EUVD-2026-90430

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata extension allows Cross-Site Scripting XSS. This issue affects MediaWiki CommonsMetadata extension: 1.46, 1.45, and 1.43...

EUVD-2026-90210

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki Wikistories extension allows Cross-Site Scripting XSS. This issue affects MediaWiki Wikistories extension: 1.46, 1.45, and 1.43...

EUVD-2026-90201

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS. This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45...

SUSE CVE-2026-34033

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. User-supplied content was included in notification emails without proper escaping, allowing authenticated users to inject arbitrary HTML int...

CVE-2026-5218

Softtr Informatics Technology Trading Limited Company E-Commerce Pack (before 5.03.01.49 ) is affected by an improper neutralization of script-related HTML tags (basic XSS), allowing Cross-Site Scripting in a web page. The vulnerability is rated CVSS 4.3 (MEDIUM) with vector AV:N/AC:L/PR:N/UI:R/S...

CVE-2026-5218 HTML Injection in Softtr's E-Commerce Pack

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in Softtr Informatics Technology Trading Limited Company E-Commerce Pack allows Cross-Site Scripting XSS. This issue affects E-Commerce Pack: before 5.03.01.49...

EUVD-2026-67002

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in Softtr Informatics Technology Trading Limited Company E-Commerce Pack allows Cross-Site Scripting XSS. This issue affects E-Commerce Pack: before 5.03.01.49...

CVE-2026-5218 HTML Injection in Softtr's E-Commerce Pack

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in Softtr Informatics Technology Trading Limited Company E-Commerce Pack allows Cross-Site Scripting XSS. This issue affects E-Commerce Pack: before 5.03.01.49...

PT-2026-82484

Name of the Vulnerable Software and Affected Versions E-Commerce Pack versions prior to 5.03.01.49 Description Improper neutralization of script-related HTML tags in a web page allows Cross-Site Scripting XSS, a condition where malicious scripts are injected into trusted websites. Recommendations...

CVE-2026-5218: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in Softtr Informatics Technology Trading Limited Company E-Commerce Pack allows Cross-Site Scripting XSS. This issue affects E-Commerce Pack: before 5.03.01.49...

CVE-2026-34497: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in Johnson Controls FM Systems Employee allows Cross-Site Scripting XSS. This issue affects FM Systems Employee: before 2025.3.1...

CVE-2026-65841: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when conte...

CVE-2026-59838: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

A improper neutralization of script-related html tags in a web page basic xss vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.2.0 through 7.2.6, FortiSIEM 7.1 all versions, FortiSIEM 7.0 all versions, FortiSIEM 6.7 all versions, FortiSIEM 6.6 all versions,...

CVE-2026-57167: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, server-side-rendered video watch pages embed a schema.org JSON-LD block by JSON.stringify-ing video metadata without escaping less-than, greater-than, or slash characters, allowing a value containing the byte sequence...

CVE-2025-36321: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

CVE-2025-64637: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Unauthenticated Content Injection in Auros Core = 5.3.1 versions...

CVE-2026-57533: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs. Since this page has a Content-Security-Policy, this can mainly be used for phishing purposes...

CVE-2026-57534: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Malicious HTML content could be injected into the content of a page in the pretix-pages plugin...

CVE-2026-13225: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Malicious HTML content could be injected into the email address of an order, which pretix showed without sanitization on the confirmation page for individual tickets in that order...

CVE-2026-57532: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser. This could allow one backend user to inject JavaScript into the browser context of another backend user. Due to requirements of the PDF rendering...