rtl_433

rtl433 rtl433 despite the name is a generic data receiver, mainly for the 433.92 MHz, 868 MHz SRD, 315 MHz, 345 MHz, and 915 MHz ISM bands. The official source code is in the https://github.com/merbanan/rtl433/ repository. See also a list of software that works with rtl433 in the wiki. For more...

owasp-java-encoder

Проект OWASP Java Encoder Контекстное кодирование вывода — это метод программирования, необходимый для предотвращения межсайтового скриптинга XSS. Этот проект представляет собой простой в использовании, высокопроизводительный класс кодировщика для Java 1.8+ с минимальными зависимостями. Более...

YesWiki Archived Revision - Cross-Site Scripting

YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coerces malformed DATETIME strings, an attacker can append an XSS payload after a valid revision timestamp. id: CVE-2026-52773 info: name: YesWiki...

EyouCms v1.6.2 - Cross-Site Scripting

EyouCms v1.6.2 was discovered to contain a reflected cross-site scripting XSS vulnerability via the component /admin/twitter.php?activet. id: CVE-2023-41597 info: name: EyouCms v1.6.2 - Cross-Site Scripting author: ritikchaddha severity: medium description: | EyouCms v1.6.2 was discovered to...

SuperWebMailer 9.00.0.01710 - Cross-Site Scripting

An issue was discovered in SuperWebMailer 9.00.0.01710 allowing XSS via crafted incorrect passwords. id: CVE-2023-38192 info: name: SuperWebMailer 9.00.0.01710 - Cross-Site Scripting author: ritikchaddha severity: medium description: | An issue was discovered in SuperWebMailer 9.00.0.01710 allowi...

SuperWebMailer - Cross-Site Scripting

An issue was discovered in SuperWebMailer 9.00.0.01710 that allows keepalive.php XSS via a GET parameter. id: CVE-2023-38194 info: name: SuperWebMailer - Cross-Site Scripting author: ritikchaddha severity: medium description: | An issue was discovered in SuperWebMailer 9.00.0.01710 that allows...

CVE-2026-9811

CVE-2026-9811 CVE-2026-9811 est une vulnérabilité de Cross-Site Scripting stocké XSS stocké affectant Mautic 7 versions 7.0.0 à 7.1.1. La vulnérabilité existe dans le composant Project Selector, où les noms de projets renvoyés via une requête AJAX sont insérés dans la page sans encodage de sortie...

CVE-2026-13635

An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to obtain non-sensitive information...

CVE-2026-13684

An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks...

WSO2-2021-1261

WSO2-2021-1261 : Multiples Cross-Site Scripting dans WSO2 ESB En raison d'un encodage de sortie inapproprié, plusieurs attaques de Cross-Site Scripting XSS ont été identifiées dans WSO2 ESB. Divulgation du fournisseur : La divulgation et le correctif du fournisseur pour cette vulnérabilité peuven...

cve-2025-31651

CVE-2025-36701 — Apache Tomcat - Rewrite rule bypass Discoverer: gregk4sec https://github.com/gregk4sec/cve Discovery Date: 2025-02-28 Affected Vendor: Apache Affected Product: Tomcat 9.0.x / 10.1.x / 11.0.x Severity: Critical / High CWE: CWE-116 Status: Under Review / Fixed / Public ✅ / Private...

CVE-2026-37272

CVE-2026-37272 CVE-2026-37272 Description Une vulnérabilité de cross-site scripting XSS réfléchi existe dans /dashboard/settings.php dans Bank Management System in Web 1.0. La vulnérabilité survient en raison d'une désinfection inadéquate des entrées fournies par l'utilisateur dans le paramètre G...

CVE-2025-65300

CVE-2025-65300 Description CVE-2025-65300: Stored Cross-Site Scripting XSS Vulnerability in Coohom SaaS Platform Disclosure Date: 2025-10-28 Last Updated: 2025-10-28 Reporter: Phisit Pupiw Vendor: Coohom CWE: CWE-79 – Cross-Site Scripting Summary A stored Cross-Site Scripting XSS vulnerability wa...

CVE-2025-63588

CVE-2025-63588 Reflected Cross-Site Scripting XSS in CMSimpleXH cmsimplexh path handling Estimated CVSS v3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N → 6.1 Medium Assigned CVE: CVE-2025-63588 Products: CMSimpleXH - 1.8 Vendor: CMSimpleXH - https://www.cmsimple-xh.org/ Summary A reflected Cross-Site...

CVE-2026-81899

Concrete CMS 9.0.0 to 9.5.2 stored group folder names without sanitization and printed them unescaped on the Members Groups dashboard page, resulting in stored cross-site scripting. The add and edit group-folder handlers stored the submitted folder name without neutralizing HTML, and the group...

EUVD-2026-79127

Concrete CMS 9.0.0 to 9.5.2 stored group folder names without sanitization and printed them unescaped on the Members Groups dashboard page, resulting in stored cross-site scripting. The add and edit group-folder handlers stored the submitted folder name without neutralizing HTML, and the group...

CVE-2026-81899

Concrete CMS versions 9.0.0 through 9.5.2 are affected by a stored cross-site scripting (XSS) vulnerability in the group folder name handling. The add and edit group-folder handlers stored submitted folder names without sanitizing HTML, and the group search grid returned them without output encod...

CVE-2026-81897 Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via Express form Text control save_control

In Concrete CMS below CMS 9.5.3, the savecontrol action in the Express entities forms dashboard controller did not validate the anti-CSRF token. By causing an authenticated administrator to submit a forged cross-site request, a remote attacker without credentials could write attacker-controlled...

EUVD-2026-78932

In Concrete CMS below CMS 9.5.3, the savecontrol action in the Express entities forms dashboard controller did not validate the anti-CSRF token. By causing an authenticated administrator to submit a forged cross-site request, a remote attacker without credentials could write attacker-controlled...

Astra Linux – Vulnerability in Tomcat9

A vulnerability exists in the improper encoding or escaping of output in the JsonAccessLogValve component of Apache Tomcat. This issue affects Apache Tomcat versions from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, and from 9.0.40 through 9.0.116. Users are recommended to upgrade t...