Lucene search
+L

6892 matches found

OSV
OSV
added 2026/03/27 1:41 p.m.11 views

CVE-2026-32859 ByteDance DeerFlow Stored XSS via Inline Artifact Rendering

ByteDance DeerFlow versions prior to commit 5dbb362 contain a stored cross-site scripting vulnerability in the artifacts API that allows attackers to execute arbitrary scripts by uploading malicious HTML or script content as artifacts. Attackers can store malicious content that executes in the...

5.1CVSS6.1AI score
SaveExploits0References6
EUVD
EUVD
added 2026/03/27 6:31 a.m.9 views

EUVD-2026-16553

WordPress Plugin "OpenStreetMap" provided by MiKa contains a cross-site scripting vulnerability. On the site with the affected version of the plugin enabled, a logged-in user with a page-creating/editing privilege can embed some malicious script with a crafted HTTP request. When a victim user...

5.4CVSS5.7AI score0.00177EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/03/27 4:56 a.m.37 views

CVE-2026-33559

WordPress Plugin "OpenStreetMap" provided by MiKa contains a cross-site scripting vulnerability. On the site with the affected version of the plugin enabled, a logged-in user with a page-creating/editing privilege can embed some malicious script with a crafted HTTP request. When a victim user...

5.4CVSS0.00177EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/03/26 8:33 p.m.3 views

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the web page generation process. An attacker can execute arbitrary scripts in the context of a user's browser by supplying crafted input that is not properly neutralized. Details Cross-site scripting or XSS i...

6.1CVSS6.4AI score0.00226EPSS
SaveExploits1References3
EUVD
EUVD
added 2026/03/26 3:30 p.m.13 views

EUVD-2026-16185

SolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended script execution...

5.9CVSS5.5AI score0.00343EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/03/26 3:30 p.m.15 views

EUVD-2026-16183

SolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended script execution...

6.1CVSS5.5AI score0.00368EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/03/26 3:30 p.m.10 views

EUVD-2025-209057

HCL Aftermarket DPC is affected by Unrestricted File Upload vulnerability, allows attacker to upload and execute malicious scripts, gaining full control over the server...

9.8CVSS5.9AI score0.00295EPSS
SaveExploits0References2
NVD
NVD
added 2026/03/26 3:16 p.m.9 views

CVE-2026-28297

SolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended script execution...

8.7CVSS0.00368EPSS
SaveExploits0References2
RedhatCVE
RedhatCVE
added 2026/03/26 3:12 p.m.10 views

CVE-2026-21788

HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may allow the attacker steal cookie-based authentication credential...

5.4CVSS5.9AI score0.00164EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/03/26 3:11 p.m.7 views

CVE-2026-32112

ha-mcp is a Home Assistant MCP Server. Prior to 7.0.0, the ha-mcp OAuth consent form renders user-controlled parameters via Python f-strings with no HTML escaping. An attacker who can reach the OAuth endpoint and convince the server operator to follow a crafted authorization URL could execute...

6.8CVSS5.9AI score0.00181EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/03/26 3:10 p.m.12 views

CVE-2026-32139

Dataease is an open source data visualization analysis tool. In DataEase 2.10.19 and earlier, the static resource upload interface allows SVG uploads. However, backend validation only checks whether the XML is parseable and whether the root node is svg. It does not sanitize active content such as...

5.4CVSS6AI score0.002EPSS
SaveExploits1References1
RedhatCVE
RedhatCVE
added 2026/03/26 3:9 p.m.10 views

CVE-2026-27225

Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they brow...

5.4CVSS5.8AI score0.00167EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/03/26 2:8 p.m.28 views

CVE-2026-28298 SolarWinds Observability Self-Hosted Stored Cross-Site Scripting Vulnerability

SolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended script execution...

5.9CVSS0.00343EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/03/26 2:8 p.m.5 views

CVE-2026-28298

SolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended script execution...

5.9CVSS5.5AI score0.00343EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment
added 2026/03/26 2:8 p.m.5 views

CVE-2026-28298 SolarWinds Observability Self-Hosted Stored Cross-Site Scripting Vulnerability

SolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended script execution...

5.9CVSS5.5AI score0.00343EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/03/26 2:1 p.m.5 views

CVE-2026-28297 SolarWinds Observability Self-Hosted Stored Cross-Site Scripting Vulnerability

SolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended script execution...

6.1CVSS5.5AI score0.00368EPSS
SaveExploits0References2
NVD
NVD
added 2026/03/26 1:16 p.m.11 views

CVE-2025-55267

HCL Aftermarket DPC is affected by Unrestricted File Upload vulnerability, allows attacker to upload and execute malicious scripts, gaining full control over the server...

9.8CVSS0.00295EPSS
SaveExploits0References1
CVE
CVE
added 2026/03/26 1:1 p.m.35 views

CVE-2025-55267

HCL Aftermarket DPC is affected by an Unrestricted File Upload vulnerability due to inadequate verification/filtering of uploaded files. This allows an attacker to upload and execute malicious scripts, potentially gaining full control over the server. The CVE entry notes a high-impact scenario (C...

9.8CVSS5.9AI score0.00295EPSS
SaveExploits0References1Affected Software1
NVD
NVD
added 2026/03/26 5:16 a.m.10 views

CVE-2026-4329

The Blackhole for Bad Bots plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User-Agent HTTP header in all versions up to and including 3.8. This is due to insufficient input sanitization and output escaping. The plugin uses sanitizetextfield when capturing bot data which...

7.2CVSS0.00315EPSS
SaveExploits0References12
ATTACKERKB
ATTACKERKB
added 2026/03/25 10:44 p.m.7 views

CVE-2026-33911

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the POST parameter title is reflected back in a JSON response built with jsonencode. Because the response is served with a text/html Content-Type, the browser...

5.4CVSS6AI score0.00228EPSS
SaveExploits0References4Affected Software1
Rows per page
Query Builder