CVE-2026-65763

CVE-2026-65763 affects Phoca Maps (Phoca.cz) Joomla extension versions 1.0.0 through 6.0.9. The vulnerability is a reflected XSS caused by improper validation of user inputs, enabling an attacker to reflect malicious input in the response. Metrics indicate a CVSS 4.0 base with a 5.1 score (medium...

CVE-2026-65763 Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4

Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4 - Improper validation of user inputs lead to a reflective XSS vulnerability...

CVE-2026-65763

Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4 - Improper validation of user inputs lead to a reflective XSS vulnerability...

CVE-2026-9577

The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the mod URL parameter before reflecting it into the admin settings page admin.php?page=post-status-notifier-lite, leading to a Reflected Cross-Site Scripting vulnerability that fires in the administrator's sessi...

CVE-2026-9066

The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress...

CVE-2026-9066

The CVE describes a Reflected XSS in WP Compress for WordPress plugin before 7.10.04 due to lack of validation of a query parameter that controls the asset CDN host. This allows an attacker, via a crafted link, to cause the loader to inject script elements pointing to an attacker-controlled origi...

CVE-2026-9066 WP Compress < 7.10.04 - Reflected XSS via test_zone

The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress...

CVE-2026-63264

Joomla Extension - joomshopping.com - Reflective XSS in JoomShopping 5.9.3 - The Joomla extension JoomShopping is vulnerable to an reflected XSS vulnerability in the product frontend controller...

CVE-2026-63264 Joomla Extension - joomshopping.com - Reflective XSS in JoomShopping < 5.9.3

The Joomla extension JoomShopping is vulnerable to an reflected XSS vulnerability in the product frontend controller...

CVE-2026-63264

Joomla Extension - joomshopping.com - Reflective XSS in JoomShopping 5.9.3 - The Joomla extension JoomShopping is vulnerable to an reflected XSS vulnerability in the product frontend controller...

CVE-2026-63264 Joomla Extension - joomshopping.com - Reflective XSS in JoomShopping < 5.9.3

Joomla Extension - joomshopping.com - Reflective XSS in JoomShopping 5.9.3 - The Joomla extension JoomShopping is vulnerable to an reflected XSS vulnerability in the product frontend controller...

CVE-2026-55081 DHIS2 Reflected XSS in OpenAPI HTML scope parameter

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2 OpenAPI HTML endpoint reflected values from the scope query parameter into the generated HTML document without sufficient sanitization. A crafted scope value could be rendered a...

CVE-2026-55081 DHIS2 Reflected XSS in OpenAPI HTML scope parameter

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2 OpenAPI HTML endpoint reflected values from the scope query parameter into the generated HTML document without sufficient sanitization. A crafted scope value could be rendered a...

CVE-2026-44227

A flaw was found in RT, an issue and ticket tracking system. This reflected Cross-Site Scripting XSS vulnerability allows a remote attacker to execute arbitrary JavaScript code in an authenticated user's browser session. This can happen if an attacker convinces an authenticated user to visit a...

CVE-2026-44230 RT: Reflected Cross-Site Scripting in search results chart

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to but not including 5.0.10, and 6.0.0 up to but not including 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability where an attacker who can induce an authenticated RT user to visit a crafted U...

CVE-2026-44227

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability. An attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's...

CVE-2026-44227 RT: Reflected Cross-Site Scripting via URL parameters

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability. An attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's...

EUVD-2026-46045

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability. An attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's...

CVE-2026-44227

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability. An attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's...

CVE-2026-32822 dataCycle Unauthenticated Reflected DOM XSS Via flash[...] On Public Pages

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any unauthenticated attacker can place arbitrary HTML into flash...