste malicious ce...

PT-2026-99251

Name of the Vulnerable Software and Affected Versions Optimole WordPress plugin versions prior to 4.2.13 Description The plugin fails to escape unrecognized attributes within its video-player block before rendering them onto the block's wrapper element. This allows users with the Author role or...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in the Network component of Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML through a crafted HTML page. Chromium security severity: Medium...

Cross-site Scripting (XSS)

Overview org.apache.sling:org.apache.sling.xss is a package for providing XSS protection based on the OWASP AntiSamy and OWASP Java Encoder libraries. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the sanitizer process. An attacker can execute arbitrary scripts ...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the Special:Ask process when a forged cursor pagination token is supplied. An attacker can execute arbitrary scripts in the victim's browser by crafting a malicious link containing a specially crafted cursor...

Cross-site Scripting (XSS)

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the modular pages process. An attacker can execute arbitrary scripts in the context of administrator or visitor...

Exploit for CVE-2026-13157

CVE-2026-13157 Theme Demo Import...

CVE-2026-17962: Improper Neutralization of Input During Web Page Generation

Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Low...

CVE-2026-17739: Improper Neutralization of Input During Web Page Generation

Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts or HTML UXSS via a crafted Chrome Extension. Chromium security severity: Medium...