1162847 matches found
CVE-2026-34491
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting. This issue affects Metasys 14: before 14.1.5; Metasys 15: before 15.0.1...
EUVD-2026-65005
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting. This issue affects Metasys 14: before 14.1.5; Metasys 15: before 15.0.1...
CVE-2026-34491
A persistent cross-site scripting (XSS) vulnerability in the web interface of Johnson Controls Metasys (a building management system) allows a low-privilege user to inject a malicious payload via a crafted URL. The payload persists across logins and executes in the browser context of other users,...
CVE-2026-34491
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting. This issue affects Metasys 14: before 14.1.5; Metasys 15: before 15.0.1...
CVE-2026-34491
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting. This issue affects Metasys 14: before 14.1.5; Metasys 15: before 15.0.1...
CVE-2026-78414 Cross-site scripting in Nx Witness VMS Web Administration allows session token exfiltration via a rogue peer site name
Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...
CVE-2026-78414
A cross-site scripting (XSS) vulnerability exists in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 (Linux, Windows, macOS). An adjacent-network attacker who controls a rogue Nx server on the same network segment can set that server's site name to a script p...
CVE-2026-78414 Cross-site scripting in Nx Witness VMS Web Administration allows session token exfiltration via a rogue peer site name
Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...
EUVD-2026-64898
Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...
Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server, which impacts IBM Tivoli Netcool Configuration Manager
Summary IBM WebSphere Application Server is a required product for IBM Tivoli Netcool Configuration Manager version 6.4.2. Multiple vulnerabilities were addressed in IBM WebSphere Application Server. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...
CVE-2026-78391
RansomLook contains a stored cross-site scripting XSS vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored without sufficient validation and later...
WordPress Toolset Blocks plugin <= 1.6.26 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Toolset Blocks versions = 1.6.26...
WordPress Stripe Payments plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Stripe Payments versions = 2.1.2...
WordPress Event Tickets plugin <= 5.29.2.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Udin Chan in WordPress Plugin Event Tickets versions = 5.29.2.1...
CVE-2026-78290
Contributor Cross Site Scripting XSS in Magazine Blocks = 1.8.6 versions...
CVE-2026-66623
Unauthenticated Cross Site Scripting XSS in Social Media & Share Icons = 2.9.9 versions...
CVE-2026-66610
Unauthenticated Cross Site Scripting XSS in Urna = 2.6.2 versions...
CVE-2026-66584
Unauthenticated Cross Site Scripting XSS in 12 Step Meeting List = 3.19.16 versions...