HW-Pyton-10

CVE-2020-11022 Brief description CVE-2020-11022 is a Reflected XSS Cross-Site Scripting vulnerability related to incorrect processing of user input that is reflected in the HTML response without escaping. An attacker can inject JavaScript code that will execute in the user's browser...

EUVD-2026-98084

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the HTML response...

CVE-2026-93892

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the HTML response...

CVE-2026-93892

The IBM TRIRIGA Application Platform versions 5.0.0 through 5.0.8 are vulnerable to an information disclosure vulnerability (CWE-200). A remote authenticated attacker can obtain sensitive information because session tokens are exposed within the HTML response in the Admin console. To remediate th...

CVE-2026-93892 Security Vulnerability identified in IBM TRIRIGA - Information Disclosure in Admin Console

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the HTML response...

PT-2026-111109

Name of the Vulnerable Software and Affected Versions IBM TRIRIGA Application Platform versions 5.0.0 through 5.0.8 Description A remote authenticated attacker can obtain sensitive information because session tokens are exposed within the HTML response. Recommendations At the moment, there is no...

CVE-2026-19657 ScadaLTS Unauthenticated Reflected XSS

ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. An unauthenticated attacker who lures a victim into visiting a crafted URL can execute arbitrary JavaScript in the context of the victim's browser session...

CVE-2026-19657: Improper Neutralization of Input During Web Page Generation

ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. An unauthenticated attacker who lures a victim into visiting a crafted URL can execute arbitrary JavaScript in the context of the victim's browser session...

GO-2026-5170 OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga...

CVE-2026-40986 Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML

Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scripting attack in the user's browser if the error response from the server contains error details with input reflected from an attacker...

cve-2026-40986 - MEDIUM - Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML

cve-2026-40986 - MEDIUM - Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML...

CVE-2026-45315

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, the audio transcription upload endpoint takes the file extension from the user-supplied filename and saves the file under CACHEDIR/audio/transcriptions/.. The /cache/path route serve...

CVE-2026-40293

OpenFGA is an authorization/permission engine built for developers. In versions 0.1.4 through 1.13.1, when OpenFGA is configured to use preshared-key authentication with the built-in playground enabled, the local server includes the preshared API key in the HTML response of the /playground...

CVE-2026-40293 OpenFGA Playground Preshared Key Exposure

OpenFGA is an authorization/permission engine built for developers. In versions 0.1.4 through 1.13.1, when OpenFGA is configured to use preshared-key authentication with the built-in playground enabled, the local server includes the preshared API key in the HTML response of the /playground...

GHSA-68M9-983M-F3V5 OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response

Description When OpenFGA is configured to use preshared-key authentication with the built-in playground enabled, the local server includes the preshared API key in the HTML response of the /playground endpoint. The /playground endpoint is enabled by default and does not require authentication. It...

GHSA-8WHX-V8QQ-PQ64 changedetection.io has Reflected XSS in its RSS Tag Error Response

A reflected cross-site scripting XSS vulnerability was identified in the /rss/tag/ endpoint of changedetection.io. The taguuid path parameter is reflected directly in the HTTP response body without HTML escaping. Since Flask returns text/html by default for plain string responses, the browser...

CVE-2025-66845

A reflected Cross-Site Scripting (XSS) vulnerability exists in TechStore version 1.0 within the user_name endpoint. The root cause is that the id query parameter is reflected directly into the HTML response without proper output encoding or sanitization . This allows an attacker to execute arbitr...

EUVD-2018-4212

Malware in sbrugna...

EUVD-2025-22586

Malicious code in bioql PyPI...

CVE-2025-5301

ONLYOFFICE Docs (DocumentServer) versions 8.3.1 and below are vulnerable to a reflected cross-site scripting (XSS) issue. The root cause is the improper sanitization of crafted HTTP POST requests sent via the WOPI protocol . An attacker can inject malicious scripts that are reflected in the serve...