CVE-2014-125132: Improper Neutralization of Input During Web Page Generation

Blogroll Fun plugin for WordPress before 0.8.5 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the 'k' parameter in blogroll.php. Attackers can craft GET requests to /wp-content/plugins/blogroll-fun/blogroll.php with maliciou...

Jason Newman Blogroll Fun Cross-site Scripting Vulnerability

Versions prior to 0.8.5 of Jason Newman’s Blogroll Fun contain a cross-site scripting vulnerability. This flaw arises because the ‘k’ parameter in blogroll.php is echoed without sanitization, potentially enabling reflected XSS attacks. Unauthenticated attackers can exploit this to inject scripts...

EUVD-2025-211115

The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts. Successful exploitation allows a remote attacker to execute arbitrary JavaScript in the context of a victim's browser, leading to actio...

cypht-org cypht Cross-Site Scripting Vulnerabilities

The cypht-org project has cross-site scripting vulnerabilities in versions from 2.0.0 to 2.12.2. These vulnerabilities arise when ALLOWEXTERNALIMAGESOURCES is enabled. In this case, malicious alt texts or URL values in external image tags are decoded and used to construct image prompts through...

CVE-2026-112290

Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. When tree item truncation is enabled, attackers who influence a tree item label ca...

CVE-2026-112290 MI6 @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 DOM XSS via ic-tree-item

Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. When tree item truncation is enabled, attackers who influence a tree item label ca...

CVE-2026-112290 MI6 @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 DOM XSS via ic-tree-item

Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. When tree item truncation is enabled, attackers who influence a tree item label ca...

CVE-2026-112290 MI6 @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 DOM XSS via ic-tree-item

Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. When tree item truncation is enabled, attackers who influence a tree item label ca...

CVE-2026-112290

Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. When tree item truncation is enabled, attackers who influence a tree item label ca...

EUVD-2026-104283

Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. When tree item truncation is enabled, attackers who influence a tree item label ca...

CVE-2026-112290

The Intelligence Community UI Kit (@ukic/canary-web-components) versions 3.0.0-canary.12 before 3.0.0-canary.48 are vulnerable to a DOM-based cross-site scripting (XSS) vulnerability in the ic-tree-item component. The root cause is that the component re-parses router-item slot text as HTML. Speci...

CVE-2026-112184

MISP contains a reflected cross-site scripting XSS vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names...

CVE-2026-112184 MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels

MISP contains a reflected cross-site scripting XSS vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names...

CVE-2026-112184 MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels

MISP contains a reflected cross-site scripting XSS vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names...

CVE-2026-112184 MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels

MISP contains a reflected cross-site scripting XSS vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names...

EUVD-2026-104142

MISP contains a reflected cross-site scripting XSS vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names...

CVE-2026-112184

The MISP workflow module is vulnerable to reflected cross-site scripting (XSS) in versions prior to 2.5.48 . The root cause is the lack of output encoding when rendering parameter names from the misp-modules service as HTML form labels. An attacker capable of influencing these parameter names can...

Astra Linux – vulnerability in ruby-rack

Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, Rack::Directory generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename starts with the javascript: scheme e.g., javascript:alert1, th...

CVE-2026-112290: Improper Neutralization of Input During Web Page Generation

Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. When tree item truncation is enabled, attackers who influence a tree item label ca...

PT-2026-117475

Name of the Vulnerable Software and Affected Versions carbon console affected versions not specified Description The carbon console fails to sufficiently encode user-supplied XML input, which enables the injection of malicious scripts. A remote attacker can exploit this to execute arbitrary...