CVE-2026-52606

A reflected cross-site scripting XSS vulnerability in reportico-web = 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the loadTemplate parameter in conjunction with the executemode=PREPARE parameter of run.php...

CVE-2026-75078 SourceCodester Class and Exam Timetabling System BSHRM1.php cross site scripting

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSHRM1.php. Performing a manipulation of the argument course results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been...

SUSE CVE-2026-48550

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to reflected cross-site scripting in cmd.cgi via the NagFormId parameter. An unauthenticated remote attacker can craft a malicious link that, when followed by an authenticated user, executes arbitrary JavaScript in the victim'...

WordPress Mayosis Core plugin <= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Mayosis Core versions = 5.4.7...

WordPress SSL Zen plugin <= 4.7.43 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Martino Spagnuolo r3verii in WordPress Plugin SSL Zen versions = 4.7.43...

Exploit for CVE-2026-64638

xss2shell-check Non-destructive, dependency-free detector for...

CVE-2026-19922 code-projects Online Shopping System checkout.php cross site scripting

A security flaw has been discovered in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /checkout.php. Performing a manipulation of the argument amount1 results in cross site scripting. The attack can be initiated remotely. The exploit has...

CVE-2026-19922

Affects code-projects Online Shopping System 1.0; vulnerable component is the file /checkout.php. Manipulating the amount_1 parameter triggers cross-site scripting. Exploitation appears remotely viable; CVSS details in provided metrics show several vectors with a PROOF-OF-CONCEPT exploit maturity...

CVE-2026-19904

CVE-2026-19904 affects SourceCodester Online Book Store System 1.0 in the System Settings Module, via /admin/index.php?page=site_settings. The vulnerability enables cross-site scripting and can be exploited remotely, with a public exploit reported. Documents confirm the affected path and XSS impa...

Cross-Site Scripting (XSS)

Spring Web Flow is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the JavaScript RemotingHandler rendering error-response bodies as HTML even when the response is not text/html, which allows an attacker to exploit the issue by injecting malicious input that is reflected in...

Exploit for CVE-2026-12345

CVE-2026-64638 - WordPress wp-login.php Reflected XSS "XSS2...

CVE-2026-63361 LimeSurvey Community Edition 7.0.5 - Reflected XSS in HTML editor popup

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding...

CVE-2026-63361 LimeSurvey Community Edition 7.0.5 - Reflected XSS in HTML editor popup

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding...

EUVD-2026-58731

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding...

CVE-2026-63361 LimeSurvey Community Edition 7.0.5 - Reflected XSS in HTML editor popup

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding...

CVE-2026-63361

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding...

EUVD-2026-58596

The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...

CVE-2026-63361: Improper Neutralization of Input During Web Page Generation

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding...

CVE-2026-73037

Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter that is interpolated without escaping into HTML and JavaScript. Attackers can craft malicious URLs to execute arbitrary JavaScript in the localhost origin, enabling exfiltration...

CVE-2026-73037 Next AI Draw.io 0.2.1 - 0.4.16 Reflected XSS via unsanitized mcp query parameter

Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter that is interpolated without escaping into HTML and JavaScript. Attackers can craft malicious URLs to execute arbitrary JavaScript in the localhost origin, enabling exfiltration...