CVE-2023-46019-Code-Projects-Blood-Bank-1.0-Reflected-Cross-Site-Scripting-Vulnerability

CVE-2023-46019-Code-Projects-Blood-Bank-1.0-Reflected-Cross-Site-Scripting-Vulnerability Exploit Author: ersinerenler Vendor Homepage https://code-projects.org/blood-bank-in-php-with-source-code Software Link https://download-media.code-projects.org/2020/11/BloodBankInPHPWithSourcecode.zip Overvi...

CVE-2026-124474

MRBS Meeting Room Booking System before 1.12.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script via the error parameter of viewentry.php. Attackers can send crafted links to logged-in users to read CSRF tokens, modify or delete booking...

CVE-2026-124474 MRBS before 1.12.3 Reflected XSS via error parameter of view_entry.php

MRBS Meeting Room Booking System before 1.12.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script via the error parameter of viewentry.php. Attackers can send crafted links to logged-in users to read CSRF tokens, modify or delete booking...

EUVD-2026-119606

MRBS Meeting Room Booking System before 1.12.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script via the error parameter of viewentry.php. Attackers can send crafted links to logged-in users to read CSRF tokens, modify or delete booking...

CVE-2026-124474

The Meeting Room Booking System (MRBS) version before 1.12.3 is vulnerable to a reflected cross-site scripting (XSS) vulnerability. The issue resides in the view_entry.php file, where an unauthenticated attacker can inject scripts via the error parameter . By sending crafted links to authenticate...

CVE-2026-124474 MRBS before 1.12.3 Reflected XSS via error parameter of view_entry.php

MRBS Meeting Room Booking System before 1.12.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script via the error parameter of viewentry.php. Attackers can send crafted links to logged-in users to read CSRF tokens, modify or delete booking...

CVE-2026-124474: meeting-room-booking-system mrbs-code: MRBS (Meeting Room Booking System) before 1.12.3 contains a reflected cross-site scripting vulnerability that allows…

MRBS Meeting Room Booking System before 1.12.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script via the error parameter of viewentry.php. Attackers can send crafted links to logged-in users to read CSRF tokens, modify or delete booking...

PT-2026-140010

MRBS Meeting Room Booking System before 1.12.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script via the error parameter of view entry.php. Attackers can send crafted links to logged-in users to read CSRF tokens, modify or delete...

MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler

SummaryThe OAuth 2.0 setup wizard's local callback HTTP server reflects the error query parameter directly into an HTML response without any sanitization or encoding. An attacker can craft a malicious callback URL containing JavaScript in the error parameter that executes in the victim's browser...

GHSA-G2R2-3J32-J27X MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler

Summary The OAuth 2.0 setup wizard's local callback HTTP server reflects the error query parameter directly into an HTML response without any sanitization or encoding. An attacker can craft a malicious callback URL containing JavaScript in the error parameter that executes in the victim's browser...

Cross-site Scripting (XSS)

Overview mcp-atlassian is a The Model Context Protocol MCP Atlassian integration is an open-source implementation that bridges Atlassian products Jira and Confluence with AI language models following Anthropic's MCP specification. This project enables secure, contextual AI interactions with...

MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler

Summary The OAuth 2.0 setup wizard's local callback HTTP server reflects the error query parameter directly into an HTML response without any sanitization or encoding. An attacker can craft a malicious callback URL containing JavaScript in the error parameter that executes in the victim's browser...

PT-2026-96955

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description The OAuth 2.0 setup wizard's local callback HTTP server reflects the error query parameter directly into an HTML response without sanitization or encoding. This occurs within the CallbackHandl...

CVE-2026-85577 AVideo userLogin.php Reflected XSS via error parameter

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php that allows unauthenticated attackers to inject arbitrary JavaScript by closing the script tag with . Attackers can craft a malicious URL with an error parameter containing script breakout...

CVE-2026-85577 AVideo userLogin.php Reflected XSS via error parameter

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php that allows unauthenticated attackers to inject arbitrary JavaScript by closing the script tag with . Attackers can craft a malicious URL with an error parameter containing script breakout...

CVE-2026-85577

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php that allows unauthenticated attackers to inject arbitrary JavaScript by closing the script tag with . Attackers can craft a malicious URL with an error parameter containing script breakout...

CVE-2026-85577: Improper Neutralization of Input During Web Page Generation

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php that allows unauthenticated attackers to inject arbitrary JavaScript by closing the script tag with . Attackers can craft a malicious URL with an error parameter containing script breakout...

CVE-2025-71404

better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting XSS vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a...

EUVD-2025-210583

better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting XSS vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a...

CVE-2025-71404

Summary: CVE-2025-71404 affects better-auth versions after 0.0.2 and before 1.1.16. The vulnerability is a reflected XSS on the /api/auth/error page where the URL parameter error is echoed into HTML without proper neutralization, enabling arbitrary JavaScript when a user visits a crafted link. Im...