PT-2026-85665

In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint...

CVE-2026-79419

A reflected cross-site scripting XSS vulnerability exists in EMX Tecnologia Gestao X Business Suite 8.4 and earlier. The vulnerability is caused by insufficient validation and sanitization of the mensagem parameter in the /Configuracao/Imagens.aspx endpoint, allowing an authenticated attacker to...

CVE-2026-79419

A reflected XSS vulnerability in EMX Tecnologia Gestao X Business Suite 8.4 and earlier is caused by insufficient validation and sanitization of the mensagem parameter at the /Configuracao/Imagens.aspx endpoint, allowing an attacker to inject arbitrary JavaScript executed in a victim's browser. T...

EUVD-2026-71456

A reflected cross-site scripting XSS vulnerability exists in EMX Tecnologia Gestao X Business Suite 8.4 and earlier. The vulnerability is caused by insufficient validation and sanitization of the mensagem parameter in the /Configuracao/Imagens.aspx endpoint, allowing an unauthenticated attacker t...

PT-2026-85598

Name of the Vulnerable Software and Affected Versions EMX Tecnologia Gestao X Business Suite versions prior to 8.5 Description A reflected cross-site scripting XSS issue occurs due to insufficient validation and sanitization of the mensagem parameter within the '/Configuracao/Imagens.aspx'...

EUVD-2022-56032

In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint...

CVE-2022-35497

In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint...

CVE-2022-35499

Trimble TM4WEB (versions

CVE-2022-35497: Improper Neutralization of Input During Web Page Generation

In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint...

CVE-2022-35499: Improper Neutralization of Input During Web Page Generation

In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended to the URL...

CVE-2026-79419: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability exists in EMX Tecnologia Gestao X Business Suite 8.4 and earlier. The vulnerability is caused by insufficient validation and sanitization of the mensagem parameter in the /Configuracao/Imagens.aspx endpoint, allowing an authenticated attacker to...

CVE-2026-85541: Improper Neutralization of Input During Web Page Generation

DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary JavaScript codes in user's browser via a malicious website...

CVE-2026-75170

Cross-site scripting XSS vulnerability in the /loginController/doLogin endpoint of the HubCore platform version 14.1.1 allows a remote unauthenticated attacker to inject arbitrary JavaScript into the application's response via the language POST parameter...

CVE-2022-35499

In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended to the URL...

CVE-2026-85577: Improper Neutralization of Input During Web Page Generation

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php that allows unauthenticated attackers to inject arbitrary JavaScript by closing the script tag with . Attackers can craft a malicious URL with an error parameter containing script breakout...

CVE-2022-35497

In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint...

PT-2026-85454

DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary JavaScript codes in user's browser via a malicious website...

CVE-2026-85227

MISP contains a reflected Cross-Site Scripting XSS vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL parameters were inserted into the query-builder rules without HTML escaping before being serialized as JSON and embedded inside a...

SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass

Summary SiYuan cleans user supplied SVG with util.SanitizeSVG before it serves the file inline as image/svg+xml. This cleaner is the guard behind the Editor.AllowSVGScript setting, which is off by default, so a inside an SVG is meant to be removed. The cleaner reads the input as HTML, but the...

GHSA-99RQ-75J6-5J9F SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass

Summary SiYuan cleans user supplied SVG with util.SanitizeSVG before it serves the file inline as image/svg+xml. This cleaner is the guard behind the Editor.AllowSVGScript setting, which is off by default, so a inside an SVG is meant to be removed. The cleaner reads the input as HTML, but the...