WordPress plugin King Addons for Elementor 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...

CI4MS 跨站脚本漏洞

CI4MS is an open-source blog page management tool developed by Ci4MS. Versions of CI4MS prior to 0.31.0.0 contained a cross-site scripting vulnerability. This vulnerability stemmed from the improper cleaning of user input when adding pages through the menu management feature, which could lead to...

EUVD-2026-17269

baserCMS is Vulnerable to Cross-site Scripting...

CVE-2026-34716 AVideo: DOM XSS via Unsanitized Display Name in WebSocket Call Notification

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo YPTSocket plugin's caller feature renders incoming call notifications using the jQuery Toast Plugin, passing the caller's display name directly as the heading parameter. The toast plugin constructs the heading as...

aie-sdk (>=3.0.1, <=3.0.4), aiearth-engine (>=3.0.2, <=3.1.6) +115 more potentially affected by CVE-2026-34073 via cryptography (38.0.1)

cryptography PYPI version 38.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - aie-sdk =3.0.1, =3.0.2, =2022.10.0b0, =3.0.0, =2.1.1, =0.1.37, =0.7.18, =0.1.9, =0.1.10 - c7n-org 0.6.18 and more Source cves:...

ais-dom (>=0.109.0b0, <=0.109.7), aws-gate (0.8.8) +10 more potentially affected by CVE-2026-34073 via cryptography (2.9.0)

cryptography PYPI version 2.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - ais-dom =0.109.0b0, =0.3.0a0, =0.109.0b0, =2.0.0rc1, =2.3.7, =1.37.1, =1.37.8 - tornado-widgets 0.0.17 Source cves: CVE-2026-34073 Sourc...

airflow-run (0.4.9), ais-dom (>=0.117.0b0, <=2021.2.4) +49 more potentially affected by CVE-2026-34073 via cryptography (3.2.0)

cryptography PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - airflow-run 0.4.9 - ais-dom =0.117.0b0, =2.0.1.dev14, =2.0.2 - azureml-accel-models 1.23.0 - azureml-cli-common 1.23.0 -...

ais-dom (>=2022.12.0b0, <=2022.12.3), alibabacloud-ros-iacer (0.0.16) +78 more potentially affected by CVE-2026-34073 via cryptography (38.0.3)

cryptography PYPI version 38.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - ais-dom =2022.12.0b0, =0.3.0, =2.1.0, =0.2.4, =3.69.0, =2.2.2, =2.1.0, =0.0.16, =0.0.20 and more Source cves: CVE-2026-34073 Source...

ais-dom (>=0.92.5, <=0.95.7), bitwarden-simple-cli (>=1.0.0, <=1.3.1) +29 more potentially affected by CVE-2026-34073 via cryptography (2.6.1)

cryptography PYPI version 2.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - ais-dom =0.92.5, =1.0.0, =1.7.1, =0.2.5, =0.0.0, =0.0.17, =0.0.1.dev33, =0.1.8, =0.4.3, =0.1.0, =1.0.5 - ezissue-br 1.0.0 and more Sourc...

ais-dom (>=0.96.10, <=0.98.9), ali-cli (>=0.5.1, <=0.7.2) +52 more potentially affected by CVE-2026-34073 via cryptography (2.7.0)

cryptography PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - ais-dom =0.96.10, =0.5.1, =0.0.1, =0.5.0, =1.0.1, =1.0.1, =0.0.5a0, =0.2.12, =2.5.6, =0.1.0, =0.5.1, =0.5.2 - duo-universal 1.0.1 -...

CVE-2026-32734 baserCMS: Multiple vulnerabilities in baserCMS

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has DOM-based cross-site scripting in tag creation. This issue has been patched in version 5.2.3...

CVE-2026-32734

CVE-2026-32734 concerns baserCMS, a website development framework. According to the provided documents, prior to version 5.2.3 baserCMS is vulnerable to a DOM-based cross-site scripting (XSS) issue in tag creation. The vulnerability is described as allowing malicious JavaScript execution in the b...

CVE-2026-32734: Improper Neutralization of Input During Web Page Generation

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has DOM-based cross-site scripting in tag creation. This issue has been patched in version 5.2.3...

HCL Aftermarket DPC Cross-Site Scripting Vulnerability

HCL Aftermarket DPC is a digital spare parts and aftermarket management platform for HCL India. HCL Aftermarket DPC suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied data, which can be exploited by an...

baserCMS 跨站脚本漏洞

BaserCMS is a corporate-level content management system CMS developed by the BaserCMS team. Versions of BaserCMS prior to 5.2.3 had a cross-site scripting vulnerability, which originated from DOM-based cross-site scripting during tag creation...

CVE-2026-34558 CI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input within the Methods Management functionality when creating or...

CVE-2026-34558 CI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input within the Methods Management functionality when creating or...

CVE-2026-27599

CI4MS (CodeIgniter 4-based CMS skeleton) is affected by a stored DOM XSS in System Settings – Mail Settings. Prior to version 0.31.0.0, fields such as Mail Server, Mail Port, Email Address, Email Password, Mail Protocol and TLS settings accept attacker-controlled input that is stored server-side ...

GHSA-66M2-V9V9-95C3 ci4-cms-erp/ci4ms: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

Summary Vulnerability: Stored DOM XSS via System Settings – Mail Settings Same-Page Attribute Breakout & Persistent Payload Injection - Stored Cross-Site Scripting via Unsanitized Mail Settings Configuration Fields Description The application fails to properly sanitize user-controlled input withi...

DOM-Based Cross-Site Scripting (XSS)

github.com/zitadel/zitadel, is vulnerable to DOM-Based Cross-Site Scripting XSS. The vulnerability is due to improper validation of the postlogoutredirect parameter in the /logout endpoint, which allows an unauthenticated remote attacker to execute malicious JavaScript in users’ browsers...