CVE-2026-66421-OpenClaw-Dashboard-Stored-XSS-via-lastMessage-Session-Field

Security Advisory: Stored Cross-Site Scripting Via Agent Messages Leading To Session Token Theft openclaw-dashboard Title: OpenClaw Dashboard Stored XSS via lastMessage Session Field CVE ID: CVE-2026-66421 https://github.com/tugcantopaloglu/openclaw-dashboard Summary The sessions table on the...

Tiny-XSS-Payloads

Tiny-XSS-Payloads A collection of short XSS payloads that can be used in different contexts. The DEMO available here: https://tinyxss.terjanq.me Current Payloads ... -- " !-- If number of iframes on the pa...

CVE-2026-9806

CVE-2026-9806 CVE-2026-9806 is a Stored Cross-Site Scripting Stored XSS vulnerability affecting CTI Transmute versions prior to the patched release.The flaw exists in the notification panel, where notification messages containing user-controlled convert names are rendered in the notification bell...

CVE-2025-64495-POC

CVE-2025-64495-POC Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE Summary The functionality that inserts custom prompts into the chat window is vulnerable to DOM XSS when 'Insert Prompt as Rich Text' is enabled, since the prom...

CVE-2025-71465

@kolkov/angular-editor before 3.0.3 contains a cross-site scripting vulnerability in refreshView that writes HTML from ngModel or reactive form controls to innerHTML without DomSanitizer, bypassing the default sanitize option. Attackers can store HTML with event-handler attributes in content late...

CVE-2025-71464

@kolkov/angular-editor before 3.0.4 contains a cross-site scripting vulnerability in toggleEditorMode that assigns source view text to innerHTML without DomSanitizer sanitization. Attackers can induce users to paste HTML with event handlers such as img onerror into source mode, executing script i...

CVE-2025-71464 @kolkov/angular-editor before 3.0.4 XSS via toggleEditorMode()

@kolkov/angular-editor before 3.0.4 contains a cross-site scripting vulnerability in toggleEditorMode that assigns source view text to innerHTML without DomSanitizer sanitization. Attackers can induce users to paste HTML with event handlers such as img onerror into source mode, executing script i...

CVE-2025-71464

The @kolkov/angular-editor library (versions before 3.0.4 ) is vulnerable to a Cross-Site Scripting (XSS) flaw within the toggleEditorMode() function. The root cause is the assignment of source view text to innerHTML without utilizing DomSanitizer for proper sanitization. An attacker can trick a ...

EUVD-2025-211337

@kolkov/angular-editor before 3.0.4 contains a cross-site scripting vulnerability in toggleEditorMode that assigns source view text to innerHTML without DomSanitizer sanitization. Attackers can induce users to paste HTML with event handlers such as img onerror into source mode, executing script i...

CVE-2025-71465 @kolkov/angular-editor before 3.0.3 XSS via refreshView()

@kolkov/angular-editor before 3.0.3 contains a cross-site scripting vulnerability in refreshView that writes HTML from ngModel or reactive form controls to innerHTML without DomSanitizer, bypassing the default sanitize option. Attackers can store HTML with event-handler attributes in content late...

EUVD-2025-211336

@kolkov/angular-editor before 3.0.3 contains a cross-site scripting vulnerability in refreshView that writes HTML from ngModel or reactive form controls to innerHTML without DomSanitizer, bypassing the default sanitize option. Attackers can store HTML with event-handler attributes in content late...

CVE-2025-71465

The @kolkov/angular-editor library (versions prior to 3.0.3 ) is vulnerable to a cross-site scripting (XSS) flaw within the refreshView() function. The root cause is the direct injection of HTML from ngModel or reactive form controls into the innerHTML without using DomSanitizer , effectively byp...

CVE-2026-66418-OpenClaw-Dashboard-v3.0.0-Stored-XSS-via-Failed-Login-Username-Field

Security Advisory: Unauthenticated Stored Cross-Site Scripting Leading To Administrator Account Takeover openclaw-dashboard Title: OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field Assigned CVE ID: CVE-2026-66418 Target Repository:...

phpmyadmin-vqb-xss

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · phpmyadmin-vqb-xss Write-up: https://abraxaslabs.tech/research/phpmyadmin-vqb-xss phpmyadmin-vqb-xss Class: Stored XSS Reach: Remote phpMyAdmin 5.2.3 RELEASE523 / 962857e - phpMyAdmin js/src/designer/history.js builds...

CVE-2025-71464: kolkov angular-editor: @kolkov/angular-editor before 3.0.4 contains a cross-site scripting vulnerability in toggleEditorMode() that assigns…

@kolkov/angular-editor before 3.0.4 contains a cross-site scripting vulnerability in toggleEditorMode that assigns source view text to innerHTML without DomSanitizer sanitization. Attackers can induce users to paste HTML with event handlers such as img onerror into source mode, executing script i...

PT-2026-147410

@kolkov/angular-editor before 3.0.4 contains a cross-site scripting vulnerability in toggleEditorMode that assigns source view text to innerHTML without DomSanitizer sanitization. Attackers can induce users to paste HTML with event handlers such as img onerror into source mode, executing script i...

CVE-2025-71465: kolkov angular-editor: @kolkov/angular-editor before 3.0.3 contains a cross-site scripting vulnerability in refreshView() that writes HTML…

@kolkov/angular-editor before 3.0.3 contains a cross-site scripting vulnerability in refreshView that writes HTML from ngModel or reactive form controls to innerHTML without DomSanitizer, bypassing the default sanitize option. Attackers can store HTML with event-handler attributes in content late...

PT-2026-147411

Name of the Vulnerable Software and Affected Versions @kolkov/angular-editor versions prior to 3.0.3 Description An issue exists where the refreshView function writes HTML from ngModel or reactive form controls directly to innerHTML without using DomSanitizer. This bypasses the default sanitize...

EUVD-2026-125612

SurveyKing 1.13.0 through 1.13.2 contains a stored cross-site scripting vulnerability because the server accepts a respondent-supplied survey snapshot and the frontend renders its titles via innerHTML. Anonymous respondents can submit a forged snapshot embedding event handlers such as img onerror...

CVE-2026-129154

SurveyKing versions 1.13.0 through 1.13.2 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The issue arises because the server accepts a respondent-supplied survey snapshot , which the frontend subsequently renders using innerHTML . This allows anonymous respondents to submit ...