CVE-2026-56126 pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /statusmonitoring.php. Multiple POST parameters including graph-left, graph-right, time-period, resolution, start-date...

CVE-2026-56126

pfSense Plus before 26.07 and CE before 2.9.0 contain a stored cross-site scripting (XSS) vulnerability in /status_monitoring.php . Authenticated users holding the Status: Monitoring privilege can inject arbitrary JavaScript by supplying unsanitized values in multiple POST parameters (e.g., graph...

EUVD-2026-70495

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /statusmonitoring.php. Multiple POST parameters including graph-left, graph-right, time-period, resolution, start-date...

CVE-2026-85158

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comment with zero escaping. Attackers can close the comment with -- and inject arbitrary JavaScript that executes when victims visit the crafte...

CVE-2026-85158 AVideo Reflected XSS via videoEmbeded.php link parameter

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comment with zero escaping. Attackers can close the comment with -- and inject arbitrary JavaScript that executes when victims visit the crafte...

CVE-2026-56126: Improper Neutralization of Input During Web Page Generation

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /statusmonitoring.php. Multiple POST parameters including graph-left, graph-right, time-period, resolution, start-date...

PodcastGenerator 3.2.9 Cross Site Scripting

PodcastGenerator version 3.2.9 contains a persistent cross site scripting vulnerability in the Live Items functionality. Exploit Title: PodcastGenerator 3.2.9 - Stored XSS Date: 2026-08-08 Exploit Author: Sahil Arya Vendor Homepage: https://github.com/PodcastGenerator/PodcastGenerator Software...

PT-2026-85051

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /status monitoring.php. Multiple POST parameters including graph-left, graph-right, time-period, resolution, start-dat...

CVE-2026-84793 Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name

Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages...

PT-2026-84666

Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages...

PodcastGenerator 3.2.9 - Stored XSS

Exploit Title: PodcastGenerator 3.2.9 - Stored XSS Date: 2026-08-08 Exploit Author: Sahil Arya Vendor Homepage: https://github.com/PodcastGenerator/PodcastGenerator Software Link: https://github.com/PodcastGenerator/PodcastGenerator Version: 3.2.9 Tested on: Windows 11 / XAMPP CVE : CVE-2025-7033...

CVE-2026-84192

LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript through SNMP interface descriptions or syslog...

CVE-2026-84191 LibreNMS before 26.5.0 Stored XSS via SNMP VRF fields

LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescription, vrfname, and mplsVpnVrfRouteDistinguisher fields from SNMP polling are rendered without sanitization. Attackers controlling a monitored network device can inject arbitrary...

CVE-2026-84191

LibreNMS versions prior to 26.5.0 contain stored cross-site scripting (XSS) vulnerabilities in VRF display pages. The root cause is that SNMP-polled fields—mplsVpnVrfDescription , vrf_name , and mplsVpnVrfRouteDistinguisher —are rendered without sanitization. An attacker controlling a monitored n...

CVE-2026-84191 LibreNMS before 26.5.0 Stored XSS via SNMP VRF fields

LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescription, vrfname, and mplsVpnVrfRouteDistinguisher fields from SNMP polling are rendered without sanitization. Attackers controlling a monitored network device can inject arbitrary...

CVE-2026-78047

A stored cross-site scripting XSS vulnerability in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to inject arbitrary HTML/JavaScript into these fields, which then executes in the browser session of any other user...

CVE-2026-38725: Improper Neutralization of Input During Web Page Generation

xipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject arbitrary JavaScript via the name and content parameters in ajax.php. The input is stored in the database without HTML sanitization and rendered in Smarty templates without output escaping, resulting...

CVE-2026-78047 Dimension Stored XSS in Scheduled Report Task

A stored cross-site scripting XSS vulnerability in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to inject arbitrary HTML/JavaScript into these fields, which then executes in the browser session of any other user...

CVE-2026-78047

CVE-2026-78047 is a stored cross-site scripting (XSS) vulnerability in WatchGuard Dimension's task scheduling feature (also referenced as "Scheduled Report Task" in the CNA record). A low-privileged authenticated administrator can inject arbitrary HTML or JavaScript into the scheduling fields, an...

CVE-2026-78047 Dimension Stored XSS in Scheduled Report Task

A stored cross-site scripting XSS vulnerability in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to inject arbitrary HTML/JavaScript into these fields, which then executes in the browser session of any other user...