CVE-2026-52773

YesWiki is a wiki system written in PHP. From version 4.1.0 to before version 4.6.6, YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coerces malformed DATETIME strings, an attacker can append HTML ...

CVE-2026-52774 Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes in YesWiki

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using striptags only. Because striptags does not escape double quotes, an attacker can break out of the attribute value, inject an event handler such ...

CVE-2026-52773 Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php` in YesWiki

YesWiki is a wiki system written in PHP. From version 4.1.0 to before version 4.6.6, YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coerces malformed DATETIME strings, an attacker can append HTML ...

EUVD-2026-71805

YesWiki is a wiki system written in PHP. From version 4.1.0 to before version 4.6.6, YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coerces malformed DATETIME strings, an attacker can append HTML ...

CVE-2026-52773 Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php` in YesWiki

YesWiki is a wiki system written in PHP. From version 4.1.0 to before version 4.6.6, YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coerces malformed DATETIME strings, an attacker can append HTML ...

CVE-2026-85593 phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode

phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks that calls htmlentitydecode on sanitized FAQ content, reversing entity-encoding protection. Authenticated users with FAQ editing privileges can inject JavaScript payloads that...

CVE-2026-85541

DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary JavaScript codes in user's browser via a malicious website...

EUVD-2026-70983

DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary JavaScript codes in user's browser via a malicious website...

CVE-2026-85541 Interinfo｜DreamMaker - Reflected Cross-site Scripting

DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary JavaScript codes in user's browser via a malicious website...

CVE-2026-85541 Interinfo｜DreamMaker - Reflected Cross-site Scripting

DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary JavaScript codes in user's browser via a malicious website...

CVE-2026-85541

DreamMaker developed by Interinfo contains a Reflected Cross-site Scripting (XSS) vulnerability. Authenticated remote attackers can execute arbitrary JavaScript in a victim's browser via a malicious website. The CVSS 3.1 base score is 5.4 (MEDIUM) with a changed scope, requiring low privileges an...

Linux Distros Unpatched Vulnerability : CVE-2026-76178

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A stored Cross-Site Scripting XSS vulnerability in the notification template functionality of the endpoint /ocsreports/?function=notification. A user with...

PT-2026-85597

EMX Tecnologia Gestao X version = 8.4 contains a Stored Cross-Site Scripting XSS vulnerability in the Help Chat functionality. Improper neutralization of user-controlled input during web page generation allows authenticated attackers to execute arbitrary JavaScript in the context of other...

CVE-2026-85599: Improper Neutralization of Input During Web Page Generation

Grav Shortcode Core before 6.2.5 contains stored cross-site scripting vulnerabilities in the lorem tag parameter and details summary parameter that are written to rendered pages without escaping. Attackers with page-edit access can inject arbitrary HTML and JavaScript that executes in the browser...

PT-2026-85454

DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary JavaScript codes in user's browser via a malicious website...

Material for MkDocs: DOM XSS in search suggestions via query parameter

Impact Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature. A crafted q URL parameter could execute JavaScript in the documentation site's origin after user interaction. Patches The issue is fixed in Material for...

EUVD-2026-57321

Material for MkDocs: DOM XSS in search suggestions via query parameter...

GHSA-XVG9-69GF-FJRF Material for MkDocs: DOM XSS in search suggestions via query parameter

Impact Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature. A crafted q URL parameter could execute JavaScript in the documentation site's origin after user interaction. Patches The issue is fixed in Material for...

EUVD-2026-70393

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comment with zero escaping. Attackers can close the comment with -- and inject arbitrary JavaScript that executes when victims visit the crafte...

CVE-2026-76178 Multiple vulnerabilities in Ocsreports for OCS Inventory NG

A stored Cross-Site Scripting XSS vulnerability in the notification template functionality of the endpoint /ocsreports/?function=notification. A user with administrator privileges can input malicious HTML content which is subsequently stored and displayed without proper sanitisation when other...