CVE-2026-52609

A reflected cross-site scripting (XSS) vulnerability exists in reportico-web versions

CVE-2026-52609

A reflected cross-site scripting XSS vulnerability in reportico-web = 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the reporticocriteria parameter in conjunction with the executemode=CRITERIA parameter of run.php...

CVE-2026-52606

The software reportico-web (version

PT-2026-77233

Name of the Vulnerable Software and Affected Versions reportico-web versions prior to 8.1.1 Description A reflected cross-site scripting XSS issue allows remote attackers to execute arbitrary JavaScript in a user's web browser. This occurs when a malicious payload is included in the reportico...

CVE-2026-45118: Improper Neutralization of Script in Attributes in a Web Page

MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resulting in an open redirect and reflected JavaScript code injection. contact.php accepts the redirect target from the from HTTP parameter in $mybb-input'from'...

CVE-2026-71572: Improper Neutralization of CRLF Sequences

Joomla! Core - 20260801 - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 - Lack of output processing allowed a header injection in the multiple download views, leading to reflected file download / content-type confusion...

PT-2026-77191

Name of the Vulnerable Software and Affected Versions Joomla! Core versions 3.0.0 through 5.4.7 Joomla! Core versions 6.0.0 through 6.1.2 Description Lack of output processing in multiple download views allows for response header injection. This issue can lead to reflected file download or...

CVE-2026-75078 SourceCodester Class and Exam Timetabling System BSHRM1.php cross site scripting

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSHRM1.php. Performing a manipulation of the argument course results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been...

CVE-2026-74253

Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer 16.0.0 - Regular Labs Sourcerer before 16.0.0 processes source blocks found in Joomla’s final rendered HTML without reliably determining where that code originated...

EUVD-2026-60307

Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer 14.0.0 - Regular Labs Sourcerer before 14.0.0 processes source blocks found in Joomla’s final rendered HTML without reliably determining where that code originated...

SUSE CVE-2026-48550

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to reflected cross-site scripting in cmd.cgi via the NagFormId parameter. An unauthenticated remote attacker can craft a malicious link that, when followed by an authenticated user, executes arbitrary JavaScript in the victim'...

WordPress Mayosis Core plugin <= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Mayosis Core versions = 5.4.7...

WordPress SSL Zen plugin <= 4.7.43 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Martino Spagnuolo r3verii in WordPress Plugin SSL Zen versions = 4.7.43...

PT-2026-76726

Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer 14.0.0 - Regular Labs Sourcerer before 14.0.0 processes source blocks found in Joomla’s final rendered HTML without reliably determining where that code originated...

CVE-2026-74253: Improper Control of Generation of Code

Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer 16.0.0 - Regular Labs Sourcerer before 16.0.0 processes source blocks found in Joomla’s final rendered HTML without reliably determining where that code originated...

Exploit for CVE-2026-64638

xss2shell-check Non-destructive, dependency-free detector for...

web-vulnerabilities-labs

Web Vulnerabilities Labs Notes techniques issues de labs web...

CVE-2026-19922

Affects code-projects Online Shopping System 1.0; vulnerable component is the file /checkout.php. Manipulating the amount_1 parameter triggers cross-site scripting. Exploitation appears remotely viable; CVSS details in provided metrics show several vectors with a PROOF-OF-CONCEPT exploit maturity...

CVE-2026-19922 code-projects Online Shopping System checkout.php cross site scripting

A security flaw has been discovered in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /checkout.php. Performing a manipulation of the argument amount1 results in cross site scripting. The attack can be initiated remotely. The exploit has...

CVE-2026-19904

CVE-2026-19904 affects SourceCodester Online Book Store System 1.0 in the System Settings Module, via /admin/index.php?page=site_settings. The vulnerability enables cross-site scripting and can be exploited remotely, with a public exploit reported. Documents confirm the affected path and XSS impa...