CVE-2026-19716 Stored Cross-site Scripting in Pentestify user account deletion via unescaped username

Stored Cross-site Scripting CWE-79 in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML...

CVE-2026-19716

CVE-2026-19716 affects maalfer Pentestify prior to 1.1.1 in the user management component. A stored XSS (CWE-79) vulnerability arises when the frontend escapes the username with escapeHTML() before inserting it into the onclick handler of the account deletion button; because HTML decodes attribut...

CVE-2025-62318

CVE-2025-62318 affects HCL AION. The issue involves JavaScript responses that contain data being referenced by external pages, enabling potential JavaScript hijacking where an attacker-controlled page could capture sensitive information under certain conditions. The vulnerability is described wit...

EUVD-2025-210724

HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive information to be captured by an attacker-controlled page JavaScript hijacking under certain conditions...

CVE-2025-62318 HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive information to be captured by an attacker-controlled page JavaScript hijacking under certain conditions...

CVE-2025-62318 HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive information to be captured by an attacker-controlled page JavaScript hijacking under certain conditions...

CVE-2026-73617

Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering. Attackers can inject MongoDB operators through query parameters to bypass...

CVE-2026-73628

Serendipity versions = 2.3.5 and . In include/functionsrouting.inc.php serveSearch, the sanitisation pipeline runs urldecode after HTML-encoding, so a single URL-encoded HTML payload survives striptags and htmlspecialchars and is then decoded back into live HTML in the page. A crafted search link...

CVE-2026-73628

Serendipity versions = 2.3.5 and . In include/functionsrouting.inc.php serveSearch, the sanitisation pipeline runs urldecode after HTML-encoding, so a single URL-encoded HTML payload survives striptags and htmlspecialchars and is then decoded back into live HTML in the page. A crafted search link...

CVE-2026-73628 Serendipity 2.3.5 Reflected XSS via search clean-URL route

Serendipity versions = 2.3.5 and . In include/functionsrouting.inc.php serveSearch, the sanitisation pipeline runs urldecode after HTML-encoding, so a single URL-encoded HTML payload survives striptags and htmlspecialchars and is then decoded back into live HTML in the page. A crafted search link...

EUVD-2026-57821

Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering. Attackers can inject MongoDB operators through query parameters to bypass...

CVE-2026-73617

Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering. Attackers can inject MongoDB operators through query parameters to bypass...

CVE-2026-73617

Budibase before 3.40.0 has a NoSQL injection in the MongoDB datasource integration. User-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering, allowing injection of MongoDB operators through query parameters. Impact described includes bypas...

CVE-2026-73602

Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass. Attackers can craft a fake String object with a match function that bypasses path traversal checks to...

dompurify: DOMPurify: URI validation bypass leads to cross-site scripting

A flaw was found in DOMPurify. An attacker can bypass URI validation by providing a specially crafted predicate function via EXTRAELEMENTHANDLING.attributeCheck. This allows unsafe protocols, such as javascript:, to persist after sanitization, potentially leading to DOM-based cross-site scripting...

PT-2026-71494

Name of the Vulnerable Software and Affected Versions maalfer Pentestify versions prior to 1.1.1 Description A stored cross-site scripting issue exists in the user management component. An authenticated attacker can execute arbitrary JavaScript in the browser of another authenticated user by...

PT-2026-71866

Worksuite SaaS versions prior to 6.0.14 contains a stored cross-site scripting vulnerability in the Asset Management module that allows authenticated administrators to inject arbitrary JavaScript by entering malicious payloads into the Location and Description fields when creating a new asset...

PT-2026-71493

Name of the Vulnerable Software and Affected Versions HCL AION affected versions not specified Description A flaw exists where JavaScript responses containing data can be referenced by external pages. This may allow an attacker-controlled page to capture sensitive information through JavaScript...

CVE-2026-73428: Improper Neutralization of Input During Web Page Generation

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a with an empty data-trix-attachment="" value, causing...

CVE-2026-73649: Improper Control of Generation of Code

Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior to 2.1.7, the earlier fix for CVE-2026-44966 filtered constructor, proto, and prototype only in the set assignment handler in src/compile/set.ts, while property-read expressions in src/compile/references.ts...