CVE-2026-90570: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in linlinjava litemall 1.4.0/1.5.0/1.6.0/1.7.0/1.8.0. This issue affects the function AdminGoodsService.validate of the file litemall-vue/src/views/items/detail/index.vue of the component Product Detail. Such manipulation of the argument detail leads to cross site...

CVE-2026-90564: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in quequnlong shiyi-blog 1.0.0-1.2.1. This impacts the function SysChatMsgMapper.getChatMsgList of the file blog-web/src/views/chat/index.vue of the component chat sendMsg Endpoint. Such manipulation of the argument chatmsg leads to cross site scripting. The attack...

CVE-2026-90527: Improper Neutralization of Input During Web Page Generation

A vulnerability was detected in quequnlong shiyi-blog up to 1.2.1. Affected is an unknown function of the file blog-admin/src/views/message/message/index.vue of the component Add Message API. The manipulation of the argument body.content results in cross site scripting. The attack can be executed...

PT-2026-90981

A flaw has been found in Rizwan17 inventory-management-system up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2. This affects an unknown function of the file includes/process.php. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. The explo...

PT-2026-90875

A vulnerability has been found in linlinjava litemall 1.4.0/1.5.0/1.6.0/1.7.0/1.8.0. This issue affects the function AdminGoodsService.validate of the file litemall-vue/src/views/items/detail/index.vue of the component Product Detail. Such manipulation of the argument detail leads to cross site...

PT-2026-90865

A vulnerability was detected in quequnlong shiyi-blog up to 1.2.1. Affected is an unknown function of the file blog-admin/src/views/message/message/index.vue of the component Add Message API. The manipulation of the argument body.content results in cross site scripting. The attack can be executed...

PT-2026-90789

A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11. Affected by this vulnerability is the function getTitle of the file application/views/task/add task.php of the component Task Title Output. Executing a manipulation of the argument og objects.name can lead to cross site...

CVE-2026-90502: Improper Neutralization of Input During Web Page Generation

A vulnerability was detected in stilleshan ServerStatus 1.0/2.0. Impacted is an unknown function of the file server/src/main.cpp of the component Stats Generation. Performing a manipulation of the argument custom results in cross site scripting. It is possible to initiate the attack remotely. The...

CVE-2026-90529: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in DataEase up to 2.10.25/2.10.26. Affected by this issue is the function buildTooltip of the file core/core-frontend/src/views/chart/components/js/panel/charts/map/symbolic-map.ts of the component Symbolic Map. Such manipulation of the argument...

CVE-2026-90563: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in maliangnansheng bbs-springboot 3.0.0. This affects the function utils.toToc of the file ArticleController.java. This manipulation causes cross site scripting. The attack is possible to be carried out remotely...

CVE-2026-90489 Xuxueli xxl-job insert cross site scripting

A vulnerability was identified in Xuxueli xxl-job up to 3.5.0. This vulnerability affects unknown code of the file /jobinfo/insert. Such manipulation of the argument name/author leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used...

CVE-2026-90489

Xuxueli xxl-job up to 3.5.0 contains a cross-site scripting (XSS) vulnerability in the /jobinfo/insert endpoint. Manipulating the name or author arguments allows remote attackers with low privileges (requiring user interaction) to inject client-side scripts. The CVSS 3.1 base score is 3.5 (LOW) ,...

CVE-2026-90534

Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name endpoint is mounted without any route-level permission check and invokes component loadMethods with an attacker-controlled nodeName, loadMethod, inputs, and...

CVE-2026-90534

Flowise , a low-code platform for building LLM applications, is affected by a Cross-Workspace Credential IDOR in the POST /api/v1/node-load-method/:name endpoint through version 3.1.3 . The endpoint lacks route-level permission checks and resolves credentials by raw Credential.id via getCredentia...

CVE-2026-90534 Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-method

Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name endpoint is mounted without any route-level permission check and invokes component loadMethods with an attacker-controlled nodeName, loadMethod, inputs, and...

EUVD-2026-76852

Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name endpoint is mounted without any route-level permission check and invokes component loadMethods with an attacker-controlled nodeName, loadMethod, inputs, and...

CVE-2026-90534 Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-method

Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name endpoint is mounted without any route-level permission check and invokes component loadMethods with an attacker-controlled nodeName, loadMethod, inputs, and...

CVE-2026-90534 Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-method

Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name endpoint is mounted without any route-level permission check and invokes component loadMethods with an attacker-controlled nodeName, loadMethod, inputs, and...

CVE-2026-81429

The Export & Import WPBakery Page Builder WordPress plugin through version 1.0.2 is affected by a CSRF to Stored XSS vulnerability discovered by Suhayb Ahmed (cyboltx). The plugin's template-import feature performs no CSRF check and fails to sanitise imported data before storing and echoing it ba...

WordPress Custom Menu Wizard Widget plugin <= 3.3.1 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin Custom Menu Wizard Widget versions = 3.3.1...