Rukovoditel <= 3.2.1 - Cross Site Scripting

A stored cross-site scripting XSS vulnerability in the Global Lists feature /index.php?module=globallists/lists of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking "Add". id:...

BIBLIOsoft BIBLIOpac 2008 - Cross-Site Scripting

BIBLIOsoft BIBLIOpac 2008 contains a cross-site scripting vulnerability via the db or action parameter to bin/wxis.exe/bibliopac/, which allows a remote attacker to inject arbitrary web script or HTML. id: CVE-2018-16139 info: name: BIBLIOsoft BIBLIOpac 2008 - Cross-Site Scripting author:...

Xinuo Openserver 5/6 - Cross-Site scripting

Xinuo formerly SCO Openserver versions 5 and 6 allows remote attackers to inject arbitrary web script or HTML tag via the parameter 'section' and is vulnerable to reflected cross-site scripting. id: CVE-2020-25495 info: name: Xinuo Openserver 5/6 - Cross-Site scripting author: 0xAkoko severity:...

CVE-2026-78210

In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the required authorization...

Check Point Gaia Operating System (sk1000171)

The remote host is missing a hotfix for the Gaia Operating System. It is, therefore, affected by a vulnerability as referenced in the sk1000171 advisory. - A path traversal and arbitrary file upload vulnerability in Check Point Security Management Server, Multi-Domain Security Management Server,...

CVE-2026-102831

A flaw was found in JupyterLab. This vulnerability allows Cross-Site Scripting XSS when pasting notebook cells from the system clipboard, as the application fails to clear trusted metadata flags from imported cell data. A remote attacker could exploit this by enticing a user to paste malicious ce...

PT-2026-99251

Name of the Vulnerable Software and Affected Versions Optimole WordPress plugin versions prior to 4.2.13 Description The plugin fails to escape unrecognized attributes within its video-player block before rendering them onto the block's wrapper element. This allows users with the Author role or...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in the Network component of Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML through a crafted HTML page. Chromium security severity: Medium...

Cross-site Scripting (XSS)

Overview org.apache.sling:org.apache.sling.xss is a package for providing XSS protection based on the OWASP AntiSamy and OWASP Java Encoder libraries. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the sanitizer process. An attacker can execute arbitrary scripts ...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the Special:Ask process when a forged cursor pagination token is supplied. An attacker can execute arbitrary scripts in the victim's browser by crafting a malicious link containing a specially crafted cursor...

Cross-site Scripting (XSS)

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the modular pages process. An attacker can execute arbitrary scripts in the context of administrator or visitor...

Exploit for CVE-2026-13157

CVE-2026-13157 Theme Demo Import...

CVE-2026-17962: Improper Neutralization of Input During Web Page Generation

Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Low...

CVE-2026-17818: Improper Neutralization of Input During Web Page Generation

Inappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-17739: Improper Neutralization of Input During Web Page Generation

Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts or HTML UXSS via a crafted Chrome Extension. Chromium security severity: Medium...

CVE-2026-17728: Improper Neutralization of Input During Web Page Generation

Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-15739

The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pagination' Shortcode Attribute in all versions up to, and including, 6.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2025-9205

The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.14.0. This is due to insufficient input sanitization and output escaping on user supplied attributes within the map options. This makes it possible for authenticated attackers, wit...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the ntitle parameter in the PFS module, which is processed through the TXT filter in pfs.main.php. An attacker can execute arbitrary scripts in the browser of users who view the affected folder listing by...

CVE-2026-13320

A flaw was found in GitLab. Under certain conditions, an authenticated user could exploit improper sanitization of user-supplied input. This vulnerability allows for the execution of arbitrary scripts within another user's browser session, commonly known as Cross-Site Scripting XSS. This could le...