CVE-2026-22072

Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens...

CVE-2026-22072

CVE-2026-22072 involves arbitrary URL loading in WebView, where loading external URLs can permit malicious JavaScript to steal user tokens. The connected document confirms the issue arises from WebView behavior, enabling token leakage with a CVSS v4.0 base score of 8.3 (HIGH), attack vector Netwo...

CVE-2026-22072 Arbitrary URL Loading in WebView Leading to Token Leakage Risk

Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens...

PT-2026-76828

Pandora contains a stored cross-site scripting XSS vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the Submit to Lookyloo action. Although the value was subject to...

CVE-2026-14290

The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including...

CVE-2026-19716

CVE-2026-19716 affects maalfer Pentestify prior to 1.1.1 in the user management component. A stored XSS (CWE-79) vulnerability arises when the frontend escapes the username with escapeHTML() before inserting it into the onclick handler of the account deletion button; because HTML decodes attribut...

CVE-2026-19716 Stored Cross-site Scripting in Pentestify user account deletion via unescaped username

Stored Cross-site Scripting CWE-79 in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML...

PT-2026-71494

Stored Cross-site Scripting CWE-79 in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML...

PT-2026-71866

Worksuite SaaS versions prior to 6.0.14 contains a stored cross-site scripting vulnerability in the Asset Management module that allows authenticated administrators to inject arbitrary JavaScript by entering malicious payloads into the Location and Description fields when creating a new asset...

EUVD-2026-57447

Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browse...

CVE-2026-16694

IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

LibreNMS: Reflected XSS via Proxmox instance/vmid GET parameters injected into document.title JavaScript assignment

Summary LegacyController.php:75 writes the page title into a document.title JS assignment using string interpolation. apps/proxmox.inc.php pushes $vars'instance' and $vars'vmid' GET params, only striptags applied directly into $pagetitle. A single quote terminates the JS string, executing arbitra...

CVE-2026-57858

Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID without sanitization. Attackers can close th...

Security Bulletin:Vulnerability in Spring Framework affects IBM Netezza Appliance

Summary The Spring Framework package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVE CVE-2026-41845 Vulnerability Details CVEID:CVE-2026-41845 DESCRIPTION: Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape may lead to JavaScript code...

PT-2026-71154

IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

PT-2026-70861

An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed within the query scope of other users, through a specially crafted stored value processed during an internal maintenance cycle. This could...

EUVD-2026-55801

SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. Attackers who can modify dashboard text widget content can inject arbitrary HTML and JavaScript that...

CVE-2026-18478

Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image. The issue was fixed in version 6.3.10...

CVE-2026-14293

The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does not escape that value when it is later output on the checkout page, allowing unauthenticated attackers to store JavaScript that executes in the...

CVE-2026-15047 s2Member < 260805 - Contributor+ Stored XSS via Shortcode

The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post stored XSS...