CVE-2026-3244 Concrete CMS below version 9.4.8 is vulnerable to Stored XSS in Search Results via Page Names

In Concrete CMS below version 9.4.8, A stored cross-site scripting XSS vulnerability exists in the search block where page names and content are rendered without proper HTML encoding in search results. This allows authenticated, rogue administrators to inject malicious JavaScript through page nam...

CVE-2021-47733

CMSimple 5.4 contains a cross-site scripting vulnerability that allows attackers to bypass input filtering by using HTML to Unicode encoding. Attackers can inject malicious scripts by encoding payloads like '-alert1// and execute arbitrary JavaScript when victims interact with delete buttons...

Qualys Web Application Cross-Site Scripting Vulnerability

Qualys Web Application is a web application from Qualys, Inc. A cross-site scripting vulnerability exists in Qualys Web Application versions prior to 10.24.0.0, which arises from a lack of HTML coding when presenting logging information to a user, allowing a user with login access to the...