EUVD-2026-71805

YesWiki is a wiki system written in PHP. From version 4.1.0 to before version 4.6.6, YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coerces malformed DATETIME strings, an attacker can append HTML ...

CVE-2026-52773 Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php` in YesWiki

YesWiki is a wiki system written in PHP. From version 4.1.0 to before version 4.6.6, YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coerces malformed DATETIME strings, an attacker can append HTML ...

CVE-2026-52773 Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php` in YesWiki

YesWiki is a wiki system written in PHP. From version 4.1.0 to before version 4.6.6, YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coerces malformed DATETIME strings, an attacker can append HTML ...

CVE-2026-52773

YesWiki (PHP wiki system), versions 4.1.0 through 4.6.5 , is vulnerable to a reflected XSS (CWE-79) in the archived-revision view. The time GET parameter is reflected unescaped into a hidden HTML input in handlers/page/show.php. Because MySQL coerces malformed DATETIME strings, an attacker append...

CVE-2026-79419

A reflected cross-site scripting XSS vulnerability exists in EMX Tecnologia Gestao X Business Suite 8.4 and earlier. The vulnerability is caused by insufficient validation and sanitization of the mensagem parameter in the /Configuracao/Imagens.aspx endpoint, allowing an authenticated attacker to...

CVE-2022-35497

In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint...

CVE-2022-35499

In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended to the URL...

CVE-2026-77818 Reflected HTML Injection via Form Hijacking in Yordam Informatics's Library Automation System

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Content Spoofing. This issue affects...

CVE-2026-85577

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php that allows unauthenticated attackers to inject arbitrary JavaScript by closing the script tag with . Attackers can craft a malicious URL with an error parameter containing script breakout...

CVE-2026-85577 AVideo userLogin.php Reflected XSS via error parameter

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php that allows unauthenticated attackers to inject arbitrary JavaScript by closing the script tag with . Attackers can craft a malicious URL with an error parameter containing script breakout...

CVE-2026-85577

AVideo through commit c91b5975d is affected by a reflected cross-site scripting vulnerability in userLogin.php . The root cause is that the error parameter is reflected into the page without sufficient sanitization, allowing an unauthenticated attacker to break out of a sequences. The payload ex...

EUVD-2026-71000

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php that allows unauthenticated attackers to inject arbitrary JavaScript by closing the script tag with . Attackers can craft a malicious URL with an error parameter containing script breakout...

CVE-2026-85577 AVideo userLogin.php Reflected XSS via error parameter

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php that allows unauthenticated attackers to inject arbitrary JavaScript by closing the script tag with . Attackers can craft a malicious URL with an error parameter containing script breakout...

CVE-2026-85541

DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary JavaScript codes in user's browser via a malicious website...

EUVD-2026-70983

DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary JavaScript codes in user's browser via a malicious website...

CVE-2026-85541 Interinfo｜DreamMaker - Reflected Cross-site Scripting

DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary JavaScript codes in user's browser via a malicious website...

CVE-2026-85541 Interinfo｜DreamMaker - Reflected Cross-site Scripting

DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary JavaScript codes in user's browser via a malicious website...

CVE-2026-85541

DreamMaker developed by Interinfo contains a Reflected Cross-site Scripting (XSS) vulnerability. Authenticated remote attackers can execute arbitrary JavaScript in a victim's browser via a malicious website. The CVSS 3.1 base score is 5.4 (MEDIUM) with a changed scope, requiring low privileges an...

CVE-2022-35499

In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended to the URL...

PT-2026-85598

Name of the Vulnerable Software and Affected Versions EMX Tecnologia Gestao X Business Suite versions prior to 8.5 Description A reflected cross-site scripting XSS issue occurs due to insufficient validation and sanitization of the mensagem parameter within the '/Configuracao/Imagens.aspx'...