owasp-java-encoder

OWASP Java Encoder Project La codificación de salida contextual es una técnica de programación necesaria para detener el Cross-Site Scripting. Este proyecto es una clase de codificador de alto rendimiento para Java 1.8+, simple de usar, de integración directa y con poco lastre. Para obtener...

rtl_433

rtl433 rtl433 despite the name is a generic data receiver, mainly for the 433.92 MHz, 868 MHz SRD, 315 MHz, 345 MHz, and 915 MHz ISM bands. The official source code is in the https://github.com/merbanan/rtl433/ repository. See also a list of software that works with rtl433 in the wiki. For more...

CVE-2026-9811

CVE-2026-9811 CVE-2026-9811 es una vulnerabilidad de Cross-Site Scripting Almacenado Stored XSS que afecta a Mautic 7 versiones 7.0.0 a 7.1.1. La vulnerabilidad existe en el componente Project Selector, donde los nombres de proyecto devueltos a través de una solicitud AJAX se insertan en la págin...

YesWiki Archived Revision - Cross-Site Scripting

YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coerces malformed DATETIME strings, an attacker can append an XSS payload after a valid revision timestamp. id: CVE-2026-52773 info: name: YesWiki...

SuperWebMailer 9.00.0.01710 - Cross-Site Scripting

An issue was discovered in SuperWebMailer 9.00.0.01710 allowing XSS via crafted incorrect passwords. id: CVE-2023-38192 info: name: SuperWebMailer 9.00.0.01710 - Cross-Site Scripting author: ritikchaddha severity: medium description: | An issue was discovered in SuperWebMailer 9.00.0.01710 allowi...

EyouCms v1.6.2 - Cross-Site Scripting

EyouCms v1.6.2 was discovered to contain a reflected cross-site scripting XSS vulnerability via the component /admin/twitter.php?activet. id: CVE-2023-41597 info: name: EyouCms v1.6.2 - Cross-Site Scripting author: ritikchaddha severity: medium description: | EyouCms v1.6.2 was discovered to...

SuperWebMailer - Cross-Site Scripting

An issue was discovered in SuperWebMailer 9.00.0.01710 that allows keepalive.php XSS via a GET parameter. id: CVE-2023-38194 info: name: SuperWebMailer - Cross-Site Scripting author: ritikchaddha severity: medium description: | An issue was discovered in SuperWebMailer 9.00.0.01710 that allows...

WSO2-2021-1261

WSO2-2021-1261: Múltiples Cross-Site Scripting en WSO2 ESB Debido a una codificación de salida inadecuada, se han identificado múltiples ataques de Cross Site Scripting XSS en WSO2 ESB. Divulgación del proveedor: La divulgación del proveedor y la corrección para esta vulnerabilidad se pueden...

cve-2025-31651

CVE-2025-36701 — Apache Tomcat - Bypass de reglas de reescritura Descubridor: gregk4sec https://github.com/gregk4sec/cve Fecha de descubrimiento: 2025-02-28 Proveedor afectado: Apache Producto afectado: Tomcat 9.0.x / 10.1.x / 11.0.x Gravedad: Crítica / Alta CWE: CWE-116 Estado: En revisión /...

CVE-2026-37272

CVE-2026-37272 CVE-2026-37272 Descripción Existe una vulnerabilidad de cross-site scripting XSS reflejado en /dashboard/settings.php en Bank Management System in Web 1.0. La vulnerabilidad se produce debido a una sanitización incorrecta de la entrada proporcionada por el usuario en el parámetro G...

CVE-2026-87550

Improper encoding or escaping of output in CSS in Google Chrome prior...

CVE-2025-65300

CVE-2025-65300 Descripción CVE-2025-65300: Vulnerabilidad de Cross-Site Scripting XSS almacenado en la plataforma SaaS de Coohom Fecha de divulgación: 2025-10-28 Última actualización: 2025-10-28 Reportero: Phisit Pupiw Proveedor: Coohom CWE: CWE-79 – Cross-Site Scripting Resumen Se identificó una...

CVE-2025-63588

CVE-2025-63588 Cross-Site Scripting XSS Reflejado en el manejo de la ruta cmsimplexh de CMSimpleXH CVSS v3.1 Estimado: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N → 6.1 Medio CVE Asignado: CVE-2025-63588 Productos: CMSimpleXH - 1.8 Vendor: CMSimpleXH - https://www.cmsimple-xh.org/ Resumen Existe una...

EUVD-2026-72538

Improper Encoding or Escaping of Output vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header. BearerPlug and RequireScopePlug built the Bearer resourcemetadata="..."...

CVE-2026-37196

CVE-2026-37196 – Cross-Site Scripting XSS Almacenado en nirix traq v3.9.0 Descripción general Existe una vulnerabilidad de Cross-Site Scripting XSS Almacenado en nirix traq v3.9.0 , donde la entrada proporcionada por el usuario en el campo de descripción del ticket no se sanitiza adecuadamente...

CVE-2025-52097

CVE-2025-52097 – InstantForum.NET v4.1.4 中的反射型XSS 本仓库包含 CVE-2025-52097 的公开公告、概念验证及相关支持材料，该漏洞是 InstantForum.NET v4.1.4 中发现的一个反射型跨站脚本（XSS）漏洞。 摘要 产品： InstantForum.NET v4.1.4 厂商： InstantASP Ltd.（已停止运营） 漏洞类型： 反射型跨站脚本（XSS） 描述： hbhxg 查询字符串参数中的未净化输入被直接反射到 HTML 响应中，未进行输出编码，这使得攻击者能够在无需认证的情况下在受害者浏览器中执行任意...

CVE-2025-25461

📌 CVE-2025-25461 - SeedDMS 6.0.29 存储型跨站脚本（XSS）漏洞 📝 描述 SeedDMS 6.0.29 中存在一个存储型跨站脚本（XSS）漏洞。 拥有 "添加分类" 权限的用户或恶意管理员可以向分类名称字段注入恶意 XSS 载荷。 当文档随后与该分类关联时，载荷会被存储在服务器上，并在未经过滤或输出编码的情况下渲染。 这导致任何查看文档的用户浏览器执行该 XSS 载荷。 🎯 受影响产品 软件： SeedDMS 版本： 6.0.29 组件： 分类名称字段 ⚠️ 影响 会话劫持 数据泄露 钓鱼攻击 远程代码执行（通过 JavaScript） 🔥...

CVE-2026-76798

The MongoSQL Transition Readiness Tool (part of MongoDB's SQL/BI Connector stack) writes query text and user names from BI Connector log files into its generated HTML reports without encoding them for the HTML output context. An attacker with low privileges who can issue queries through the BI Co...

CVE-2026-76798 MongoSQL Transition Readiness Tool Improper Output Encoding in Generated HTML Reports

The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to issue queries through the BI Connector can influence log content so that markup supplied in a query...

MongoSQL Transition Readiness Tool Improper Output Encoding in Generated HTML Reports

The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to issue queries through the BI Connector can influence log content so that markup supplied in a query...