22988 matches found
PT-2026-78454
Joomla Extension - cmsjunkie.com - Reflected XSS / XML injection in J-BusinessDirectory 6.2.3 - companyName from the request was written unescaped into an XML attribute...
PT-2026-78300
The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered against any visitor, including a logged-in administrator...
CVE-2026-18756: Improper Neutralization of Input During Web Page Generation
HumHub Community Edition 1.18.4 contains a reflected cross-site scripting vulnerability in the Space membership-request workflow. An attacker can place attacker-controlled button configuration in the options query-string parameter of space/membership/request-membership-form, lure an authenticated...
Exploit for CVE-2026-64638
CVE-2026-64638 // XSS2Shell Análisis técnico y matriz de mi...
CVE-2026-52609
A reflected cross-site scripting XSS vulnerability in reportico-web = 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the reporticocriteria parameter in conjunction with the executemode=CRITERIA parameter of run.php...
CVE-2026-52606
A reflected cross-site scripting XSS vulnerability in reportico-web = 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the loadTemplate parameter in conjunction with the executemode=PREPARE parameter of run.php...
WordPress WP Photo Album Plus plugin < 9.2.07.002 - Reflected XSS via lbstart vulnerability
Reflected XSS via lbstart vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WP Photo Album Plus versions 9.2.07.002...
CVE-2026-45118 MyBB: Contact page reflected XSS
MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resulting in an open redirect and reflected JavaScript code injection. contact.php accepts the redirect target from the from HTTP parameter in $mybb-input'from'...
CVE-2026-45118 MyBB: Contact page reflected XSS
MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resulting in an open redirect and reflected JavaScript code injection. contact.php accepts the redirect target from the from HTTP parameter in $mybb-input'from'...
CVE-2026-45118
MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resulting in an open redirect and reflected JavaScript code injection. contact.php accepts the redirect target from the from HTTP parameter in $mybb-input'from'...
CVE-2026-45118 MyBB: Contact page reflected XSS
MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resulting in an open redirect and reflected JavaScript code injection. contact.php accepts the redirect target from the from HTTP parameter in $mybb-input'from'...
CVE-2026-45118
MyBB's contact.php passes unvalidated from parameter or Referer header to redirect() without protocol checks, allowing a javascript: URI to become a clickable link that executes script when a victim clicks it. No public exploitation evidence is available. Upgrade to MyBB 1.8.40 to fix.
EUVD-2026-61021
MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resulting in an open redirect and reflected JavaScript code injection. contact.php accepts the redirect target from the from HTTP parameter in $mybb-input'from'...
CVE-2026-73378
Unauthenticated Cross Site Scripting XSS in Contact Form by Supsystic 1.10.0 versions...
CVE-2026-32547
Unauthenticated Cross Site Scripting XSS in BP Better Messages = 2.15.22 versions...
CVE-2026-32333
Mayosis Core WordPress plugin versions ≤5.4.7 are affected by an unauthenticated reflected Cross Site Scripting (XSS) vulnerability exploitable via network with low attack complexity; CVSS 3.1 score is 7.1 (HIGH), requiring user interaction. No patch version or in-the-wild exploitation details ar...
CVE-2026-32333 WordPress Mayosis Core plugin <= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Mayosis Core = 5.4.7 versions...
CVE-2026-32333 WordPress Mayosis Core plugin <= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Mayosis Core = 5.4.7 versions...
CVE-2026-28569
CVE-2026-28569 is an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin SSL Zen , affecting versions ≤ 4.7.43 . The vulnerability was discovered by Martino Spagnuolo (r3verii) and carries a CVSS 3.1 base score of 7.1 (HIGH) with a changed scope, indicating ...