Zarafa WebApp <=2.0.1.47791 - Cross-Site Scripting

Zarafa WebApp 2.0.1.47791 and earlier contains an unauthenticated reflected cross-site scripting vulnerability. An attacker can execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. id: CVE-2019-7219 info: name: Zarafa WebApp =2.0.1.47791 -...

SPIP <3.1.2 - Cross-Site Scripting

SPIP 3.1.2 and earlier contains a cross-site scripting vulnerability in validerxml.php which allows remote attackers to inject arbitrary web script or HTML via the varurl parameter in a validerxml action. id: CVE-2016-7981 info: name: SPIP 3.1.2 - Cross-Site Scripting author: pikpikcu severity:...

WebMirage

WebMirage 对抗性图像劫持 Web 智能体：从视觉定位到浏览器执行 Wanjing Han, Levi Taiji Li, Mu Zhang, Yue Jiang, Guanhong Tao — 犹他大学 WebMirage 是一个针对视觉定位 Web 智能体的红队测试框架。它在攻击者控制的网页图像（例如产品缩略图或个人资料照片）上精心构造局部对抗性扰动，使智能体在不同的网页渲染下选择攻击者的元素并执行相应的浏览器操作。该攻击是端到端构建的，从视觉定位到浏览器执行，而非仅在模型推理阶段。 两个组件实现了这一目标： 角色槽位抽象与网页重组 ——...

CVE-2026-100380

CVE-2026-100380：语言验证错误中的反射型 XSS 报告者：Marco Paciaroni（BomboBombone）。 Wikibase 在 SetLabel 页面中包含了未转义的语言验证错误文本。被拒绝的输入可能在请求到达标签保存操作之前，作为可执行的 HTML 返回。 受影响版本 CVE 记录指出，受影响的 Wikibase 发布分支为 1.46.1、1.45.5 和 1.43.10 中修复之前的版本。请使用对应 MediaWiki 发布分支的已修复扩展代码。 影响与条件 归档的验证记录了一次未认证请求以及在该 wiki...

CVE-2026-59670: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomListaValidacion” parameter is affected – endpoint...

EUVD-2026-89622

The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript...

EUVD-2026-88435

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager Free element to execute in the browser of anyone who loads the crafted link...

CVE-2026-92784

@refinedev/inferencer through version 7.0.0 (part of the refine framework) is vulnerable to code injection via API field names . The root cause is a failure to escape API field names when interpolating them into generated JSX source code . An attacker controlling the data provider can inject mali...

CVE-2026-92784 @refinedev/inferencer through 7.0.0 Code Injection via API Field Names

@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controlling the data provider can inject malicious JavaScript through crafted JSON property names that execute in the developer's browser when the Inferencer page...

CVE-2026-12751 Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.

IBM Cloud Pak for Business Automation is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

EUVD-2026-78866

IBM Cloud Pak for Business Automation is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

PT-2026-92161

Name of the Vulnerable Software and Affected Versions IBM Cloud Pak for Business Automation affected versions not specified Description An HTML injection flaw allows a remote attacker to inject malicious HTML code. When viewed, this code is executed in the victim's web browser within the security...

CVE-2026-81918: Improper Neutralization of Input During Web Page Generation

Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A user with editpagecontents permissions could store a payload which executes in the browser of any visitor who viewed a page where the block was configured to display a date-type...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2025-64584

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79) in vulnerable form fields. A low-privileged attacker can inject malicious scripts that execute in a victim's browser when the victim browses the affected page. The vulnerability carries a CVSS 3.1 s...

CVE-2026-33387

A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim can be socially engineered into importing a...

Insufficient sanitization of Dashboards in Guardian/CMC before 26.3.0

Summary A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. Impact An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim can be socially engineered into...

shockwave-poc

Shockwave POC Shockwave POC — Comparação DirPlayer vs Libre...

PT-2026-82883

SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product...

CVE-2026-69236

A stored cross-site scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 12.1 and prior allows a remote, privileged attacker to inject malicious code that can execute arbitrary JavaScript in a victim's browser. The CVSS 3.1 score is 6.1 (Medium) , reflecting network attack vector, low...