CVE-2026-37196

CVE-2026-37196 – Stored Cross-Site Scripting XSS in nirix traq v3.9.0 Overview A Stored Cross-Site Scripting XSS vulnerability exists in nirix traq v3.9.0 , where user-supplied input in the ticket description field is improperly sanitized before being rendered in the application interface. This...

WSO2-2021-1261

WSO2-2021-1261: Múltiplos Cross-Site Scripting no WSO2 ESB Devido à codificação incorreta de saída, múltiplos ataques de Cross-Site Scripting XSS foram identificados no WSO2 ESB. Divulgação do Fornecedor: A divulgação e a correção do fornecedor para esta vulnerabilidade podem ser encontradas aqui...

EyouCms v1.6.2 - Cross-Site Scripting

EyouCms v1.6.2 was discovered to contain a reflected cross-site scripting XSS vulnerability via the component /admin/twitter.php?activet. id: CVE-2023-41597 info: name: EyouCms v1.6.2 - Cross-Site Scripting author: ritikchaddha severity: medium description: | EyouCms v1.6.2 was discovered to...

SuperWebMailer 9.00.0.01710 - Cross-Site Scripting

An issue was discovered in SuperWebMailer 9.00.0.01710 allowing XSS via crafted incorrect passwords. id: CVE-2023-38192 info: name: SuperWebMailer 9.00.0.01710 - Cross-Site Scripting author: ritikchaddha severity: medium description: | An issue was discovered in SuperWebMailer 9.00.0.01710 allowi...

SuperWebMailer - Cross-Site Scripting

An issue was discovered in SuperWebMailer 9.00.0.01710 that allows keepalive.php XSS via a GET parameter. id: CVE-2023-38194 info: name: SuperWebMailer - Cross-Site Scripting author: ritikchaddha severity: medium description: | An issue was discovered in SuperWebMailer 9.00.0.01710 that allows...

CVE-2025-52097

CVE-2025-52097 – XSS riflesso in InstantForum.NET v4.1.4 Questo repository contiene l'advisory pubblica, la prova di concetto e i materiali di supporto per CVE-2025-52097 , una vulnerabilità di cross-site scripting XSS riflesso identificata in InstantForum.NET v4.1.4. Riepilogo Prodotto:...

CVE-2026-37272

CVE-2026-37272 CVE-2026-37272 Descrizione Esiste una vulnerabilità di cross-site scripting XSS riflesso in /dashboard/settings.php nel Bank Management System in Web 1.0. La vulnerabilità si verifica a causa di una sanitizzazione impropria dell'input fornito dall'utente nel parametro GET msg. Un...

CVE-2026-9811

CVE-2026-9811 CVE-2026-9811 ist eine Schwachstelle vom Typ Stored Cross-Site Scripting Stored XSS, die Mautic 7 Versionen 7.0.0 bis 7.1.1 betrifft. Die Schwachstelle befindet sich in der Komponente Project Selector, in der Projektnamen, die über eine AJAX-Anfrage zurückgegeben werden, ohne...

owasp-java-encoder

OWASP Java Encoder Projekt Contextual Output Encoding ist eine Programmiertechnik, die notwendig ist, um Cross‑Site Scripting zu stoppen. Dieses Projekt ist eine einfach zu verwendende, einsatzbereite, leistungsstarke Java‑1.8+‑Encoder‑Klasse mit geringem Zusatzaufwand. Für detailliertere...

cve-2025-31651

CVE-2025-36701 — Apache Tomcat - تجاوز قاعدة إعادة الكتابة المكتشف: gregk4sec https://github.com/gregk4sec/cve تاريخ الاكتشاف: 2025-02-28 البائع المتأثر: Apache المنتج المتأثر: Tomcat 9.0.x / 10.1.x / 11.0.x الشدة: حرجة / عالية CWE: CWE-116 الحالة: قيد المراجعة / تم الإصلاح / عام ✅ / خاص الملخص...

CVE-2025-65300

CVE-2025-65300 Beschreibung CVE-2025-65300: Gespeicherte Cross-Site-Scripting-Schwachstelle XSS in der Coohom-SaaS-Plattform Offenlegungsdatum: 2025-10-28 Zuletzt aktualisiert: 2025-10-28 Reporter: Phisit Pupiw Anbieter: Coohom CWE: CWE-79 – Cross-Site Scripting Zusammenfassung Im Modul...

CVE-2025-63588

CVE-2025-63588 CMSimpleXH cmsimplexh पथ हैंडलिंग में परावर्तित क्रॉस-साइट स्क्रिप्टिंग XSS अनुमानित CVSS v3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N → 6.1 मध्यम निर्धारित CVE: CVE-2025-63588 उत्पाद: CMSimpleXH - 1.8 विक्रेता: CMSimpleXH - https://www.cmsimple-xh.org/ सारांश CMSimpleXH के फ्रंट-राउट...

@logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys

@logtape/syslog contains two related output-encoding bugs in the structured data formatting code. Both only affect deployments with includeStructuredData: true, which is non-default. 1. Unescaped C0 control characters in structured data values escapeStructuredDataValue in...

CVE-2025-25461

📌 CVE-2025-25461 - Cross-Site Scripting XSS Memorizzato in SeedDMS 6.0.29 📝 Descrizione Esiste una vulnerabilità di Cross-Site Scripting XSS Memorizzato in SeedDMS 6.0.29. Un utente o amministratore malintenzionato con il permesso "Aggiungi Categoria" può iniettare un payload XSS dannoso nel camp...

CVE-2026-26211

Ekushey Project Manager CRM 5.0 is affected by a stored XSS vulnerability in the administrator-configured system name field. The value is written to the login page without output encoding, and its occurrence in an h4 element is parsed as markup, causing any injected HTML event handlers to execute...

CVE-2026-53468

Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites. Versions prior to 2.23.0 are vulnerable to stored HTML attribute injection in the page metadata fields og:title and og:description. An authenticated user with permission to modify...

EUVD-2026-64169

Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites. Versions prior to 2.23.0 are vulnerable to stored HTML attribute injection in the page metadata fields og:title and og:description. An authenticated user with permission to modify...

CVE-2026-53468 Typemill has Stored HTML Attribute Injection in Metadata Fields

Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites. Versions prior to 2.23.0 are vulnerable to stored HTML attribute injection in the page metadata fields og:title and og:description. An authenticated user with permission to modify...

CVE-2026-53468

Typemill versions prior to 2.23.0 are vulnerable to stored HTML attribute injection in the page metadata fields (og:title and og:description). The root cause is missing output encoding , allowing an authenticated user with permission to modify page metadata to inject arbitrary HTML attributes int...

CVE-2026-53468 Typemill has Stored HTML Attribute Injection in Metadata Fields

Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites. Versions prior to 2.23.0 are vulnerable to stored HTML attribute injection in the page metadata fields og:title and og:description. An authenticated user with permission to modify...