CVE-2026-91922 Steedos Platform through 3.0.15-beta.47 Reflected XSS via page render

Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaA...

cve-2026-41200-stig-manager-oidc-reflected-xss

CVE-2026-41200 — STIG Manager OIDC リフレクション型XSS PoC STIG Manager バージョン 1.5.10 から 1.6.7 におけるリフレクション型クロスサイトスクリプティング（XSS）脆弱性の概念実証です。 脆弱性の概要 STIG Manager Web アプリの OIDC 認証エラーハンドリングコードにリフレクション型 XSS 脆弱性が存在します。OIDC プロバイダーから返される error および errordescription クエリパラメータが、HTML エスケープなしで innerHTML を介して DOM...

CVE-2026-62280

OpenAM versions 13.0.0 through 16.1.2 are vulnerable to reflected XSS in the OAuth2 authorize endpoint's display=wap consent page. Request-derived values are reflected through ConsentRequiredResource and the wap/authorize.ftl template without HTML escaping, allowing an attacker to execute arbitra...

CVE-2026-62280 OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page

Open Access Management OpenAM is an access management solution. From 13.0.0 until 16.1.2, the OAuth2 authorize endpoint's display=wap consent page reflects request-derived values through ConsentRequiredResource and wap/authorize.ftl without HTML escaping. An attacker can induce a user with an...

CVE-2026-44203 OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the OAuth 2.0 and OpenID Connect authorization endpoint does not sufficiently encode user-supplied parameters before FormPostResponse.ftl and checkSession.ftl render them into HTML for the formpost response mode. An...

CVE-2026-44203 OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the OAuth 2.0 and OpenID Connect authorization endpoint does not sufficiently encode user-supplied parameters before FormPostResponse.ftl and checkSession.ftl render them into HTML for the formpost response mode. An...

CVE-2026-44793 OpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `FSUtils.postToTarget`

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, certain federation endpoints in a non-default clustered configuration inconsistently encode user-supplied parameters rendered into HTML in the SAML2 cluster cookie-hash redirect path. An unauthenticated attacker can...

CVE-2025-69848-security-advisories

NetBox ProtectedError 処理における反射型XSS CVE-2025-69848 概要 NetBox は、オープンソースのインフラストラクチャリソースモデリングおよび IP アドレス管理プラットフォームです。ProtectedError 例外処理ロジックに反射型クロスサイトスクリプティング XSS の脆弱性が存在します。 保護されたリレーションシップが原因で削除操作が失敗すると、オブジェクトの表示名が適切にエスケープされずに HTML エラーメッセージに挿入されます。これにより、ユーザーが制御するコンテンツが NetBox の Web...

CVE-2026-30251

ZenShare Suite - 脆弱性開示 このリポジトリには、ZenShare Suite アプリケーションで発見された複数の Reflected Cross-Site Scripting XSS 脆弱性に関する詳細が含まれています。 脆弱性の概要 ZenShare Suite アプリケーションは、ログイン機能とパスワード復旧機能に影響を及ぼす Reflected Cross-Site Scripting XSS に対して脆弱です。攻撃者は、悪意のある URL を作成し、被害者を騙してその URL にアクセスさせることで、被害者のブラウザ上で任意の JavaScript...

CVE-2026-39200

CVE-2026-39200 — Toko Online RotI における反映型クロスサイトスクリプティング XSS 概要 反映型クロスサイトスクリプティング XSS の脆弱性が、Toko Online RotI Web アプリケーションの produk リクエストパラメータで特定されました。このアプリケーションは、ユーザー提供の入力を二重引用符で囲まれた HTML タグ属性内に反映する前に HTML エンコードしていません。攻撃者は、被害者のブラウザセッションのコンテキストで任意の JavaScript を実行させる悪意のある URL を作成し、被害者がその URL...

CVE-2026-16186

IBM WebSphere Application Server 9.0, and 8.5 is affected by a reflected cross-site scripting vulnerability...

CVE-2026-16186 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 is affected by a reflected cross-site scripting vulnerability...

CVE-2026-16186

IBM WebSphere Application Server versions prior to 9.0.5.29 and 8.5.5.31 are affected by a reflected cross-site scripting (XSS) vulnerability. The flaw requires user interaction and is exploitable over the network without authentication, but impact is limited to low confidentiality and integrity ...

EUVD-2026-78053

IBM WebSphere Application Server 9.0, and 8.5 is affected by a reflected cross-site scripting vulnerability...

CVE-2026-19872

A flaw was found in HTML::FormHandler. A remote attacker could exploit this vulnerability by submitting malicious input that is then rendered unescaped in error messages. This allows the attacker to execute arbitrary script code in the victim's browser, potentially leading to information disclosu...

CVE-2026-78318

Apache Syncope is affected by an unauthenticated reflected XSS vulnerability in the notification message displayed on the Console and Enduser login pages. An attacker can craft a malicious HTTP link that injects HTML tags with unsafe inline JavaScript, which renders when a user follows the link. ...

CVE-2026-78318 Apache Syncope: Unauthenticated reflected XSS in Console and Enduser

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Syncope. The notification message, as optionally shown by Console's and Enduser's login pages can be instructed to display HTML tags with unsafe JS inline, via malicious HTTP link generation...

Astra Linux – Vulnerability in Zabbix

A authenticated user can create a link containing reflected JavaScript code on it for the discovery page and send it to other users. The payload can only be executed with a known CSRF token value of the victim, which is changed periodically and is difficult to predict...

Astra Linux – Vulnerability in Zabbix

Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected from a web application to the victim’s browser. The script is activated through a link, which sends a request to a website with a vulnerability that allows the execution of malicious scripts...

Astra Linux – Vulnerability in Zabbix

Reflected XSS attacks occur when a malicious script is reflected from a web application into the victim’s browser. The script can be activated through action form fields, which are sent as requests to a website with vulnerabilities that allow the execution of malicious scripts...