CVE-2026-66421-OpenClaw-Dashboard-Stored-XSS-via-lastMessage-Session-Field

Aviso de Seguridad: Cross-Site Scripting Almacenado a Través de Mensajes de Agente Que Conduce al Robo de Tokens de Sesión openclaw-dashboard Título: OpenClaw Dashboard XSS Almacenado a través del campo lastMessage de la sesión ID de CVE: CVE-2026-66421...

Tiny-XSS-Payloads

Tiny-XSS-Payloads Una colección de cargas útiles XSS cortas que se pueden usar en diferentes contextos. La DEMO disponible aquí: https://tinyxss.terjanq.me Cargas útiles actuales root@kitploit: ... -- root@kitploit: root@kitploit: root@kitploit: root@kitploit:...

CVE-2023-4771

Vulnerabilidad de Cross-site scripting en CKEditor en el ejemplo AJAX PoC CVE-2023-4771 Vulnerabilidad de Cross-site scripting XSS en CKEditor 4 en el ejemplo AJAX Este documento describe cómo realizar una vulnerabilidad XSS CVE-2023-4771 usando CKEditor. Asegúrese de que todo lo siguiente se hag...

CVE-2026-54165

Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting XSS vulnerability in the public, unauthenticated shared-folder image gallery. A file's name is fully attacker-controlled and is never...

CVE-2026-54165

Dobase , an open-source self-hosted workspace, is affected by a one-click stored DOM-based XSS in its public shared-folder image gallery. The root cause is that a file's name attribute is fully attacker-controlled and never sanitized; it is round-tripped through an ERB-escaped data-name attribute...

PT-2026-90505

Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting XSS vulnerability in the public, unauthenticated shared-folder image gallery. A file's name is fully attacker-controlled and is never...

CVE-2026-87814

SiYuan before v3.8.2 is affected by a stored cross-site scripting (XSS) vulnerability in the search asset preview feature. The root cause is a failure to escape indexed asset content before inserting it into the DOM via innerHTML . An attacker who can place crafted text assets in a workspace can ...

cve-2026-41200-stig-manager-oidc-reflected-xss

CVE-2026-41200 — PoC de XSS Reflejado en STIG Manager OIDC Prueba de concepto de la vulnerabilidad de Cross-Site Scripting XSS reflejado en STIG Manager versiones 1.5.10 hasta 1.6.7. Resumen de la vulnerabilidad Existe una vulnerabilidad de XSS reflejado en el código de manejo de errores de...

CVE-2026-66418-OpenClaw-Dashboard-v3.0.0-Stored-XSS-via-Failed-Login-Username-Field

Aviso de seguridad: Cross-Site Scripting almacenado no autenticado que conduce a la toma de control de la cuenta de administrador openclaw-dashboard Título: OpenClaw Dashboard v3.0.0 XSS almacenado a través del campo de nombre de usuario en inicio de sesión fallido ID de CVE asignado:...

CVE-2026-86188

AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global...

CVE-2026-8625 Dear Flipbook <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.df-element' Element Inner HTML

The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent Custom HTML block inner HTML' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output...

EUVD-2026-71841

The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent Custom HTML block inner HTML' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output...

CVE-2026-8625 Dear Flipbook <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.df-element' Element Inner HTML

The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent Custom HTML block inner HTML' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output...

PT-2026-86315

The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post content Custom HTML block inner HTML' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output...

Dear Flipbook < 2.4.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.df-element' Element Inner HTML

Description The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent Custom HTML block inner HTML' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and...

CVE-2026-85061 MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip

MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes removes attributes from the same collection, shifting indexes and skipping an adjacent dangerous...

CVE-2026-82868

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute...

CVE-2026-82865

pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML. Attackers who control label overrides through options.labels can inject arbitrary JavaScript that executes when users open the...

CVE-2026-82868 @pdfme/schemas before 5.5.9 Cross-Site Scripting via SVG

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute...

CVE-2026-82868

@pdfme/schemas versions before 5.5.9 contain a cross-site scripting (XSS) vulnerability in the SVG schema plugin . User-supplied SVG content is rendered directly to innerHTML without sanitization , allowing attackers to inject malicious SVG with embedded scripts, event handlers, or foreignObject ...