CVE-2026-94034: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing of the file /drugrecommender/Admin/changepassword of the component Password Change. Performing a manipulation of the argument txtoldpassword/txtnewpassword results in cross site...

CVE-2026-93976: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in code-projects Assessment Management 1.0. Affected is an unknown function of the file admin/add-user.php. The manipulation of the argument level results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used...

CVE-2026-94045: Improper Neutralization of Input During Web Page Generation

A security flaw has been discovered in newbee-ltd newbee-mall up to 1.0.0. Impacted is an unknown function of the file controller/common/UploadController.java of the component Goods Save Endpoint. Performing a manipulation of the argument goodsName results in cross site scripting. The attack may ...

Cross-site Scripting (XSS)

Semantic MediaWiki is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to insufficient output-context encoding of the user-controlled value parameter in rendered output and error messages, which allows an attacker to inject malicious content and execute scripts in a victim's brows...

Cross-site Scripting (XSS)

Semantic MediaWiki is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper sanitization of user-controlled mainlabel content when headers=plain, which allows an attacker to inject executable HTML into table headers and execute malicious scripts in a victim's browser...

Cross-site Scripting (XSS)

Paella Player is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper sanitization of closed-caption cue text, which allows an attacker to inject malicious script content through captions and execute it in a victim's browser...

PT-2026-95755

Name of the Vulnerable Software and Affected Versions Ultra Addons for Contact Form 7 versions prior to 3.5.51 Description Unauthenticated users can upload arbitrary files because the plugin fails to validate file types or extensions in one of its form fields. Uploaded files are stored in a...

CVE-2026-11608: Improper Neutralization of Input During Web Page Generation

The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3fname' parameter in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-84750: Unrestricted Upload of File with Dangerous Type

The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary...

CVE-2026-76790: Improper Neutralization of Input During Web Page Generation

The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting...

CVE-2026-89081: Improper Neutralization of Input During Web Page Generation

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-87917: Improper Neutralization of Input During Web Page Generation

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data' Dynamic Content Tag in all versions up to, and including, 4.14.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-93956: Improper Neutralization of Input During Web Page Generation

A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by this issue is the function SearchEngine::buildHighlights of the file src/SearchEngine.php of the component Search Engine. Executing a manipulation of the argument Query can lead to cross site scripting. The attack may be launche...

CVE-2026-15463: Improper Neutralization of Input During Web Page Generation

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'host' parameter in all versions up to, and including, 4.7.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Special:FacetedSearch process. An attacker can inject arbitrary HTML or JavaScript into the response by crafting a request with malicious cstate parameters that are not properly escaped, leading to...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the sep parameter in the table rendering process. An attacker can execute arbitrary scripts in the context of the user's browser by injecting malicious HTML through the unsanitized separator value. Details...

CVE-2026-1025

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials...

CVE-2025-36147

IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4.0 through 3.2.4.16 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leadi...

CVE-2026-1037 Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially...

CVE-2026-1031

IBM Common Licensing Agent versions 9.0, 9.0.0.1, 9.0.0.2 and IBM ART versions 9.0, 9.0.0.1, 9.0.0.2 are affected by a cross-site scripting vulnerability. An unauthenticated attacker can embed arbitrary JavaScript code in the Web UI, altering its intended functionality and potentially leading to ...