EUVD-2026-67134

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Seres Software syWEB allows Reflected XSS. This issue affects syWEB: through 27082026. NOTE: The vendor was contacted and it was learned that the product is not supported...

portswigger---cross-site-scripting

portswigger-web-security-academy/ └── cross-site-scripting/...

CVE-2026-5738

DoXBASE by BilPark Informatics Technologies Industry and Trade Inc. is affected by a reflected cross-site scripting (XSS) vulnerability, described as enabling Cross Zone Scripting due to improper input neutralization during web page generation. The issue affects DoXBASE versions through 27082026 ...

CVE-2026-5738 Reflected XSS in BilPark's DoXBASE

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in BilPark Informatics Technologies Industry and Trade Inc. DoXBASE allows Cross Zone Scripting. This issue affects DoXBASE: through 27082026. NOTE: The vendor was contacted early about this disclosur...

CVE-2026-66155

A vulnerability has been identified in Element maps-ng V47 All versions V47.12.3, Element maps-ng V48 All versions V48.11.3, Element maps-ng V49 All versions V49.16.1. The si-map component does not properly neutralize user-controllable input of the points property that is used to render the toolt...

web-xss-scanner-and-patcher

Web Vulnerability Assessment & Automated Python Scanner A han...

CVE-2026-77989

Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager 5.0.1 - buildCurrentPdfLink copies the current request query string into the PDF button URL, and pdfbutton echoes it unescaped, leading to an reflected XSS vector...

CVE-2026-47877

Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6...

CVE-2026-77989 Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1

Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager 5.0.1 - buildCurrentPdfLink copies the current request query string into the PDF button URL, and pdfbutton echoes it unescaped, leading to an reflected XSS vector...

CVE-2026-77989

Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager 5.0.1 - buildCurrentPdfLink copies the current request query string into the PDF button URL, and pdfbutton echoes it unescaped, leading to an reflected XSS vector...

EUVD-2026-66862

Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager 5.0.1 - buildCurrentPdfLink copies the current request query string into the PDF button URL, and pdfbutton echoes it unescaped, leading to an reflected XSS vector...

CVE-2026-77989

This is a reflected XSS in the Joomla Events Manager extension prior to version 5.0.1 . The root cause lies in the buildCurrentPdfLink function, which copies the current request query string into the PDF button URL, and pdfbutton() echoes it without escaping, creating a reflected XSS vector via t...

CVE-2026-77989 Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1

Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager 5.0.1 - buildCurrentPdfLink copies the current request query string into the PDF button URL, and pdfbutton echoes it unescaped, leading to an reflected XSS vector...

EUVD-2026-66773

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding. This...

PT-2026-82506

Name of the Vulnerable Software and Affected Versions syWEB versions prior to 27082026 Description Improper neutralization of input during web page generation in syWEB allows Reflected XSS, a type of cross-site scripting where malicious scripts are reflected off a web application to the victim's...

CVE-2026-11747: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Seres Software syWEB allows Reflected XSS. This issue affects syWEB: through 27082026. NOTE: The vendor was contacted and it was learned that the product is not supported...

PT-2026-82424

Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager 5.0.1 - buildCurrentPdfLink copies the current request query string into the PDF button URL, and pdfbutton echoes it unescaped, leading to an reflected XSS vector...

CVE-2026-77989: Improper Neutralization of Input During Web Page Generation

Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager 5.0.1 - buildCurrentPdfLink copies the current request query string into the PDF button URL, and pdfbutton echoes it unescaped, leading to an reflected XSS vector...

CVE-2026-79718: Improper Neutralization of Input During Web Page Generation

Reflected XSS in Netron versions =9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution...

CVE-2026-79719: Improper Neutralization of Input During Web Page Generation

Reflected XSS in Netron versions =9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution...