CVE-2023-34836

CVE-2023-34836 — eScan Management Console 14.0.1400.2281: Cross-Site Scripting XSS Reflejado Resumen ID CVE: CVE-2023-34836 Tipo de Vulnerabilidad: Cross-Site Scripting XSS Reflejado Producto Afectado: Microworld Technologies eScan Management Console Versión Afectada: 14.0.1400.2281 Severidad:...

CVE-2026-93454

Aureus ERP through 1.6.0 contains a stored XSS in the Accounting plugin's Payment Term note field. The field is stored unsanitized and rendered as raw HTML, allowing any authenticated user with payment-term create permission to inject arbitrary JavaScript via the payment-terms endpoint. The paylo...

CVE-2024-46878-TikiCMS-XSS

CVE-2024-46878 - Tiki CMS 反射型跨站脚本（XSS）漏洞 Tiki CMS - 'page' 参数反射型跨站脚本（XSS）漏洞 免责声明 仅用于教育、研究和防御目的 。未经许可对系统进行未授权使用是违法的。 摘要 在 Tiki 版本 26.3 及更早版本的 tiki-editpage.php 中的 page 参数存在反射型跨站脚本（XSS）漏洞。攻击者可通过构造的载荷执行任意 JavaScript 代码，可能导致敏感信息泄露或未授权操作。 受影响的产品 产品：Tiki CMS Groupware 版本：26.3 及更早版本 组件：tiki-editpage.php...

CVE-2026-54355

MapServer (a web-based GIS application system) is affected by a reflected XSS in its OpenLayers HTML output. Versions from 6.0 through 8.6.3 reflect an attacker-controlled X-Forwarded-Host header value without escaping it for a single-quoted JavaScript string when handling SERVICE=WMS&REQUEST=Get...

CVE-2026-54355 MapServer: Reflected XSS in OpenLayers HTML Output via `HTTP_X_FORWARDED_HOST`

MapServer is a system for developing web-based GIS applications. From 6.0 until 8.6.4, MapServer's OpenLayers HTML output for SERVICE=WMS&REQUEST=GetMap&FORMAT=application/openlayers reflects an attacker-controlled X-Forwarded-Host value received as HTTPXFORWARDEDHOST through msBuildOnlineResourc...

EUVD-2026-82424

FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2319, the ActivityAMP AMP message renderer in app/src/main/java/eu/faircode/email/ActivityAMP.java enables JavaScript in its WebView but incompletely sanitizes untrusted message HTML. For non-allowliste...

CVE-2026-54521 FairEmail: Cross-site scripting (XSS) in AMP message rendering (ActivityAMP)

FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2319, the ActivityAMP AMP message renderer in app/src/main/java/eu/faircode/email/ActivityAMP.java enables JavaScript in its WebView but incompletely sanitizes untrusted message HTML. For non-allowliste...

CVE-2025-69606-GSVoIP-XSS

CVE-2025-69606 — GSVoIP Web面板中的反射型XSS 严重性: 中等 | CWE: CWE-79 | 需要认证: 否 | 攻击向量: 远程 摘要 在GSVoIP Web面板 v2.0.90 中发现了一个反射型跨站脚本XSS漏洞。错误端点的msg参数在将用户控制的输入反射到HTML响应之前未进行清理，允许在受害者浏览器中执行任意JavaScript。 受影响产品 字段| 详情 ---|--- 产品| GSVoIP Web面板 版本| 2.0.90（可能更早版本） 供应商| Solutions VoIP GS Solutions CWE| CWE-79 — 跨站脚本...

FuguHub-8.1-Reflected-SVG-XSS-CVE-2025-65790

CVE-2025-65790 - FuguHub 8.1 反射型 SVG XSS FuguHub 中通过 SVG 渲染实现的反射型跨站脚本（XSS） https://vulners.com/cve/CVE-2025-65790 本仓库记录了一个 FuguHub 8.1 中的反射型跨站脚本（XSS）漏洞，当通过内部文件管理器 /fs/ 界面查看包含内联 JavaScript 的 SVG 文件时，其中的脚本会被执行。 CVE 编号： CVE-2025-65790 发现者： Han Tek Foo 严重性： 高 影响： 任意 JavaScript 执行 简介 FuguHub 是由 Real...

CVE-2026-86788

The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlist, allowing users with contributor-level access and above to store a crafted tag name that executes arbitra...

EUVD-2026-81342

The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlist, allowing users with contributor-level access and above to store a crafted tag name that executes arbitra...

CVE-2026-26211

-orange?style=for-the-badge&logo=owasp CVE-2026-26211: Stored XSS in Ekushey Project Manager CRM Product: Ekushey Project Manager CRM Version: 5.0 Vulnerability: Stored Cross-Site Scripting XSS CWE: CWE-79 Researcher: LINDAN TRI SAPUTRA Initial Report: August 1, 2026 Summary A stored Cross-Site...

CVE-2025-61454

🛡️ CVE Disclosure: CVE-2025-61454 — Reflected XSS in E-commerce Project Disclosure Date: 14 October 2025 CVE ID: CVE-2025-61454 Severity: MEDIUM CVSS 6.1 🧩 Summary A reflected Cross-Site Scripting XSS vulnerability exists in the E-commerce Project v1.0, specifically within the search.php endpoint...

CVE-2026-25940

PoC de CVE-2026-25940 para jsPDF Una prueba de concepto para CVE-2026-25940 que demuestra cómo apariencias de botones de radio AcroForm especialmente diseñadas pueden desencadenar JavaScript incrustado en visores de PDF vulnerables p. ej., Foxit. El repositorio incluye un generador basado en Node...

CVE-2026-25916-Roundcube-Webmail-DOM-based-XSS-Exploit-via-SVG-href-Attribute

CVE-2026-25916: Explotación de XSS DOM en Roundcube Webmail 📋 Información del Exploit Título del Exploit: XSS DOM en Roundcube Webmail mediante href SVG CVE-2026-25916 Autor: Mohammed Idrees Banyamer Contacto: GitHub @mbanyamer | Instagram @banyamersecurity País: Jordania Fecha: 9 de febrero de...

CVE-2026-27574-OneUptime-RCE

CVE-2026-27574-OneUptime-RCE Overview Proof-of-Concept exploit for CVE-2026-27574 – a critical code injection vulnerability CWE-94 in OneUptime 10.0.0 allowing arbitrary JavaScript execution in the probe context, leading to full and leakage of sensitive environment variables...

CVE-2026-30082

IngEstate Server 软件包列表页面编辑功能中的存储型跨站脚本（XSS）漏洞 受影响版本：IngEstate Server - 11.14.0 受影响功能 受影响 API：PUT /emgui/rest/appDatasheet//?full=true HTTP/1.1 PoC 要利用此存储型跨站脚本（XSS）漏洞，已认证用户必须首先通过仪表盘访问软件包列表页面。编辑功能与 API 端点 /emgui/rest/appDatasheet/ 交互。攻击者随后可将 XSS 载荷注入“关于应用程序”、“新增内容”或“发布说明”参数中。一旦注入成功，恶意 JavaScript...

CVE-2025-61319

CVE-2025-61319：ReNgine 2. 扫描完成后，打开 ReNgine 中的“漏洞”选项卡并查看结果。 3. 该载荷会在管理员的浏览器上下文中执行。 受影响版本 ReNgine = 2.2.0 修复建议 在渲染扫描结果之前，对用户提供的输入进行净化和转义。 在“漏洞”选项卡中，对用户可控的输出实施正确的 HTML 编码。 参考 ReNgine 官方仓库...

CVE-2026-30048

CVE-2026-30048 - Cross-Site Scripting XSS Almacenado en NotChatbot WebChat = 1.5.0 Resumen Existe una vulnerabilidad de Cross-Site Scripting XSS almacenado en el paquete @developer.notchatbot/webchat en versiones hasta la 1.5.0 inclusive. La entrada proporcionada por el usuario no se sanitiza...

CVE-2026-29598

CVE-2026-29598: Cross-Site Scripting XSS Almacenado en cm3 Acora CMS versión 10.7.1. DDSN Interactive cm3 Acora CMS versión 10.7.1 contiene una vulnerabilidad de Cross-Site Scripting XSS Almacenado en la funcionalidad de gestión de usuarios. Un administrador con la capacidad de añadir o editar...