1148598 matches found
Multiple vulnerabilities in baserCMS
Overview baserCMS provided by baserCMS User Community contains multiple vulnerabilities listed below: Cross-site scripting CWE-79 - CVE-2026-93460, CVE-2026-93463, CVE-2026-93464 SQL injection CWE-89 - CVE-2026-62956 Missing authentication for critical function CWE-306 - CVE-2026-93462...
CVE-2025-14814 CSS & JavaScript Toolbox <= 12.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via cjtoolbox Shortcode
The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cjtoolbox shortcode in all versions up to, and including, 12.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2025-14814 CSS & JavaScript Toolbox <= 12.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via cjtoolbox Shortcode
The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cjtoolbox shortcode in all versions up to, and including, 12.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2026-97650
A vulnerability has been found in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function echo of the file admin/fun/addLog.php. The manipulation of the argument reason/detail leads to cross site scripting. The attack can be...
CVE-2026-97650 ningzichun student-management-system addLog.php echo cross site scripting
A vulnerability has been found in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function echo of the file admin/fun/addLog.php. The manipulation of the argument reason/detail leads to cross site scripting. The attack can be...
EUVD-2026-86501
A vulnerability has been found in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function echo of the file admin/fun/addLog.php. The manipulation of the argument reason/detail leads to cross site scripting. The attack can be...
CVE-2026-97650 ningzichun student-management-system addLog.php echo cross site scripting
A vulnerability has been found in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function echo of the file admin/fun/addLog.php. The manipulation of the argument reason/detail leads to cross site scripting. The attack can be...
CVE-2026-97650
The ningzichun student-management-system (up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf ) is vulnerable to Cross-Site Scripting (XSS) . The flaw exists in the echo function within the admin/fun/addLog.php file, where improper handling of the reason/detail arguments allows for remote scrip...
Nagios XI 5.7.5 - Cross-Site Scripting
Nagios XI 5.7.5 contains a cross-site scripting vulnerability in the file /usr/local/nagiosxi/html/admin/sshterm.php, due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal session cookies, or it can be chained with th...
OESA-2026-4058 xapian-core security update
Xapian is an Open Source Search Engine Library, released under the GPL v2+. It is a highly adaptable toolkit which allows developers to easily add advanced indexing and search facilities to their own applications. It has built-in support for several families of weighting models and also supports ...
CVE-2026-100174: Improper Neutralization of Input During Web Page Generation
The AIL Framework tag selector component var/www/static/js/tags.js is vulnerable to stored cross-site scripting XSS. A user with the ability to create a custom tag could embed an HTML payload containing JavaScript event handlers e.g., or in the tag name. When another authenticated user opened a...
CVE-2026-78902
A Cross Site Scripting (XSS) vulnerability exists in Netgate pfSense 26.03.1-RELEASE . This flaw specifically affects the pfBlockerNG package , potentially allowing an attacker to achieve arbitrary code execution . No specific remediation or exploit details are provided in the documents.
CVE-2026-97868: Improper Neutralization of Input During Web Page Generation
A security vulnerability has been detected in sheshbabu zen up to 1.5.0. Affected by this issue is the function dangerouslySetInnerHTML of the file features/notes/NotesEditor.jsx of the component Note Editor. The manipulation leads to cross site scripting. The attack may be initiated remotely. Th...
CVE-2026-96752: Improper Neutralization of Input During Web Page Generation
The Zero Spam for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 Integration in all versions up to, and including, 5.7.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...
CVE-2026-67236: Cleartext Storage of Sensitive Information
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused isauthorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding...
CVE-2026-96877: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4...
CVE-2026-100380: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - Wikibase Extension: from before 1.46.1, 1.45.5, 1.43.10...
PT-2026-98379
Name of the Vulnerable Software and Affected Versions GeoDirectory versions prior to 2.8.184 Description The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input...
CVE-2026-100381: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - UploadWizard Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - UploadWizard Extension: from before 1.46.1, 1.45.5, 1.43.10...