6593 matches found
CVE-2026-81894 Concrete CMS 9.5.2 and below is vulnerable to Stored DOM-based Cross-site Scripting (XSS) in the Gallery block image Caption field
Concrete CMS 9.5.2 and below is vulnerable to stored DOM-based Cross-site Scripting XSS via the Gallery block's per-image Caption field because the bundled Magnific Popup lightbox script concrete/js/features/imagery/frontend.js re-parses the attribute-decoded caption as HTML through jQuery's...
CVE-2026-91944 crawl4ai before 0.9.3 DOM-based XSS via Playground UI
crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI where the forceHighlightElement function assigns textContent back to innerHTML, re-parsing JSON responses as HTML. Attackers can inject malicious scripts through crawled page content like th...
CVE-2026-91944 crawl4ai before 0.9.3 DOM-based XSS via Playground UI
crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI where the forceHighlightElement function assigns textContent back to innerHTML, re-parsing JSON responses as HTML. Attackers can inject malicious scripts through crawled page content like th...
CVE-2026-91944 crawl4ai before 0.9.3 DOM-based XSS via Playground UI
crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI where the forceHighlightElement function assigns textContent back to innerHTML, re-parsing JSON responses as HTML. Attackers can inject malicious scripts through crawled page content like th...
CVE-2026-91944
crawl4ai versions before 0.9.3 are affected by a DOM-based XSS in the Playground UI. The root cause is in the forceHighlightElement() function, which assigns textContent back to innerHTML, causing JSON responses to be re-parsed as HTML. An attacker can inject malicious scripts via crawled page co...
EUVD-2026-78799
crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML. Attackers can craft malicious PDFs with event-handler markup to execute JavaScript in the Playground origin and steal API tokens fro...
CVE-2026-81894: Improper Neutralization of Special Elements used in an SQL Command
Concrete CMS 9.5.2 and below is vulnerable to stored DOM-based Cross-site Scripting XSS via the Gallery block's per-image Caption field because the bundled Magnific Popup lightbox script concrete/js/features/imagery/frontend.js re-parses the attribute-decoded caption as HTML through jQuery's...
CVE-2026-91942: Improper Neutralization of Input During Web Page Generation
crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML. Attackers can craft malicious PDFs with event-handler markup to execute JavaScript in the Playground origin and steal API tokens fro...
CVE-2026-91944: Improper Neutralization of Input During Web Page Generation
crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI where the forceHighlightElement function assigns textContent back to innerHTML, re-parsing JSON responses as HTML. Attackers can inject malicious scripts through crawled page content like th...
CVE-2026-82019
TripleLift's ad rendering script video-bundle.js contains a DOM-based cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a publisher's domain by sending crafted postMessage payloads without origin validation. Attackers can cause a victim to...
CVE-2026-82019 TripleLift video-bundle.js DOM-based XSS via postMessage
TripleLift's ad rendering script video-bundle.js contains a DOM-based cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a publisher's domain by sending crafted postMessage payloads without origin validation. Attackers can cause a victim to...
CVE-2026-82019
TripleLift's ad rendering script (video-bundle.js ) is vulnerable to a DOM-based cross-site scripting (XSS) flaw caused by the absence of origin validation on postMessage events. An unauthenticated attacker can craft a malicious page that sends postMessage payloads to a publisher page loading the...
CVE-2026-82019 TripleLift video-bundle.js DOM-based XSS via postMessage
TripleLift's ad rendering script video-bundle.js contains a DOM-based cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a publisher's domain by sending crafted postMessage payloads without origin validation. Attackers can cause a victim to...
PT-2026-91224
TripleLift's ad rendering script video-bundle.js contains a DOM-based cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a publisher's domain by sending crafted postMessage payloads without origin validation. Attackers can cause a victim to...
CVE-2026-82019: Improper Neutralization of Input During Web Page Generation
TripleLift's ad rendering script video-bundle.js contains a DOM-based cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a publisher's domain by sending crafted postMessage payloads without origin validation. Attackers can cause a victim to...
CVE-2026-54165: Improper Neutralization of Input During Web Page Generation
Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting XSS vulnerability in the public, unauthenticated shared-folder image gallery. A file's name is fully attacker-controlled and is never...
Vulnerabilities in Adobe Experience Manager
Adobe has identified several vulnerabilities in Adobe Experience Manager. Adobe Experience Manager contains several Cross-Site Scripting XSS vulnerabilities, including DOM-based and stored XSS vulnerabilities. These vulnerabilities allow attackers to inject and execute malicious JavaScript code...
CVE-2025-3271
CVE-2025-3271 is attributed in the initial record to a DOM-based XSS in OpenText Documentum Webtop versions prior to 16.7.1 , rated CVSS 4.0 4.8 (MEDIUM) requiring low privileges and active user interaction with low impact on confidentiality and integrity. A connected PT Security entry (PT-2025-2...