1148982 matches found
CVE-2026-73053 SiYuan before v3.7.4 Cross-Site Scripting via unicode2Emoji
SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attackers can craft document icons with hex-encoded markup that executes in the renderer with Node integration enabled, achieving arbitrary code...
CVE-2026-73052
CVE-2026-73052 concerns SiYuan before v3.7.4. The issue arises because attribute-view field names are stored without HTML escaping and are interpolated into option elements via innerHTML in the sort menu. This allows stored XSS: an attacker can rename a database field to inject markup, which can ...
CVE-2026-73050
SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, executing arbitrary...
CVE-2026-73050
CVE-2026-73050 affects SiYuan before v3.7.4, where the color field in attribute-view select options is not validated/escaped, allowing stored XSS via eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, enabling arbitrary Jav...
CVE-2026-73044
SiYuan before v3.7.4 is affected: it fails to validate/escape table column width values, enabling stored XSS via style attributes. Attackers can use the setAttrViewColWidth API to break out of style attributes and inject event handlers on every table cell, enabling arbitrary code execution in the...
CVE-2026-73044 SiYuan before v3.7.4 Stored Cross-Site Scripting via Column Width
SiYuan versions before v3.7.4 fail to validate or escape table column width values, allowing stored cross-site scripting injection into style attributes. Attackers can inject malicious payloads through the setAttrViewColWidth API that break out of style attributes and inject event handlers on eve...
CVE-2026-19904
A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file /admin/index.php?page=sitesettings of the component System Settings Module. The manipulation results in cross site scripting. The attack can be executed remotely. The...
EUVD-2026-59783
A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file /admin/index.php?page=sitesettings of the component System Settings Module. The manipulation results in cross site scripting. The attack can be executed remotely. The...
MINI-JQGP-JMM7-RVVQ
Bulletin has no description...
CVE-2026-14230
The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers gated only by a capability-agnostic nonce that any editposts user obtains from the Elementor editor, so a Contributor can write a data-source binding into any post —...
CVE-2026-14433
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'businessid' parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-19904: Improper Neutralization of Input During Web Page Generation
A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file /admin/index.php?page=sitesettings of the component System Settings Module. The manipulation results in cross site scripting. The attack can be executed remotely. The...
CVE-2026-73053: Improper Neutralization of Input During Web Page Generation
SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attackers can craft document icons with hex-encoded markup that executes in the renderer with Node integration enabled, achieving arbitrary code...
PT-2026-73044
Name of the Vulnerable Software and Affected Versions SourceCodester Online Book Store System version 1.0 Description Cross site scripting occurs in the System Settings Module within the file '/admin/index.php?page=site settings'. This issue allows a remote attacker to execute malicious scripts...
PT-2026-73057
Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description A cross-site scripting issue exists in the unicode2Emoji function due to a failure to sanitize codepoint branch output. This allows attackers to create document icons containing hex-encoded markup. Wh...
CVE-2026-19916: Improper Neutralization of Input During Web Page Generation
A vulnerability was detected in code-projects Online Food Order System 1.0. The affected element is an unknown function of the file editfooditems.php. Performing a manipulation of the argument dname results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now...
PT-2026-73061
Name of the Vulnerable Software and Affected Versions code-projects Online Food Order System version 1.0 Description An issue exists in the edit food items.php file where manipulating the dname argument allows for cross-site scripting XSS, a technique used to inject malicious scripts into web pag...
PT-2026-73055
Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Stored cross-site scripting is possible due to a failure to validate or escape the color field in attribute-view select options across eight unescaped render sites. An attacker can inject event-handle...