9096 matches found
CVE-2026-85593 phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode
phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks that calls htmlentitydecode on sanitized FAQ content, reversing entity-encoding protection. Authenticated users with FAQ editing privileges can inject JavaScript payloads that...
CVE-2026-85541
DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary JavaScript codes in user's browser via a malicious website...
EUVD-2026-70983
DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary JavaScript codes in user's browser via a malicious website...
CVE-2026-85541 Interinfo｜DreamMaker - Reflected Cross-site Scripting
DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary JavaScript codes in user's browser via a malicious website...
CVE-2026-85541 Interinfo｜DreamMaker - Reflected Cross-site Scripting
DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary JavaScript codes in user's browser via a malicious website...
CVE-2026-85541
DreamMaker developed by Interinfo contains a Reflected Cross-site Scripting (XSS) vulnerability. Authenticated remote attackers can execute arbitrary JavaScript in a victim's browser via a malicious website. The CVSS 3.1 base score is 5.4 (MEDIUM) with a changed scope, requiring low privileges an...
Malicious code in cors-security (npm)
Source: amazon-inspector b1cff2c95bb175e36d5cb7a6e4880ed0f8816cbfb1dc7acef5d8173cf2cc40bb The CommonJS entry point of [email protected] exposes a getPlugin API that issues an HTTPS GET to the hardcoded host workconfig.vercel.app and passes the response body directly to new Function'require',...
Linux Distros Unpatched Vulnerability : CVE-2026-76178
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A stored Cross-Site Scripting XSS vulnerability in the notification template functionality of the endpoint /ocsreports/?function=notification. A user with...
CVE-2026-85599: Improper Neutralization of Input During Web Page Generation
Grav Shortcode Core before 6.2.5 contains stored cross-site scripting vulnerabilities in the lorem tag parameter and details summary parameter that are written to rendered pages without escaping. Attackers with page-edit access can inject arbitrary HTML and JavaScript that executes in the browser...
PT-2026-85597
EMX Tecnologia Gestao X version = 8.4 contains a Stored Cross-Site Scripting XSS vulnerability in the Help Chat functionality. Improper neutralization of user-controlled input during web page generation allows authenticated attackers to execute arbitrary JavaScript in the context of other...
PT-2026-85454
DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary JavaScript codes in user's browser via a malicious website...
Material for MkDocs: DOM XSS in search suggestions via query parameter
Impact Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature. A crafted q URL parameter could execute JavaScript in the documentation site's origin after user interaction. Patches The issue is fixed in Material for...
EUVD-2026-57321
Material for MkDocs: DOM XSS in search suggestions via query parameter...
GHSA-XVG9-69GF-FJRF Material for MkDocs: DOM XSS in search suggestions via query parameter
Impact Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature. A crafted q URL parameter could execute JavaScript in the documentation site's origin after user interaction. Patches The issue is fixed in Material for...
EUVD-2026-70393
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comment with zero escaping. Attackers can close the comment with -- and inject arbitrary JavaScript that executes when victims visit the crafte...
CVE-2026-76178 Multiple vulnerabilities in Ocsreports for OCS Inventory NG
A stored Cross-Site Scripting XSS vulnerability in the notification template functionality of the endpoint /ocsreports/?function=notification. A user with administrator privileges can input malicious HTML content which is subsequently stored and displayed without proper sanitisation when other...
CVE-2026-76178
Ocsreports for OCS Inventory NG is affected by a stored XSS vulnerability in the notification template functionality at /ocsreports/?function=notification. An administrator can inject malicious HTML that is stored and later rendered without proper sanitisation when other administrators view the t...
PT-2026-84980
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A stored Cross-Site Scripting XSS issue exists in the notification template functionality. An administrator can input malicious HTML content via the endpoint...
Prototype Pollution
Overview @tiptap/core is a headless rich text editor Affected versions of this package are vulnerable to Prototype Pollution via the mergeAttributes function. An attacker can inject malicious prototype properties by supplying crafted objects with a proto key, which can result in inherited...