The vulnerability of the FOQUZ platform, related to the lack of measures taken to protect the website structure, allows attackers to perform cross-site scripting attacks (XSS).

The vulnerability of the FOQUZ platform is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

EUVD-2026-88641

A vulnerability was determined in CodeCanyon Rocket LMS up to 2.2. This affects an unknown function of the component Student Profile Image Upload. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be...

CVE-2026-97897

A security flaw exists in Krayin laravel-crm versions up to 2.2.5 . The vulnerability resides in the Sanitizer.php file of the TinyMCE Media Upload component, where improper processing allows for cross-site scripting (XSS) . This flaw can be triggered via a remote attack. To remediate this issue,...

CVE-2026-97322

A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This affects an unknown function of the file yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileController.java of the component File Upload. Performing a manipulation results in...

CVE-2026-97322: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This affects an unknown function of the file yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileController.java of the component File Upload. Performing a manipulation results in...

PT-2026-97149

Name of the Vulnerable Software and Affected Versions SourceCodester Smart Attendance System with QR Code Scanner version 1.0 Description An issue exists in the Self-Registration component within the student signup.php file. Manipulating the full name argument in the prepend function allows for...

CVE-2026-18131

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary JavaScript in an authenticated user's browser due to improper neutralization of HTML input...

CVE-2026-18131 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary JavaScript in an authenticated user's browser due to improper neutralization of HTML input...

CVE-2026-94426: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in xuxueli xxl-job up to 3.5.0. The impacted element is an unknown function of the file /jobgroup/insert. This manipulation of the argument Name causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be...

CVE-2026-90845: Improper Neutralization of Input During Web Page Generation

A flaw has been found in PHPGurukul Daily Expense Tracker System 1.1. This issue affects some unknown processing of the file /dets/includes/sidebar.php. Executing a manipulation of the argument FullName can lead to cross site scripting. The attack can be executed remotely. The exploit has been...

CVE-2026-90602: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this vulnerability is the function renderHistory of the file ImageStudio.js of the component Studio Components. This manipulation causes cross site scripting. The attack may be initiated remotely. The...

CVE-2026-90489: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in Xuxueli xxl-job up to 3.5.0. This vulnerability affects unknown code of the file /jobinfo/insert. Such manipulation of the argument name/author leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used...

ROS-20260911-73-0058

The vulnerability of the DevTools suite for web development in Google Chrome and Microsoft Edge relates to the execution of operations beyond the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute XSS attacks using a specially crafted HTML page...

CVE-2026-87926: Improper Neutralization of Input During Web Page Generation

A flaw has been found in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This issue affects some unknown processing of the file index.php of the component Login Page. Executing a manipulation of the argument msg can lead to cross site scripting. The attack can...

The vulnerability of the Element.setAttribute() method in the XML Document Access and Management Module XMLDOM allows a attacker to perform cross-site scripting (XSS) attacks.

The vulnerability of the Element.setAttribute method in the XML document access and manipulation module XMLDOM is related to errors in processing XML requests. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

CVE-2026-19988: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

A vulnerability was detected in Alaev SEO Tools Extension up to 1.0.10 on Chrome. This impacts the function addDiv of the file src/popup.html of the component Popup UI. Performing a manipulation results in basic cross site scripting. The attack can be initiated remotely. The exploit is now public...

CVE-2026-18632: Improper Neutralization of Special Elements Used in a Template Engine

A security flaw has been discovered in langgenius dify up to 1.14.2. This issue affects the function jinja2.Template of the file api/core/helper/codeexecutor/jinja2/jinja2transformer.py of the component Jinja2 Handler. The manipulation results in improper neutralization of special elements used i...

The vulnerability of Adobe Experience Manager’s content and media data management system lies in the insufficient protection of website structures, which allows attackers to perform cross-site scripting (XSS) attacks.

The vulnerability of the Adobe Media Encoder application relates to the lack of authentication for critical functions. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

CVE-2026-16485

A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /class.php. Such manipulation of the argument day leads to cross site scripting. The attack can be launched remotely. The exploit has been...

CVE-2026-15311: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in NousResearch hermes-agent up to 2026.5.29.2. Affected by this issue is the function MatrixAdapter.markdowntohtml of the file gateway/platforms/matrix.py of the component Matrix Adapter. Such manipulation leads to cross site scripting. The attack can be executed...