636 matches found
CVE-2024-39031
CVE-2024-39031 : Silverpeas Core Stored XSS in in Mes agendas Information Description: In Mes Agendas, a user can create new events and add them to their calendar. Additionally, users can invite others from the same domain, including administrators, to these events. A standard user can inject an...
CVE-2019-19658
CVE-2019-19658 Chevereto のプロフィールページにおけるストアドXSS - 1.0.0 - 1.1.4 Free、 登録済みユーザーが名前フィールドにスクリプト（この例ではユーザーをGoogleにリダイレクトするもの）を挿入します 誰かが/testのプロフィールにアクセスすると、リダイレクトされます...
CVE-2021-24299
creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:41+00:00| seen| https://t.me/hackingAttack/9959 2026-09-02 01:03:17+00:00| seen| https://t.me/hackingAttack/9959 2026-09-08 06:00:05+00:00| published-proof-of-concept| https://t.me/hackingAttack/9959 2026-09-09 00:00:40+00:00|...
EUVD-2026-63371
ATutor is vulnerable to Stored Cross Site Scripting in registration functionality. An attacker can register a new account and enter a JavaScript payload in the phone field during registration. When any authenticated user visits the attacker's public profile, the profile template echoes the phone...
CVE-2026-12696
The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor wh...
CVE-2026-12696 wpForo Forum < 3.1.2 - Subscriber+ Stored XSS via Profile Location Field
The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor wh...
CVE-2026-12696
CVE-2026-12696 affects the wpForo Forum WordPress plugin prior to 3.1.2. The vulnerability is a Stored XSS in the public participant profile page: a profile field is not sanitized/escaped before being output inside an HTML attribute, permitting a subscriber-level user to inject JavaScript that ru...
PT-2026-67015
The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor wh...
CVE-2026-66029
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the client Name field on the Edit Profile page without sanitization. Attackers ca...
CVE-2026-66029
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the client Name field on the Edit Profile page without sanitization. Attackers ca...
PT-2026-65090
Name of the Vulnerable Software and Affected Versions Ekushey Project Manager CRM versions prior to 5.1 Description A stored cross-site scripting issue exists where authenticated client users can inject arbitrary HTML and JavaScript. This occurs when malicious payloads are entered into the Name...
CVE-2026-59794
JetBrains TeamCity (pre-2026.1.2) is affected by a stored XSS on the cloud profile page due to agent-reported data. The issue enables an attacker with low privileges and network access to trigger a stored XSS that can impact user confidentiality and integrity, with user interaction required. The ...
CVE-2026-59794
In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data...
EUVD-2026-42912
In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data...
CVE-2025-11977
creationtimestamp| type| source ---|---|--- 2026-07-10 11:55:25+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqc3pc2czt2a 2026-07-10 21:16:28+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd32j7xs42d...
PT-2026-57185
Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2026.1.2 Description Stored Cross-Site Scripting XSS is possible on the cloud profile page. This occurs when the application fails to properly sanitize data reported by agents, allowing an attacker to injec...
CVE-2026-14403
creationtimestamp| type| source ---|---|--- 2026-07-02 00:18:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmqzc7uwk2k 2026-07-02 08:25:21+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-02 16:51:23+00:00| seen|...
CVE-2026-53350
creationtimestamp| type| source ---|---|--- 2026-07-01 22:46:32+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmlvbdcrx2y 2026-07-06 06:53:16+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260706...