CVE-2026-124492

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor's createBookmarkList, which inserts entity-decoded h1-h6 header textContent into the bookmark list via innerHTML without escaping. Attackers can store HTML-encoded payloads in editor headers that...

EUVD-2026-119547

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor's createBookmarkList, which inserts entity-decoded h1-h6 header textContent into the bookmark list via innerHTML without escaping. Attackers can store HTML-encoded payloads in editor headers that...

CVE-2026-124492

SunEditor versions prior to 3.4.0 are vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability within the ModalAnchorEditor component, specifically in the #createBookmarkList function. The root cause is the insertion of entity-decoded h1-h6 header textContent into the bookmark list using i...

PT-2026-140006

Name of the Vulnerable Software and Affected Versions SunEditor versions prior to 3.4.0 Description A stored cross-site scripting issue exists in the DocumentType constructor. The flaw occurs when header textContent is injected into innerHTML without proper HTML escaping. This allows attackers to...

PT-2026-140005

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor's createBookmarkList, which inserts entity-decoded h1-h6 header textContent into the bookmark list via innerHTML without escaping. Attackers can store HTML-encoded payloads in editor headers that...

CVE-2026-124492: JiHong88 suneditor: SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor's #createBookmarkList,…

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor's createBookmarkList, which inserts entity-decoded h1-h6 header textContent into the bookmark list via innerHTML without escaping. Attackers can store HTML-encoded payloads in editor headers that...

Tiny-XSS-Payloads

Tiny-XSS-Payloads A collection of short XSS payloads that can be used in different contexts. The DEMO available here: https://tinyxss.terjanq.me Current Payloads ... -- " !-- If number of iframes on the pa...

openclaw-dashboard

OpenClaw Agent Dashboard A beautiful, secure, real-time monitoring dashboard for OpenClaw agents. Track sessions, monitor API usage, view costs, manage memory files, and keep tabs on system health - all in one place. Screenshots Overview| Sessions| Costs ---|---|--- | | Rate Limits| Live Feed| Lo...

CVE-2025-64495-POC

CVE-2025-64495-POC Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE Summary The functionality that inserts custom prompts into the chat window is vulnerable to DOM XSS when 'Insert Prompt as Rich Text' is enabled, since the prom...

Appsmith-1.98-Stored-XSS-Exploit

CVE-2026-7299 - Appsmith 1.98 Stored XSS SQL Autocomplete innerHTML Sink Automated exploit for a stored cross-site scripting vulnerability in Appsmith's SQL query editor. A workspace Developer can inject arbitrary JavaScript via database table names that execute in any other workspace member's...

CVE-2026-119735

Munshi by Petpooja before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated users to inject malicious markup through item descriptions or messages submitted in the Purchase Inquiry thread /purchase-inquiry/thread/thread-id, which is assigned to innerHTML...

CVE-2026-119735 Munshi XSS via Purchase Inquiry Thread Rendering

Munshi by Petpooja before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated users to inject malicious markup through item descriptions or messages submitted in the Purchase Inquiry thread /purchase-inquiry/thread/thread-id, which is assigned to innerHTML...

EUVD-2026-115366

Munshi by Petpooja before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated users to inject malicious markup through item descriptions or messages submitted in the Purchase Inquiry thread /purchase-inquiry/thread/thread-id, which is assigned to innerHTML...

CVE-2026-119735

Munshi (by Petpooja) versions prior to 2026-07-13 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The flaw exists in the Purchase Inquiry thread (/purchase-inquiry/thread/{thread-id}) where malicious markup can be injected via item descriptions or messages. The root cause is ...

CVE-2026-119735: Petpooja Munshi: Munshi (by Petpooja) before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated…

Munshi by Petpooja before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated users to inject malicious markup through item descriptions or messages submitted in the Purchase Inquiry thread /purchase-inquiry/thread/thread-id, which is assigned to innerHTML...

CVE-2026-9806

CVE-2026-9806 CVE-2026-9806 is a Stored Cross-Site Scripting Stored XSS vulnerability affecting CTI Transmute versions prior to the patched release.The flaw exists in the notification panel, where notification messages containing user-controlled convert names are rendered in the notification bell...

cve-2026-41200-stig-manager-oidc-reflected-xss

CVE-2026-41200 — STIG Manager OIDC Reflected XSS PoC Conceptual Proof of Concept for the reflected Cross-Site Scripting XSS vulnerability in STIG Manager versions 1.5.10 through 1.6.7. Vulnerability Summary A reflected XSS vulnerability exists in the STIG Manager Web App OIDC authentication error...

CVE-2026-66418-OpenClaw-Dashboard-v3.0.0-Stored-XSS-via-Failed-Login-Username-Field

Security Advisory: Unauthenticated Stored Cross-Site Scripting Leading To Administrator Account Takeover openclaw-dashboard Title: OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field Assigned CVE ID: CVE-2026-66418 Target Repository:...

phpmyadmin-vqb-xss

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · phpmyadmin-vqb-xss Write-up: https://abraxaslabs.tech/research/phpmyadmin-vqb-xss phpmyadmin-vqb-xss Class: Stored XSS Reach: Remote phpMyAdmin 5.2.3 RELEASE523 / 962857e - phpMyAdmin js/src/designer/history.js builds...

CVE-2026-118057

The Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUESTURI' parameter in all versions up to, and including, 22.3.2 due to insufficient input sanitization and output escaping. This mak...