CVE-2026-81925

Concrete CMS versions before 9.5.3 contain a reflected cross-site scripting (XSS) vulnerability in the conversation view endpoint . A user-supplied custom date format was improperly neutralized when rendering conversation messages, allowing an attacker to execute arbitrary JavaScript in a victim'...

CVE-2026-81925 Concrete CMS below 9.5.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via Conversation Custom Date Format

Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in reflected cross-site scripting. An attacker could execute arbitrary JavaScript in the browser of a user who was tricked into submitting a crafted POST request to...

CVE-2026-81925 Concrete CMS below 9.5.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via Conversation Custom Date Format

Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in reflected cross-site scripting. An attacker could execute arbitrary JavaScript in the browser of a user who was tricked into submitting a crafted POST request to...

EUVD-2026-79939

Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in reflected cross-site scripting. An attacker could execute arbitrary JavaScript in the browser of a user who was tricked into submitting a crafted POST request to...

CVE-2026-81925 Concrete CMS below 9.5.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via Conversation Custom Date Format

Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in reflected cross-site scripting. An attacker could execute arbitrary JavaScript in the browser of a user who was tricked into submitting a crafted POST request to...

CVE-2026-87793

The "Design Scuole Italia" WordPress theme is affected by a Reflected XSS vulnerability in the filters-scheda-didattica.php file, allowing an unauthenticated attacker to execute arbitrary JavaScript in a victim's browser via a crafted URL containing a malicious archive parameter...

CVE-2026-87793 Reflected XSS in WordPress theme design-scuole-wordpress-theme

The "Design Scuole Italia" WordPress theme is affected by a Reflected XSS vulnerability in the filters-scheda-didattica.php file, allowing an unauthenticated attacker to execute arbitrary JavaScript in a victim's browser via a crafted URL containing a malicious archive parameter...

CVE-2026-87793

The "Design Scuole Italia" WordPress theme (versions 1.0–2.18.2 ) contains a Reflected Cross-Site Scripting (XSS) vulnerability in the filters-scheda-didattica.php file. An unauthenticated attacker can execute arbitrary JavaScript in a victim's browser by supplying a malicious value in the archiv...

EUVD-2026-78666

The "Design Scuole Italia" WordPress theme is affected by a Reflected XSS vulnerability in the filters-scheda-didattica.php file, allowing an unauthenticated attacker to execute arbitrary JavaScript in a victim's browser via a crafted URL containing a malicious archive parameter...

CVE-2026-87793 Reflected XSS in WordPress theme design-scuole-wordpress-theme

The "Design Scuole Italia" WordPress theme is affected by a Reflected XSS vulnerability in the filters-scheda-didattica.php file, allowing an unauthenticated attacker to execute arbitrary JavaScript in a victim's browser via a crafted URL containing a malicious archive parameter...

CVE-2026-91922

Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaA...

EUVD-2026-78413

Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaA...

CVE-2026-91922

Steedos Platform through version 3.0.15-beta.47 is affected by a reflected cross-site scripting (XSS) vulnerability in the anonymous /api/page/render endpoint. The root cause is the failure to properly escape query parameters within inline script elements. An attacker can craft malicious links co...

CVE-2026-91922 Steedos Platform through 3.0.15-beta.47 Reflected XSS via page render

Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaA...

CVE-2026-91922 Steedos Platform through 3.0.15-beta.47 Reflected XSS via page render

Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaA...

CVE-2026-91922 Steedos Platform through 3.0.15-beta.47 Reflected XSS via page render

Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaA...

CVE-2026-62280 OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page

Open Access Management OpenAM is an access management solution. From 13.0.0 until 16.1.2, the OAuth2 authorize endpoint's display=wap consent page reflects request-derived values through ConsentRequiredResource and wap/authorize.ftl without HTML escaping. An attacker can induce a user with an...

CVE-2026-62280 OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page

Open Access Management OpenAM is an access management solution. From 13.0.0 until 16.1.2, the OAuth2 authorize endpoint's display=wap consent page reflects request-derived values through ConsentRequiredResource and wap/authorize.ftl without HTML escaping. An attacker can induce a user with an...

CVE-2026-62280

OpenAM versions 13.0.0 through 16.1.2 are vulnerable to reflected XSS in the OAuth2 authorize endpoint's display=wap consent page. Request-derived values are reflected through ConsentRequiredResource and the wap/authorize.ftl template without HTML escaping, allowing an attacker to execute arbitra...

CVE-2026-62280 OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page

Open Access Management OpenAM is an access management solution. From 13.0.0 until 16.1.2, the OAuth2 authorize endpoint's display=wap consent page reflects request-derived values through ConsentRequiredResource and wap/authorize.ftl without HTML escaping. An attacker can induce a user with an...