Cross-site Scripting (XSS)

Apache Wicket is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper escaping of attacker-influenced model data rendered inside elements, which allows an attacker to inject and execute malicious HTML or script content in a victim's browser...

CVE-2026-102586

A flaw exists in Moodle where insufficient sanitization of username input on the password reset page enables a remote cross-site scripting (XSS) attack. An attacker can execute arbitrary script in a victim's browser by tricking an unauthenticated user into clicking a specially crafted password re...

CVE-2026-102586 Moodle: xss via password reset link due to insufficient username escaping

A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting XSS attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary...

CVE-2026-102581

A flaw in Moodle allows for a stored cross-site scripting (XSS) vulnerability due to insufficient output escaping in templates used to display forum posts. An attacker can inject malicious content into a forum post, causing arbitrary script code to execute in the browser of any user viewing that ...

CVE-2026-102581 Moodle: xss in forum post templates due to insufficient escaping

A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting XSS vulnerability. An attacker can inject malicious content into a forum post, which then executes arbitrary script code in the browser of another user viewing t...

CVE-2026-102581 Moodle: xss in forum post templates due to insufficient escaping

A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting XSS vulnerability. An attacker can inject malicious content into a forum post, which then executes arbitrary script code in the browser of another user viewing t...

CVE-2026-102581

A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting XSS vulnerability. An attacker can inject malicious content into a forum post, which then executes arbitrary script code in the browser of another user viewing t...

CVE-2024-2876

CVE-2024-2876 脆弱性の説明: WordPress & WooCommerce向けのEmail Marketing、Newsletters、AutomationプラグインであるEmail Subscribers by Icegram Express – Email Marketing、Newsletters、Automation for WordPress &...

CentOS Linux 7 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-devel / etc (CENTOS7:CLSA-2025:1753982448)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1753982448 advisory. - In PHP versions:8.1. before 8.1.33, 8.2. before 8.2.29, 8.3. before 8.3.23, 8.4. pgsql and pdopgsql escaping functions do not check if the...

TencentOS Server 4: php (TSSA-2026:1061)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1061 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2026-92224

Joomla! Core - 20260911 - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The link toolbar layout did not properly escape inputs, leading to an XSS vector...

CVE-2026-90918

Joomla! Core - 20260908 - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions...

CVE-2026-90906

Joomla! Core - 20260901 - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to XSS vulnerabilities in the link method of the HTML Helper...

CVE-2026-5513

CVE-2026-5513 https://t.me/FreeToolsCpa CVE-2026-5513 — Bookly ≤ 27.2 Stored XSS via Cookie CVE-2026-5513 — Bookly ≤ 27.2 Stored XSS via Cookie CVE CVSS Type Auth https://t.me/FreeToolsCpa CVE file In Group 概要 フィールド 値 CVE ID CVE-2026-5513 脆弱性 Stored Cross-Site Scripting XSS プラグイン Bookly — Online...

EUVD-2026-89086

Joomla! Core - 20260911 - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The link toolbar layout did not properly escape inputs, leading to an XSS vector...

CVE-2026-92224

Joomla! Core versions 4.0.0-5.4.8 and 6.0.0-6.1.3 are vulnerable to a Cross-Site Scripting (XSS) flaw in the link toolbar layout . The root cause is the failure to properly escape inputs, which creates an XSS vector. This vulnerability has a HIGH base severity (CVSS 4.0 score of 8.4 ). No specifi...

CVE-2026-90914 Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

Joomla! Core - 20260904 - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to an XSS vulnerability in the generic audio and video output layouts...

CVE-2026-90914

A cross-site scripting (XSS) vulnerability exists in Joomla! Core versions 4.0.0-5.4.8 and 6.0.0-6.1.3 . The root cause is a lack of escaping within the generic audio and video output layouts . This flaw allows an attacker to execute malicious scripts in the context of a user's session. No specif...

CVE-2026-90918

The Joomla! Core software is vulnerable to a Cross-Site Scripting (XSS) flaw in its HTML Mail Templates feature. The root cause is a lack of an escaping mechanism , which allows for XSS vectors across multiple extensions. This issue affects Joomla versions 4.0.0-5.4.8 and 6.0.0-6.1.3 . No specifi...

CVE-2026-92225

Joomla! Core versions 4.0.0-5.4.8 and 6.0.0-6.1.3 are vulnerable to a Cross-Site Scripting (XSS) flaw within the module list layout. The root cause is the failure to properly escape user-supplied values, which creates an XSS vector. The vulnerability has a High base severity score of 8.4, requiri...