CVE-2025-63607

The software TechStore 1.0 is vulnerable to Cross Site Scripting (XSS) . The vulnerability exists because the application's contact_display function echoes the id parameter verbatim into the rendered page without proper sanitization. This allows an attacker to execute arbitrary JavaScript in the ...

PT-2026-83985

TechStore 1.0 is vulnerable to Cross Site Scripting XSS. In contact display, the application echoes the id parameter verbatim into the rendered page, permitting execution of attacker-supplied JavaScript in users browser...

Linux Distros Unpatched Vulnerability : CVE-2026-59281

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument...

CVE-2026-82646

WWBN AVideo contains an unauthenticated reflected cross-site scripting vulnerability in the url2Embed.json.php endpoint that allows attackers to inject malicious scripts by supplying URLs with HTML metacharacters. Attackers can mint an encrypted evideo payload containing unescaped markup, then...

EUVD-2026-68232

WWBN AVideo contains an unauthenticated reflected cross-site scripting vulnerability in the url2Embed.json.php endpoint that allows attackers to inject malicious scripts by supplying URLs with HTML metacharacters. Attackers can mint an encrypted evideo payload containing unescaped markup, then...

CVE-2026-82646 WWBN AVideo Unauthenticated Reflected XSS via url2Embed.json.php

WWBN AVideo contains an unauthenticated reflected cross-site scripting vulnerability in the url2Embed.json.php endpoint that allows attackers to inject malicious scripts by supplying URLs with HTML metacharacters. Attackers can mint an encrypted evideo payload containing unescaped markup, then...

CVE-2026-82646 WWBN AVideo Unauthenticated Reflected XSS via url2Embed.json.php

WWBN AVideo contains an unauthenticated reflected cross-site scripting vulnerability in the url2Embed.json.php endpoint that allows attackers to inject malicious scripts by supplying URLs with HTML metacharacters. Attackers can mint an encrypted evideo payload containing unescaped markup, then...

CVE-2026-82646

WWBN AVideo is affected by an unauthenticated reflected cross-site scripting (XSS) vulnerability in the url2Embed.json.php endpoint. The root cause is that URLs containing HTML metacharacters are not properly escaped when embedded into an encrypted evideo payload, allowing an attacker to inject m...

CVE-2026-14307

The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HTML content type, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a victim is tricked into...

CVE-2026-14307

The geotargetingwp WordPress plugin, in versions prior to 3.5.6.2 , is vulnerable to Reflected Cross-Site Scripting (XSS) . The flaw occurs because the plugin fails to sanitize or escape several parameters before reflecting them in AJAX responses served with an HTML content type . This allows una...

CVE-2026-14307 Geotargeting WP < 3.5.6.2 - Reflected XSS

The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HTML content type, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a victim is tricked into...

EUVD-2026-68155

The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HTML content type, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a victim is tricked into...

CVE-2026-14307 Geotargeting WP < 3.5.6.2 - Reflected XSS

The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HTML content type, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a victim is tricked into...

CVE-2026-82646: Improper Neutralization of Input During Web Page Generation

WWBN AVideo contains an unauthenticated reflected cross-site scripting vulnerability in the url2Embed.json.php endpoint that allows attackers to inject malicious scripts by supplying URLs with HTML metacharacters. Attackers can mint an encrypted evideo payload containing unescaped markup, then...

PT-2026-83572

WWBN AVideo contains an unauthenticated reflected cross-site scripting vulnerability in the url2Embed.json.php endpoint that allows attackers to inject malicious scripts by supplying URLs with HTML metacharacters. Attackers can mint an encrypted evideo payload containing unescaped markup, then...

CVE-2026-55549

Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirecturi parameter from GET /auth/authorize into yamcs-core/src/main/resources/auth/templates/authorize.html without adequate HTML escaping by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.ja...

Yamcs has Reflected XSS in the URL of the Authorize Endpoint

Attack type: Unauthenticated remote Impact: Attackers can execute arbitrary JavaScript in a user's browser, including obtaining a user's session token and refresh token. Affected components: authorize.html, AuthHandler.java, HandlerContext.java A Reflected Cross-Site Scripting vulnerability...

GHSA-RXPG-WJF8-QV9C Yamcs has Reflected XSS in the URL of the Authorize Endpoint

Attack type: Unauthenticated remote Impact: Attackers can execute arbitrary JavaScript in a user's browser, including obtaining a user's session token and refresh token. Affected components: authorize.html, AuthHandler.java, HandlerContext.java A Reflected Cross-Site Scripting vulnerability...

EUVD-2026-67841

Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirecturi parameter from GET /auth/authorize into yamcs-core/src/main/resources/auth/templates/authorize.html without adequate HTML escaping by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.ja...

CVE-2026-55549 Yamcs: Reflected XSS in the URL of the Authorize Endpoint

Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirecturi parameter from GET /auth/authorize into yamcs-core/src/main/resources/auth/templates/authorize.html without adequate HTML escaping by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.ja...