CVE-2026-71285

Uptime Kuma's Matomo analytics integration server/analytics/matomo-analytics.js injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a block rendered on every public status page. A siteId value such as , once saved by an editor/admin, executes arbitrary...

EUVD-2026-53370

Uptime Kuma's Matomo analytics integration server/analytics/matomo-analytics.js injects the admin-configurable Matomo siteId value as a bare, unquoted JavaScript expression inside a block rendered on every public status page: paq.push'setSiteId', $escapedSiteIdHTMLAttribute;. The escaping pipelin...

CVE-2026-71285 Uptime Kuma Stored XSS via Matomo Analytics Site ID on Public Status Pages

Uptime Kuma's Matomo analytics integration server/analytics/matomo-analytics.js injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a block rendered on every public status page. A siteId value such as , once saved by an editor/admin, executes arbitrary...

CVE-2026-71285

Uptime Kuma’s Matomo analytics integration (server/analytics/matomo-analytics.js) is affected. The admin-configurable Matomo siteId is injected as a bare, unquoted JavaScript expression inside a [removed] block on every public status page: _paq.push(['setSiteId', ${escapedSiteIdHTMLAttribute}]);....

CVE-2026-71285 Uptime Kuma Stored XSS via Matomo Analytics Site ID on Public Status Pages

Uptime Kuma's Matomo analytics integration server/analytics/matomo-analytics.js injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a block rendered on every public status page. A siteId value such as , once saved by an editor/admin, executes arbitrary...

CVE-2026-71285 Uptime Kuma Stored XSS via Matomo Analytics Site ID on Public Status Pages

Uptime Kuma's Matomo analytics integration server/analytics/matomo-analytics.js injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a block rendered on every public status page. A siteId value such as , once saved by an editor/admin, executes arbitrary...

CVE-2026-16560

creationtimestamp| type| source ---|---|--- 2026-07-23 05:55:06+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116967742251184999...

CVE-2026-10965

creationtimestamp| type| source ---|---|--- 2026-06-05 13:23:39+00:00| seen| https://infosec.exchange/users/cR0w/statuses/116697713800926918 2026-06-07 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260608 2026-06-07 18:00:00+00:00| seen|...

CVE-2026-32765

This repository is no longer public...

CVE-2025-12817

creationtimestamp| type| source ---|---|--- 2025-11-13 15:04:13+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115542999175905854 2025-11-14 17:36:20+00:00| seen| https://seclists.org/oss-sec/2025/q4/182 2025-12-26 11:15:11+00:00| seen|...

CVE-2025-5947

creationtimestamp| type| source ---|---|--- 2025-08-01 04:31:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3lvcsxn247l2t 2025-10-07 16:44:43+00:00| seen| https://gist.github.com/Darkcrai86/b6a8eee2ed2df4a5d2becbda7f7b6538 2025-10-08 04:16:06+00:00| seen|...

CVE-2025-23015

creationtimestamp| type| source ---|---|--- 2025-02-03 23:49:34+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3lhcq7oypki22 2025-02-04 10:15:44+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhdt7euk4q2e 2025-02-04 10:16:22+00:00| seen|...

CVE-2024-42442

creationtimestamp| type| source ---|---|--- 2024-11-12 15:26:06+00:00| seen| https://infosec.exchange/users/cve/statuses/113470679671943514 2024-11-12 17:12:48+00:00| seen| https://t.me/cvedetector/10626...

subway.pe XSS vulnerability

Vulnerable URL: http://www.subway.pe/menu.php?cat=;alert'OPENBUGBOUNTY';// Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 2000244 VIP website status:| No Check subway.pe SSL...

vetplus.co.nz XSS vulnerability

Vulnerable URL: http://www.vetplus.co.nz/login.php?username=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 11.02.2016 Latest check for patch:| 11.02.2016 01:25 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

httpd mod_status XSS

Cross-site scripting XSS vulnerability in modstatus.c in the modstatus module in Apache HTTP Server httpd, when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browser...