CVE-2026-39107

CVE-2026-39107: Cross-Site Scripting XSS in Kimi AI v1.0 Description A Cross-Site Scripting XSS vulnerability exists in the Kimi AI v1.0 web interface's 'Preview' feature. The application fails to properly sanitize or encode HTML/JavaScript payloads generated by the AI model. When a user switches...

CVE-2026-63356

Affected devices are vulnerable to a Cross-Site Scripting (XSS) flaw because they fail to properly sanitize calculated signal names from imported CSV trace files . If these names are included in error messages on the Trace page, an attacker could socially engineer an authorized user with "Read di...

CVE-2026-63355

Affected devices are vulnerable to Cross-Site Scripting (XSS) because they do not properly sanitize signal names within imported CSV trace files before rendering them in selection menus on the Trace page. An attacker could social engineer an authorized user with "Read diagnostics" rights into imp...

CVE-2026-63353

Affected devices are vulnerable to Cross-site Scripting (XSS) because they fail to properly sanitize comment fields within imported trace files before rendering them on the Trace page. An attacker could use social engineering to trick an authorized user with "Read diagnostics" rights into importi...

CVE-2026-63352

Affected devices fail to properly sanitize calculated signal data from imported CSV trace files before rendering it on the Trace page . This vulnerability allows an attacker to perform a social engineering attack to trick an authorized user with "Read diagnostics" rights into importing a maliciou...

CVE-2026-63352

Affected devices do not properly sanitize calculated signal data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace...

CVE-2026-63351

Affected devices fail to properly validate and sanitize visual properties of calculated signals within imported CSV trace files before rendering them on the Trace page. This vulnerability allows an attacker to use social engineering to trick an authorized user with "Read diagnostics" rights into ...

CVE-2026-63351

Affected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before rendering them on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into...

CVE-2026-89269

The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing users with the Author role and above to store JavaScript that executes in the session of any user viewing the testimonials,...

CVE-2025-55579

CVE-2025-55579 - SolidInvoice Stored Cross-Site Scripting XSS in Tax Rates Summary SolidInvoice is vulnerable to a Stored Cross-Site Scripting XSS issue in the Tax Rates Feature. An authenticated attacker can inject arbitrary JavaScript into the application, which will then execute in users'...

CVE-2023-39062

CVE-2023-39062 Spipu Html2Pdf alertdocument.domain HTTP/1.1 Host: example.afine.com Cookie: PHPSESSID=oiqo2oopiqt88teqgfb0a23vk0 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.15; rv:109.0 Gecko/20100101 Firefox/113.0 Accept-Language: pl,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate...

CVE-2024-50677

CVE-2024-50677 | Two-Click Reflected XSS in OroPlatform CMS v5.1 This repository presents a proof-of-concept of CVE-2024-50677 Disclaimer: This code is a proof of concept of the vulnerability. I will not be held responsible for any use of this exploit. Description: CVE-2024-50677 refers to a...

CVE-2026-30251

ZenShare Suite - Vulnerability Disclosure This repository contains details regarding multiple Reflected Cross-Site Scripting XSS vulnerabilities discovered in the ZenShare Suite application. Vulnerability Overview The ZenShare Suite application is vulnerable to Reflected Cross-Site Scripting XSS...

ritecms

🛡️ CVE-2024-28623 – XSS Vulnerability in RiteCMS v3.0.0 🔍 Overview This repository documents a Cross-Site Scripting XSS vulnerability discovered in RiteCMS v3.0.0 , which I reported and was assigned the CVE ID CVE-2024-28623. 📄 Vulnerability Details CVE ID : CVE-2024-28623 Product : RiteCMS Versio...

EUVD-2026-98215

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browser sessions via a...

CVE-2025-46041

Anchor CMS v0.12.7 - Stored XSS CVE-2025-46041 Anchor CMS v0.12.7 is vulnerable to a Stored Cross-Site Scripting XSS vulnerability in the description field of the /admin/pages/add interface. CVE ID CVE-2025-46041 Summary Type: Stored XSS Location: Page creation interface /admin/pages/add Impact:...

PT-2026-113300

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

PT-2026-111380

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC Drive Controller CPU 1504D TF affected versions not specified Description Devices do not properly restrict executable content within imported trace files. An attacker could social engineer an authorized user with the "Read...

cve-2023-41564-research

CVE-2023-41564 Vulnerability Overview CVE-2023-415641 is a stored XSS vulnerability in the CMS Cockpit = v2.6.3. When a .shtml HTML file is uploaded during file upload, JavaScript is executed the moment the uploaded file is opened. 1: https://nvd.nist.gov/vuln/detail/CVE-2023-41564 Attack Executi...

CVE-2025-57389

CVE-2025-57389 - Reflected XSS in OpenWRT 18.06.2 Description A reflected cross-site scripting XSS vulnerability was identified in EOL Luci OpenWRT v18.06.2 on /cgi-bin/luci/admin/system/packages endpoint. Proof of Concept 1. While proxying the traffic to Burp, navigate to...