CVE-2026-52774-YESWIKI-XSS

CVE-2026-52774-YESWIKI-XSS CVE-2026-52774 is a reflected XSS vulnerability in YesWiki's Bazar widget handler. The query parameter in the NoSuchPage/widget endpoint is inadequately sanitized using striptags, which does not escape double quotes. This allows an attacker to break out of HTML attribut...

CVE-2021-32644

CVE-2021-32644 This vulnerability is an XSS vulnerability that affected versions prior to Ampache 4.4.3. https://nvd.nist.gov/vuln/detail/CVE-2021-32644 Installation and Execution Steps 1. Install Ampache When installing, please configure port forwarding in the docker-compose.yml file. The...

CVE-2024-4439

CVE-2024-4439 CVE-2024-4439 docker and poc Lab Setup After starting the Docker container, some additional configuration is needed. Visit 127.0.0.1:8080, complete the configuration, In the backend – Appearance – Themes, select a theme, customize it, and configure. Go to Design – Templates – Single...

CVE-2023-54423

OpenMage magento-lts versions before 20.2.0 are vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is that the TinyMCE WYSIWYG editor fails to adequately filter scripts within specially crafted HTML tags. An attacker can inject an element containing a malicious onmouseover at...

EUVD-2023-60729

OpenMage magento-lts before 20.2.0 contains a stored cross-site scripting vulnerability because the TinyMCE WYSIWYG editor fails to filter scripts in specially crafted HTML tags. Attackers can inject an img element with a malicious onmouseover attribute to execute scripts in the browsers of users...

CVE-2023-54423 OpenMage magento-lts before 20.2.0 Stored XSS via TinyMCE WYSIWYG Editor

OpenMage magento-lts before 20.2.0 contains a stored cross-site scripting vulnerability because the TinyMCE WYSIWYG editor fails to filter scripts in specially crafted HTML tags. Attackers can inject an img element with a malicious onmouseover attribute to execute scripts in the browsers of users...

Exploit for CVE-2026-78071

Stored XSS via Location Title in DPCalendar Free DPCalendar...

Exploit for CVE-2024-4041

CVE-2024-4041 Yoast SEO /?page=%22%20onmouseover%3D%...

EUVD-2005-2139

Malware in sbrugna...

CVE-2025-56515

File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG file content, allowing malicious SVG files with embedded foreignObject elements containing iframe tags and JavaScript event handlers onmouseover to be uploaded...

CVE-2005-2138

Cross-site scripting XSS vulnerability in index.php in Comdev eCommerce 3.0 and 3.1 allows remote attackers to inject arbitrary web script or HTML via Javascript in the onMouseOver event of an "A" tag in a review message...

CVE-2025-30342: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in OpenSlides before 4.2.5. When submitting descriptions such as Moderator Notes or Agenda Topics, an editor is shown that allows one to format the submitted text. This allows insertion of various HTML elements. When trying to insert a SCRIPT element, it is properly...

Cross-Site Scripting (XSS)

silverstripe/admin is vulnerable to Cross-Site Scripting XSS . The vulnerability is due to inadequate input validation, allowing an attacker to embed malicious JavaScript through onmouseover or onmouseout attributes in the WYSIWYG editor...

PT-2024-40151

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: The issue allows a bad actor with access to the CMS to embed malicious javascript using onmouseover or onmouseout attributes in the WYSIWYG editor. Recommendations: At the moment, there...

CVE-2023-31506: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in Grav versions 1.7.44 and before, allows remote authenticated attackers to execute arbitrary web scripts or HTML via the onmouseover attribute of an ISINDEX element...

PT-2024-12285 · Grav · Grav

Name of the Vulnerable Software and Affected Versions: Grav versions 1.7.44 and before Description: A cross-site scripting XSS vulnerability allows remote authenticated attackers to execute arbitrary web scripts or HTML via the onmouseover attribute of an ISINDEX element. Recommendations: For Gra...

Grav Cross-Site Scripting Vulnerability

Grav is an extensible CMS Content Management System for personal blogs, small content publishing platforms, and one-page product displays. A cross-site scripting vulnerability exists in Grav 1.7.44 and earlier versions that could allow an authenticated, remote attacker to execute arbitrary web...

PT-2023-33004 · Tinymce +1 · Tinymce +1

Name of the Vulnerable Software and Affected Versions: TinyMCE versions prior to 20.2.0 OpenMage magento-lts versions prior to 20.2.0 Description: The TinyMCE WYSIWYG editor fails to filter scripts when rendering HTML in specially crafted HTML tags, allowing for potential exploitation. This issue...

CVE-2023-23637

IMPatienT before 1.5.2 allows stored XSS via onmouseover in certain text fields within a PATCH /modifyonto request to the ontology builder. This may allow attackers to steal Protected Health Information...

CVE-2023-23637: Improper Neutralization of Input During Web Page Generation

IMPatienT before 1.5.2 allows stored XSS via onmouseover in certain text fields within a PATCH /modifyonto request to the ontology builder. This may allow attackers to steal Protected Health Information...