CVE-2021-3395

CVE-2021-3395 Suggested description A cross-site scripting XSS vulnerability in Pryaniki 6.44.3 allows remote authenticated users to upload an arbitrary file. The JavaScript code will execute when someone visits the attachment. Vulnerability Type Cross Site Scripting XSS Vendor of Product OOO...

CVE-2026-106142

Progress Software KendoReact versions 2.7.0 through 16.1.0 are vulnerable to a Cross-Site Scripting (XSS) flaw in the Editor component (@progress/kendo-react-editor). A low-privileged attacker capable of providing Editor content can execute arbitrary JavaScript in another user's browser by includ...

CVE-2024-50677

CVE-2024-50677 | Two-Click Reflected XSS in OroPlatform CMS v5.1 This repository presents a proof-of-concept of CVE-2024-50677 Disclaimer: This code is a proof of concept of the vulnerability. I will not be held responsible for any use of this exploit. Description: CVE-2024-50677 refers to a...

kibana-prototype-pollusion

CVE-2019-7609 Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing...

CVE-2025-57389

CVE-2025-57389 - Reflected XSS in OpenWRT 18.06.2 Description A reflected cross-site scripting XSS vulnerability was identified in EOL Luci OpenWRT v18.06.2 on /cgi-bin/luci/admin/system/packages endpoint. Proof of Concept 1. While proxying the traffic to Burp, navigate to...

CVE-2025-55579

CVE-2025-55579 - SolidInvoice Stored Cross-Site Scripting XSS in Tax Rates Summary SolidInvoice is vulnerable to a Stored Cross-Site Scripting XSS issue in the Tax Rates Feature. An authenticated attacker can inject arbitrary JavaScript into the application, which will then execute in users'...

CVE-2020-13965

CVE-2020-13965: Cross-Site Scripting via Malicious XML Attachment in Roundcube Webmail A Cross-Site scripting XSS vulnerability exists in Roundcube versions before 1.4.5 and 1.3.12. By leveraging the parsing of "text/xml" attachment, an attacker can bypass the Roundcube script filter and execute...

CVE-2025-28073

CVE-2025-28073 Suggested description phpList 3.6.3 is vulnerable to Reflected Cross-Site Scripting XSS via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which is improperly sanitized. Vulnerability Type Cross Site Scripting XSS Vend...

CVE-2025-46041

Anchor CMS v0.12.7 - Stored XSS CVE-2025-46041 Anchor CMS v0.12.7 is vulnerable to a Stored Cross-Site Scripting XSS vulnerability in the description field of the /admin/pages/add interface. CVE ID CVE-2025-46041 Summary Type: Stored XSS Location: Page creation interface /admin/pages/add Impact:...

CVE-2026-88986

Prior to version 2.15.0 , Kubeflow Pipelines is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw (CWE-79). The issue exists in the frontend routes /pipeline/k8s/pod and /pipeline/k8s/pod/events, where the frontend/server/k8s-helper.ts component includes untrusted podname and podnamespace...

CVE-2026-88060

A flaw was found in @angular/platform-server. Untrusted input in server-side rendered SSR templates, specifically within fallback raw-content elements like noscript or iframe, is not properly escaped. This allows a remote attacker to inject malicious code by crafting input that includes unescaped...

CVE-2026-123208

noname Electron desktop build v1.11.2 through v1.11.6.1 contains an unauthenticated local file server with wildcard CORS that allows malicious websites to read, overwrite, or delete installation files. Attackers can send cross-origin requests to /writeFile on localhost port 8089 to overwrite...

CVE-2026-123208

The noname Electron desktop build (versions v1.11.2 through v1.11.6.1 ) is vulnerable to a Missing Authentication flaw in its local file server. The server utilizes wildcard CORS , enabling malicious websites to perform cross-origin requests to the /writeFile endpoint on localhost port 8089 . Thi...

CVE-2026-123094

Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the servicelabel helper that marks unescaped OAuth service display names as htmlsafe. Authenticated attackers can connect an OAuth account with a crafted nickname, name or email and share it globally, executing...

CVE-2026-54144 OpenHuman: Embedded Google Meet webview can silently capture the macOS desktop without a user gesture

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0 on macOS, the runtime injected into a supported remote account webview such as Google Meet allows page JavaScript to call getDisplayMedia without a live user gesture. Instead of rejecting...

CVE-2026-54144

The OpenHuman desktop application and Rust library are vulnerable on macOS versions prior to 0.56.0 . The issue resides in the runtime injected into supported remote account webviews (e.g., Google Meet), where a shim fails to reject getDisplayMedia calls made without a live user gesture. Conseque...

CVE-2026-54144 OpenHuman: Embedded Google Meet webview can silently capture the macOS desktop without a user gesture

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0 on macOS, the runtime injected into a supported remote account webview such as Google Meet allows page JavaScript to call getDisplayMedia without a live user gesture. Instead of rejecting...

CVE-2023-39062

CVE-2023-39062 Spipu Html2Pdf alertdocument.domain HTTP/1.1 Host: example.afine.com Cookie: PHPSESSID=oiqo2oopiqt88teqgfb0a23vk0 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.15; rv:109.0 Gecko/20100101 Firefox/113.0 Accept-Language: pl,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate...

EUVD-2026-117539

Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the servicelabel helper that marks unescaped OAuth service display names as htmlsafe. Authenticated attackers can connect an OAuth account with a crafted nickname, name or email and share it globally, executing...

EUVD-2026-117157

VitaFit cloud API before 2026-10-30 contained a stored cross-site scripting vulnerability that allows authenticated attackers to upload an SVG image containing malicious JavaScript to the shared storage bucket. Attackers can exploit the application's failure to restrict scripts or force downloads...