CVE-2026-77989 Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1

Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager 5.0.1 - buildCurrentPdfLink copies the current request query string into the PDF button URL, and pdfbutton echoes it unescaped, leading to an reflected XSS vector...

EUVD-2026-66862

Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager 5.0.1 - buildCurrentPdfLink copies the current request query string into the PDF button URL, and pdfbutton echoes it unescaped, leading to an reflected XSS vector...

CVE-2026-77989 Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1

Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager 5.0.1 - buildCurrentPdfLink copies the current request query string into the PDF button URL, and pdfbutton echoes it unescaped, leading to an reflected XSS vector...

CVE-2026-77989

This is a reflected XSS in the Joomla Events Manager extension prior to version 5.0.1 . The root cause lies in the buildCurrentPdfLink function, which copies the current request query string into the PDF button URL, and pdfbutton() echoes it without escaping, creating a reflected XSS vector via t...

EUVD-2026-66773

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding. This...

CVE-2026-77989: Improper Neutralization of Input During Web Page Generation

Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager 5.0.1 - buildCurrentPdfLink copies the current request query string into the PDF button URL, and pdfbutton echoes it unescaped, leading to an reflected XSS vector...

PT-2026-82557

Name of the Vulnerable Software and Affected Versions Netron versions prior to 9.1.3 Description The desktop application contains a Reflected Cross-Site Scripting XSS flaw caused by unsanitized node names. This allows an attacker to hide specific nodes, conduct port scanning, or leverage a Chrome...

CVE-2026-63360

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding. This...

CVE-2026-45694

LibreNMS is a network monitoring system. In versions up to and including 26.4.0, the Proxmox application view is vulnerable to reflected cross-site scripting through the user-supplied instance and vmid GET parameters, which are reflected into the page title without adequate encoding. The paramete...

CVE-2026-63360 LimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpoint

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding. This...

CVE-2026-63360

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting (XSS) vulnerability in the user activation confirmation endpoint . The root cause is that the action query parameter is copied into the response and inserted into a hidden input attribute without HT...

CVE-2026-63360 LimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpoint

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding. This...

CVE-2026-45694 LibreNMS: Reflected XSS in the Proxmox app view via unsanitized instance/vmid parameters

LibreNMS is a network monitoring system. In versions up to and including 26.4.0, the Proxmox application view is vulnerable to reflected cross-site scripting through the user-supplied instance and vmid GET parameters, which are reflected into the page title without adequate encoding. The paramete...

CVE-2026-45694 LibreNMS: Reflected XSS in the Proxmox app view via unsanitized instance/vmid parameters

LibreNMS is a network monitoring system. In versions up to and including 26.4.0, the Proxmox application view is vulnerable to reflected cross-site scripting through the user-supplied instance and vmid GET parameters, which are reflected into the page title without adequate encoding. The paramete...

CVE-2026-45694

LibreNMS (network monitoring system) is affected by a reflected XSS in the Proxmox application view (versions up to 26.4.0 ). The root cause is in LegacyController.php:75, where the page title is injected into a document.title JavaScript assignment via string interpolation. The instance and vmid ...

EUVD-2026-66668

The Apple profile generated for the Apple built-in Mail, Calendar and Contacts account to synchronize with HCL Traveler requires the Logon Name and Mail Address to be embedded in them. The values cannot be changed later on, so the Apple profile generation page asks for those values and reflects...

CVE-2025-29276

CVE-2025-29276 Beweis des Konzepts PoC: Im Reiter 'Diagnose' rufen Sie das Ping-Tool auf und fügen Sie im Feld 'Host-Adresse' die folgende XSS-Nutzlast ein: root@kitploit: alert1 Beschreibung: Das direkte Absenden der Nutzlast im Feld 'Host-Adresse' löst eine reflektierte Cross-Site Scripting...

PT-2026-82314

Name of the Vulnerable Software and Affected Versions LimeSurvey Community Edition version 7.0.5 Description An authenticated reflected Cross-Site Scripting XSS issue exists in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a...

PT-2026-82210

Name of the Vulnerable Software and Affected Versions SunEditor versions prior to 3.1.4 Description A DOM-based Cross-Site Scripting XSS issue exists in the SunEditor Embed plugin within src/plugins/modal/embed.js. The plugin uses DOMParser to parse raw embed HTML and processes the resulting DOM...

CVE-2026-63360: Improper Neutralization of Input During Web Page Generation

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding. This...