CVE-2026-4264 Reflected Cross-Site Scripting in BeeTienda eCommerce platform

Reflected Cross-Site Scripting XSS on the BeeTienda e-commerce platform, specifically in the latest demo version. The incident occurs due to a lack of proper sanitization of user input data in the 'search' parameter of the product list endpoint. When malicious payloads are transmitted via the...

EUVD-2026-95540

Reflected Cross-Site Scripting XSS on the BeeTienda e-commerce platform, specifically in the latest demo version. The incident occurs due to a lack of proper sanitization of user input data in the 'search' parameter of the product list endpoint. When malicious payloads are transmitted via the...

CVE-2026-4264

The BeeTienda eCommerce platform (specifically the latest demo version ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the lack of proper sanitization of user input in the 'search' parameter of the product list endpoint. Malicious payloads sent via this parameter are r...

MAL-012

MAL-012: Reflected Cross-Site Scripting in Admin Console leading to Remote Code Execution in Payara Server A reflected Cross Site Scripting XSS attack was found in the Payara Admin Console. By convincing an admin user to access the malicious URL and click the “Choose File” button, an attacker can...

CVE-2026-107889

A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript executio...

EUVD-2026-95478

A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript executio...

CVE-2026-107889

A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript executio...

CVE-2026-107889

A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript executio...

CVE-2023-34837

CVE-2023-34837 — eScan Management Console: Reflected Cross-Site Scripting XSS Overview CVE-2023-34837 is a Reflected Cross-Site Scripting XSS vulnerability discovered in the Microworld Technologies eScan Management Console version 14.0.1400.2281. The vulnerability exists in the GrpPath POST...

PT-2026-109314

Name of the Vulnerable Software and Affected Versions @tinacms/cli versions prior to 3.0.0 Description @tinacms/cli fails to properly escape or encode Git branch values read from VERCEL GIT COMMIT REF, GITHUB BRANCH, or HEAD. These raw values are incorporated into the API URL and interpolated int...

CVE-2025-7840

XSS Exploit for CVE-2025-7840 Author : Byte Reaper @ByteReaper0 Description Proof‑of‑concept exploit for CVE-2025-7840 , targeting a vulnerable web application endpoint that fails to sanitize user input on the Firstname parameter of a reservation form. By crafting a GET request to:...

CVE-2023-34836

CVE-2023-34836 — eScan Management Console 14.0.1400.2281: Reflected Cross-Site Scripting XSS Overview CVE ID: CVE-2023-34836 Vulnerability Type: Reflected Cross-Site Scripting XSS Affected Product: Microworld Technologies eScan Management Console Affected Version: 14.0.1400.2281 Severity: Medium...

CVE-2024-46878-TikiCMS-XSS

CVE-2024-46878 - Tiki CMS Reflected Cross-Site Scripting XSS Vulnerability Tiki CMS - 'page' Parameter Reflected Cross-Site Scripting XSS Vulnerability Disclaimer Intended only for educational, research, and defensive purposes. Unauthorized use against systems without permission is illegal. Summa...

CVE-2026-107796 Jivejdon through commit ee67a65e Reflected XSS via taggedThreadList.jsp tagID and count Parameters

Jivejdon from commit 5489372d through commit ee67a65e contains a reflected cross-site scripting vulnerability in application/query/taggedThreadList.jsp that allows unauthenticated attackers to inject script via unencoded tagID and count parameters. Attackers can craft a link with a script-closing...

CVE-2026-26211

-orange?style=for-the-badge&logo=owasp CVE-2026-26211: Stored XSS in Ekushey Project Manager CRM Product: Ekushey Project Manager CRM Version: 5.0 Vulnerability: Stored Cross-Site Scripting XSS CWE: CWE-79 Researcher: LINDAN TRI SAPUTRA Initial Report: August 1, 2026 Summary A stored Cross-Site...

CVE-2025-61454

🛡️ CVE Disclosure: CVE-2025-61454 — Reflected XSS in E-commerce Project Disclosure Date: 14 October 2025 CVE ID: CVE-2025-61454 Severity: MEDIUM CVSS 6.1 🧩 Summary A reflected Cross-Site Scripting XSS vulnerability exists in the E-commerce Project v1.0, specifically within the search.php endpoint...

CVE-2026-29598

CVE-2026-29598: Stored Cross-Site Scripting XSS in cm3 Acora CMS version 10.7.1. DDSN Interactive cm3 Acora CMS version 10.7.1 contains a Stored Cross-Site Scripting XSS vulnerability in the user management functionality. An administrator with the ability to add or edit user details can...

CVE-2026-25940

CVE-2026-25940 jsPDF PoC A proof-of-concept for CVE-2026-25940 demonstrating how specially crafted AcroForm radio button appearances can trigger embedded JavaScript in vulnerable PDF viewers e.g., Foxit. The repo includes a Node-based generator and a browser viewer harness to exercise different...

CVE-2026-27574-OneUptime-RCE

CVE-2026-27574-OneUptime-RCE Overview Proof-of-Concept exploit for CVE-2026-27574 – a critical code injection vulnerability CWE-94 in OneUptime BOpen Registration B -- CRegister New Accou...

CVE-2026-25916-Roundcube-Webmail-DOM-based-XSS-Exploit-via-SVG-href-Attribute

CVE-2026-25916: Roundcube Webmail DOM XSS Exploit 📋 Exploit Information Exploit Title: Roundcube Webmail DOM XSS via SVG href CVE-2026-25916 Author: Mohammed Idrees Banyamer Contact: GitHub @mbanyamer | Instagram @banyamersecurity Country: Jordan Date: February 9, 2026 CVE: CVE-2026-25916 Type:...