1125868 matches found
EUVD-2026-67463
An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write restricted files and conduct limited denial-of-service attacks...
CVE-2026-9548
Synology Chat Server versions prior to 2.4.5-22148 are affected by a Cross-Site Scripting (XSS) vulnerability in the extract domain function, caused by improper neutralization of input during web page generation. A remote authenticated user with low privileges can exploit this via a UI interactio...
CVE-2026-40541
An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM...
EUVD-2026-67461
An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM...
CVE-2026-40541
Synology Chat Server before 2.4.5-22148 contains an improper input neutralization vulnerability in the extract domain component, classified as a cross-site scripting (XSS) flaw. Remote authenticated users can, through a UI interaction, read or write arbitrary files and trigger denial-of-service a...
CVE-2026-82123
CVE-2026-82123 is a reflected cross-site scripting (XSS) vulnerability in the Tangible Loops & Logic WordPress plugin, caused by improper neutralization of input during web page generation. Per the assigned CVSS 3.1 score of 6.5 (Medium) , the attack vector is network-based with low complexity, r...
EUVD-2026-67459
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Tangible Loops & Logic...
EUVD-2026-67578
SOY Gallery contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product...
CVE-2026-78238
SOY Gallery is affected by a cross-site scripting (XSS) vulnerability that allows arbitrary script execution in the web browser of a user who is logging in to the product. The vulnerability requires low privileges and active user interaction , with impact on subsequent system confidentiality and ...
CVE-2026-78238
SOY Gallery contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product...
CVE-2026-77838
SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product...
CVE-2026-77838
SOY Calendar is affected by a cross-site scripting (XSS) vulnerability that allows an arbitrary script to be executed in the web browser of a user who is logging in to the product. The vulnerability is scored 5.4 (MEDIUM) under CVSS v3.0, requiring low privileges and user interaction. No fix vers...
EUVD-2026-67577
SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product...
CVE-2026-73827
SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product...
CVE-2026-73827
SOY Calendar is affected by a cross-site scripting (XSS) vulnerability that allows an arbitrary script to be executed in the web browser of a user who is logging into the product. The vulnerability requires low privileges and active user interaction , with a CVSS 3.0 base score of 5.4 (MEDIUM) an...
EUVD-2026-67576
SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product...
CVE-2026-82090
Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. JavaScript code can alter the application state via native bridge methods...
CVE-2026-82090
Pocket for Android (versions through 8.33.0.0 ) is affected by a Cross-Site Scripting (XSS) vulnerability rated CVSS 4.0 9.2 (CRITICAL) . The root cause is that the "Save to Pocket" feature injects external HTML into the DOM, allowing injected JavaScript to alter the application state via native ...
