1162507 matches found
CVE-2026-90502: Improper Neutralization of Input During Web Page Generation
A vulnerability was detected in stilleshan ServerStatus 1.0/2.0. Impacted is an unknown function of the file server/src/main.cpp of the component Stats Generation. Performing a manipulation of the argument custom results in cross site scripting. It is possible to initiate the attack remotely. The...
CVE-2026-90529: Improper Neutralization of Input During Web Page Generation
A vulnerability has been found in DataEase up to 2.10.25/2.10.26. Affected by this issue is the function buildTooltip of the file core/core-frontend/src/views/chart/components/js/panel/charts/map/symbolic-map.ts of the component Symbolic Map. Such manipulation of the argument...
PT-2026-90789
Name of the Vulnerable Software and Affected Versions Fengoffice Feng Office versions prior to 3.11.13.12 Description A remote cross site scripting issue exists in the Task Title Output component. The problem occurs within the getTitle function located in the application/views/task/add task.php...
PT-2026-90872
A security vulnerability has been detected in quequnlong shiyi-blog up to 1.2.1. Affected by this issue is the function highlightKeyword of the file blog-web/src/components/Search/index.vue of the component Search. The manipulation of the argument title/summary leads to cross site scripting. The...
PT-2026-90875
A vulnerability has been found in linlinjava litemall 1.4.0/1.5.0/1.6.0/1.7.0/1.8.0. This issue affects the function AdminGoodsService.validate of the file litemall-vue/src/views/items/detail/index.vue of the component Product Detail. Such manipulation of the argument detail leads to cross site...
CVE-2026-90570: Improper Neutralization of Input During Web Page Generation
A vulnerability has been found in linlinjava litemall 1.4.0/1.5.0/1.6.0/1.7.0/1.8.0. This issue affects the function AdminGoodsService.validate of the file litemall-vue/src/views/items/detail/index.vue of the component Product Detail. Such manipulation of the argument detail leads to cross site...
CVE-2026-90497: Improper Neutralization of Input During Web Page Generation
A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11. Affected by this vulnerability is the function getTitle of the file application/views/task/addtask.php of the component Task Title Output. Executing a manipulation of the argument ogobjects.name can lead to cross site...
PT-2026-90989
A Cross-Site Scripting XSS vulnerability in the web backend for the Repetico app 1.9.7.31 for Android allows a remote authenticated user to execute arbitrary JavaScript code in the app's context via crafted input in the multiple-choice question text field...
CVE-2025-63842
CVE-2025-63842 is a Cross-Site Scripting (XSS) vulnerability in the web backend of the Repetico app 1.9.7.31 for Android . A remote authenticated user can execute arbitrary JavaScript in the app's context by supplying crafted input in the multiple-choice question text field . The CVSS 3.1 score i...
PT-2026-90986
A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this vulnerability is the function renderHistory of the file ImageStudio.js of the component Studio Components. This manipulation causes cross site scripting. The attack may be initiated remotely. The...
CVE-2026-90489 Xuxueli xxl-job insert cross site scripting
A vulnerability was identified in Xuxueli xxl-job up to 3.5.0. This vulnerability affects unknown code of the file /jobinfo/insert. Such manipulation of the argument name/author leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used...
CVE-2026-90489
Xuxueli xxl-job up to 3.5.0 contains a cross-site scripting (XSS) vulnerability in the /jobinfo/insert endpoint. Manipulating the name or author arguments allows remote attackers with low privileges (requiring user interaction) to inject client-side scripts. The CVSS 3.1 base score is 3.5 (LOW) ,...
WordPress Custom Menu Wizard Widget plugin <= 3.3.1 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin Custom Menu Wizard Widget versions = 3.3.1...
PT-2026-90729
Name of the Vulnerable Software and Affected Versions Xuxueli xxl-job versions prior to 3.5.1 Description A remote cross site scripting issue exists in the /jobinfo/insert endpoint. This occurs when the name or author variables are manipulated, allowing an attacker to execute malicious scripts in...
CVE-2026-83532: Improper Neutralization of Input During Web Page Generation
The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed...
web-vulnerabilities-demo
Web Security — Five Common Vulnerabilities A hands-on project...
CVE-2026-81918 Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block
Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A user with editpagecontents permissions could store a payload which executes in the browser of any visitor who viewed a page where the block was configured to display a date-type...
CVE-2026-77490
Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...
CVE-2026-77490
CVE-2026-77490 affects Microsoft Edge (Chromium-based) due to improper neutralization of input during web page generation, i.e., a cross-site scripting (XSS) flaw. An unauthorized attacker can leverage this over a network to perform spoofing . The CVSS 3.1 score is 6.1 (Medium) with a vector of A...
