Appium base-driver <=10.6.0 - Reflected Cross-Site Scripting

Appium = 10.7.0 contains a reflected XSS caused by unescaped reflection of throwError query parameter, comments POST field, and User-Agent header in base-driver routes, letting remote attackers execute arbitrary JavaScript, exploit requires crafted HTTP requests. id: CVE-2026-58191 info: name:...

WordPress Tag Groups < 2.2.0 - Reflected Cross-Site Scripting

The Tag Groups WordPress plugin 2.2.0 contains a stored XSS caused by improper escaping of an AJAX parameter reflected in an HTML response, letting unauthenticated attackers execute arbitrary JavaScript in browsers of logged-in users with editpages capability, exploit requires victim interaction...

CVE-2021-37833

CVE 2021-37833 Hotel Druid 3.0.2 Reflected Cross Site Scripting Vulnerability A reflected Cross Site Scripting vulnerability exists in multiple pages in version 3.0.2 of the Hotel Druid application that allows for arbitrary execution of JavaScript commands. https://vulners.com/cve/CVE-2021-37833...

CVE-2026-48398

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-110074

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-107682

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-63169 Omnispace Agora Project < 26.10.0 Stored XSS via Messenger Iframe

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to post messages containing attacker-controlled iframes through the messenger's HTMLPurifier SafeIframe branch. Attackers can craft a message with a malicious iframe that is...

CVE-2026-63169

Omnispace Agora Project versions prior to 26.10.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The flaw exists in the messenger's HTMLPurifier SafeIframe branch, which fails to properly neutralize input, allowing authenticated users to post messages containing attacker-con...

CVE-2026-48398

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of a victim's browser. Successful exploitation requires user interacti...

CVE-2026-110082

Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability (CWE-79). A low-privileged attacker can execute malicious JavaScript within a victim's browser by tricking them into visiting a URL referencing a vulnerable page. The vulnerability has a MEDIUM base sever...

CVE-2026-110080 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-110078

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of a victim's browser. Successful exploitation requires user interacti...

CVE-2026-110076

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can exploit this issue by manipulating the DOM environment to execute malicious JavaScript within a victim's browser. Successful exploitation requires user interaction , specifically...

CVE-2026-110074

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of a victim's browser. Successful exploitation requires user interacti...

EUVD-2026-100539

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-106628

Adobe Experience Manager is impacted by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79 ). An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of a victim's browser. Successful exploitation requires user interact...

CVE-2023-43770-PoC

CVE-2023-43770-PoC PoC for Stored XSS CVE-2023-43770 Vulnerability Description Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcubestringreplacer.php behavior. Attack Chain Crafted...

CVE-2025-28073

CVE-2025-28073 Suggested description phpList 3.6.3 is vulnerable to Reflected Cross-Site Scripting XSS via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which is improperly sanitized. Vulnerability Type Cross Site Scripting XSS Vend...

CVE-2026-9811

CVE-2026-9811 CVE-2026-9811 is a Stored Cross-Site Scripting Stored XSS vulnerability affecting Mautic 7 versions 7.0.0 through 7.1.1.The vulnerability exists in the Project Selector component, where project names returned via an AJAX request are inserted into the page without proper output...

CVE-2026-63357

Affected devices do not properly sanitize calculated signal data contained in imported calculated signal files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially craft...