CubeCart 6.7.4 - Cross-Site Scripting

Exploit Title: CubeCart 6.7.4 - Cross-Site Scripting Attribute Injection in gui.class.php Date: 2026-06-08 Exploit Author: Mikail Kocadağ MKLKCDG Vendor Homepage: https://www.cubecart.com/ Software Link: https://github.com/cubecart/v6 Vulnerable Version: 6.7.4 Fixed Version: 6.7.5 CVE:...

Google Chrome Microsoft Edge Confidential Data Compromise

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to gain access to confidential data and compromise data integrity...

Google Chrome Microsoft Edge Confidential Data Access

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers relates to reading data beyond the allowed buffer size. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data through a specially created HTML page...

Google Chrome Microsoft Edge DoS

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers relates to the use of memory after it is freed. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

Google Chrome Microsoft Edge DoS

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to type conversion errors. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

Exploit for CVE-2026-18741

CVE-2026-18741 - Stored XSS in Worksuite SaaS...

EUVD-2026-68154

The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfilteredhtml capability, allowing users with contributor-level access a...

OESA-2026-3576 thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: Site isolation issue in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird...

CVE-2026-14835: Improper Neutralization of Input During Web Page Generation

The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfilteredhtml capability, allowing users with contributor-level access a...

CVE-2026-55696

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/privatebin.js uses getAttachmentMimeType to accept attacker-controlled MIME types and uses getBlobUrl to create a same-origin blob before setting...

CVE-2026-55696 PrivateBin: Stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/privatebin.js uses getAttachmentMimeType to accept attacker-controlled MIME types and uses getBlobUrl to create a same-origin blob before setting...

CVE-2026-55566

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts without checking registered plugin...

CVE-2026-50980

Cross-Site Scripting XSS vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote attackers to execute arbitrary JavaScript and perform session hijacking via a crafted DNS TXT record...

EUVD-2026-66243

Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme CWE-939. A malicious application installed on the user's Android device may exploit the affected application's functionality through an Intent, potentially allowing arbitrary JavaScript to be...

EUVD-2026-42996

Snipe-IT vulnerable to stored XSS via inline-served attachment...

EUVD-2026-42992

Snipe-IT vulnerable to stored XSS via Markdown custom field...

Snipe-IT vulnerable to stored XSS via Markdown custom field

Impact CommonMark is configured with htmlinput = 'escape', which blocks raw HTML injection. However, javascript: URIs in Markdown hyperlinks are not sanitized. A user with assets.edit permission can inject a malicious link into any markdown-textarea custom field. Any user who opens the asset deta...

GHSA-R52F-R9V5-66XR Snipe-IT vulnerable to stored XSS via Markdown custom field

Impact CommonMark is configured with htmlinput = 'escape', which blocks raw HTML injection. However, javascript: URIs in Markdown hyperlinks are not sanitized. A user with assets.edit permission can inject a malicious link into any markdown-textarea custom field. Any user who opens the asset deta...

Yamcs has DOM XSS in Extension Routing

Attack type: Unauthenticated remote Impact: Execution of arbitrary JavaScript in a user’s browser. Affected components: extension.matcher.ts:12, extension.component.ts:40, app.component.ts:134. Yamcs is vulnerable to cross-site scripting in the /ext URL endpoint. By inputting specially crafted co...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the extension process. An attacker can execute arbitrary JavaScript code in a user's browser by enticing a user to visit a specially crafted URL. Details Cross-site scripting or XSS is a code vulnerability...