osTicket < 1.10.2 - Cross-Site Scripting

Cross-site scripting XSS vulnerability in /scp/index.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "sort" parameter. id: CVE-2018-7196 info: name: osTicket 1.10.2 - Cross-Site Scripting author: ritikchaddha severity: medium...

WordPress Integrator 1.32 - Cross-Site Scripting

A cross-site scripting vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirectto parameter to wp-login.php. id: CVE-2012-5913 info: name: WordPress Integrator 1.32 - Cross-Site Scripti...

WordPress Ultimate FAQs <= 1.8.24 – Unauthenticated HTML Content Injection

Functions/EWDUFAQImport.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection. id: CVE-2019-17233 info: name: WordPress Ultimate FAQs = 1.8.24 – Unauthenticated HTML Content Injection author: daffainfo severity: medium description: | Functions/EWDUFAQImport.ph...

XWiki < 4.10.20 - Remote code execution

XWiki is vulnerable to a remote code execution RCE attack through its user registration feature. This issue allows an attacker to execute arbitrary code by crafting malicious payloads in the "first name" or "last name" fields during user registration. This impacts all installations that have user...

npm: odf-kit: HTML injection leading to XSS in odtToHtml() and odsToHtml() via unescaped style attribute values

npm: odf-kit: HTML injection leading to XSS in odtToHtml and odsToHtml via unescaped style attribute values vulnerability discovered by ? in WordPress npm odf-kit versions = 0.6.0, 0.14.2...

odf-kit: HTML injection leading to XSS in odtToHtml() and odsToHtml() via unescaped style attribute values

Summary ODF style attribute values are interpolated into style="..." attributes without HTML-escaping in both of odf-kit's to-HTML renderers odtToHtml and odsToHtml. A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute...

XSScope

Go beyond the alert XSScope is one of the most advanced GUI Framework for XSS Clientside attacks. It can perform different XSS attack and HTML Injection in real time. Features Perform XSS botnet attacks. Every victim who is affected by XSS payload in the webserver, will contantly bind the payload...

CVE-2026-120648

CGI versions before 5.00 for Perl allow HTML injection via text containing -- in comment. Arguments are placed between without escaping, so text containing -- closes the comment early. An application that passes request data to comment can be made to inject HTML into the page...

CVE-2026-111040

The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inject unsanitised HTML content which is stored in the database and subsequently rendered in other users’ browsers, affecting the display of content within the...

EUVD-2026-116823

The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inject unsanitised HTML content which is stored in the database and subsequently rendered in other users’ browsers, affecting the display of content within the...

CVE-2026-111040

The Coupa Total Spend Management Platform is vulnerable to persistent HTML injection in editable fields managed by TinyMCE . An authenticated attacker with low privileges can inject unsanitized HTML content, which is stored in the database and rendered in other users' browsers. This flaw affects ...

CVE-2026-120648

A flaw was found in perl-CGI. When generating HTML comments, input is placed directly into comment tags without proper escaping. A remote attacker could exploit this flaw by submitting input that prematurely terminates the comment block, enabling the injection of arbitrary HTML or client-side...

CVE-2026-120648

CGI versions before 5.00 for Perl allow HTML injection via text containing -- in comment. Arguments are placed between without escaping, so text containing -- closes the comment early. An application that passes request data to comment can be made to inject HTML into the page...

PT-2026-136918

The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inject unsanitised HTML content which is stored in the database and subsequently rendered in other users’ browsers, affecting the display of content within the...

CVE-2026-111040: Coupa Coupa Total Spend Management Platform: The platform allows persistent HTML injection into editable fields managed by TinyMCE

The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inject unsanitised HTML content which is stored in the database and subsequently rendered in other users’ browsers, affecting the display of content within the...

CVE-2026-120648 CGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment

CGI versions before 5.00 for Perl allow HTML injection via text containing -- in comment. Arguments are placed between without escaping, so text containing -- closes the comment early. An application that passes request data to comment can be made to inject HTML into the page...

CVE-2026-120648

Perl CGI versions before 5.00 are vulnerable to HTML injection (CWE-79) because input data is placed into HTML comments without proper escaping. An attacker can submit text containing --&gt; to prematurely close the comment block, allowing the injection of arbitrary HTML or client-side scripts in...

CVE-2026-120648 CGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment

CGI versions before 5.00 for Perl allow HTML injection via text containing -- in comment. Arguments are placed between without escaping, so text containing -- closes the comment early. An application that passes request data to comment can be made to inject HTML into the page...

CVE-2026-120332

The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mail module can inject arbitrary HTML and JavaScript, which is executed in the context of other backend users viewing the mail preview or report...

CVE-2026-120332

The TYPO3 Extension "Mail" (mail) is vulnerable to Cross-Site Scripting (XSS) due to the backend module rendering the HTML content of emails and tracked URLs without proper escaping. An attacker with backend access to the mail module can inject arbitrary HTML and JavaScript , which executes withi...