xssless

xssless An automated XSS payload generator written in python. Usage 1. Record requests with Burp proxy 2. Select requests you want to generate, then right click and select "Save items" 3. Use xssless to generate your payload: ./xssless.py burpexportfile 4. Pwn! A more detailed tutorial can be fou...

CVE-2026-120205

Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related...

EUVD-2026-114726

Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related...

CVE-2026-120205

Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related...

CVE-2026-120205 Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name

Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related...

CVE-2026-120205

The Thelia software (versions prior to 3.1.0 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw in the ForSomeCustomers::getSummary() function. The root cause is the handling of unescaped customer names , allowing unauthenticated attackers to register with a script payload as their name....

CVE-2026-120205 Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name

Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related...

CVE-2026-120205: Thelia: Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows…

Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related...

PT-2026-134524

Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related...

CVE-2026-116874

SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unescaped default parameter in JsonResultPrinter. Attackers can lure victims to a crafted Special:Ask link with a zero-result query...

CVE-2026-116874 SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via JsonResultPrinter Default Parameter

SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unescaped default parameter in JsonResultPrinter. Attackers can lure victims to a crafted Special:Ask link with a zero-result query...

CVE-2026-116874

SemanticMediaWiki versions 3.1.0 before 7.3.1 is vulnerable to a reflected cross-site scripting (XSS) vulnerability. The root cause is an unescaped default parameter in the JsonResultPrinter component. An unauthenticated attacker can exploit this by luring victims to a crafted Special:Ask link fe...

CVE-2026-116874

SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unescaped default parameter in JsonResultPrinter. Attackers can lure victims to a crafted Special:Ask link with a zero-result query...

CVE-2026-116874 SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via JsonResultPrinter Default Parameter

SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unescaped default parameter in JsonResultPrinter. Attackers can lure victims to a crafted Special:Ask link with a zero-result query...

CVE-2026-116875

SemanticMediaWiki versions 3.0.0 before 7.3.1 are vulnerable to a reflected cross-site scripting (XSS) flaw within the Special:Ask functionality. The root cause is the lack of HTML escaping for separator parameters, specifically sep , propsep , valuesep , delim , and separator , when processed by...

EUVD-2026-110702

SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unescaped default parameter in JsonResultPrinter. Attackers can lure victims to a crafted Special:Ask link with a zero-result query...

CVE-2026-116874 SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via JsonResultPrinter Default Parameter

SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unescaped default parameter in JsonResultPrinter. Attackers can lure victims to a crafted Special:Ask link with a zero-result query...

PT-2026-126335

SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unescaped default parameter in JsonResultPrinter. Attackers can lure victims to a crafted Special:Ask link with a zero-result query...

Semantic MediaWiki authorization issue vulnerability

Versions 3.0.0 through 7.3.0 of Semantic MediaWiki contain an authorization issue vulnerability. This vulnerability stems from a lack of authorization checks in the smwtask module within api.php. Unauthenticated attackers can exploit publicly available anonymous CSRF tokens to perform maintenance...

REDAXO CMS core cross-site scripting vulnerability

REDAXO CMS core versions prior to 5.21.3 contain a cross-site scripting vulnerability. This flaw arises because the openerlink parameter on the backend media pool details page is not HTML-escaped, making it susceptible to reflected XSS attacks. Unauthenticated attackers can trick logged-in backen...