CVE-2026-102756: Improper Neutralization of Input During Web Page Generation

DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users who can edit dataset fields and chart configuration can store an HTML-bearing dimension value in a bar-horizontal chart. When lengthLimit truncates the category axis label,...

CVE-2023-4771

CKEditor cross-site scripting vulnerability in AJAX sample CVE-2023-4771 PoC CKEditor 4 Cross-site scripting XSS vulnerability in AJAX sample This document describes how to perform an XSS vulnerability CVE-2023-4771 using CKEditor. Make sure the following is done with great caution to follow...

CVE-2026-101127

Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms 2.4.3.4 - The public form upload endpoint validates the uploaded file's extension and detected MIME type, but stores the attacker-supplied original multipart filename verbatim in...

CVE-2026-101127 Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4

Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms 2.4.3.4 - The public form upload endpoint validates the uploaded file's extension and detected MIME type, but stores the attacker-supplied original multipart filename verbatim in...

CVE-2026-101127 Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4

Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms 2.4.3.4 - The public form upload endpoint validates the uploaded file's extension and detected MIME type, but stores the attacker-supplied original multipart filename verbatim in...

EUVD-2026-89096

Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms 2.4.3.4 - The public form upload endpoint validates the uploaded file's extension and detected MIME type, but stores the attacker-supplied original multipart filename verbatim in...

CVE-2026-101127

The Joomla Extension - balbooa.com (specifically Balbooa Forms ) is vulnerable to an unauthenticated stored Cross-Site Scripting (XSS) in versions prior to 2.4.3.4 . The root cause is that the public form upload endpoint validates file extensions and MIME types but stores the attacker-supplied or...

PT-2026-102706

Name of the Vulnerable Software and Affected Versions Balbooa Forms versions prior to 2.4.3.4 Description An unauthenticated stored Cross-Site Scripting XSS issue exists in the public form upload endpoint. While the endpoint validates file extensions and MIME types, it stores the original multipa...

CVE-2026-101127: Improper Neutralization of Input During Web Page Generation

Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms 2.4.3.4 - The public form upload endpoint validates the uploaded file's extension and detected MIME type, but stores the attacker-supplied original multipart filename verbatim in...

CVE-2026-18311

Readwise Reader for Android contains a cross-site scripting vulnerability due to missing HTML sanitization in its processing of imported document metadata. Attacker-controlled fields such as the author meta tag are inserted into a WebView via innerHTML, enabling stored XSS that executes on synced...

CVE-2026-18312

Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The application interpolates untrusted values directly into URL strings and inserts them into the DOM via innerHTML. Because the interpolation occurs without HTML or...

CVE-2026-18311 CVE-2026-18311

Readwise Reader for Android contains a cross-site scripting vulnerability due to missing HTML sanitization in its processing of imported document metadata. Attacker-controlled fields such as the author meta tag are inserted into a WebView via innerHTML, enabling stored XSS that executes on synced...

CVE-2026-18311

Readwise Reader for Android version 8.7.2 is vulnerable to a stored cross-site scripting (XSS) vulnerability due to insufficient HTML escaping and missing sanitization in the header rendering component. Specifically, attacker-controlled metadata fields, such as doc.author and doc.title , are inse...

CVE-2026-18311 CVE-2026-18311

Readwise Reader for Android contains a cross-site scripting vulnerability due to missing HTML sanitization in its processing of imported document metadata. Attacker-controlled fields such as the author meta tag are inserted into a WebView via innerHTML, enabling stored XSS that executes on synced...

CVE-2026-18312 CVE-2026-18312

Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The application interpolates untrusted values directly into URL strings and inserts them into the DOM via innerHTML. Because the interpolation occurs without HTML or...

CVE-2026-18312

Readwise Reader for Android version 8.7.2 is vulnerable to a stored cross-site scripting (XSS) flaw in its WebView URL construction logic. The application fails to properly encode or escape attacker-controlled metadata before interpolating it into URL strings, specifically impacting the X (former...

EUVD-2026-87230

Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The application interpolates untrusted values directly into URL strings and inserts them into the DOM via innerHTML. Because the interpolation occurs without HTML or...

CVE-2026-84280

The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Order 'elements.title' Parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...

CVE-2026-84280 Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via Shortcode Order 'elements[].title' Parameter

The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Order 'elements.title' Parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...

CVE-2026-84280 Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via Shortcode Order 'elements[].title' Parameter

The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Order 'elements.title' Parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...