PT-2026-79753

A vulnerability has been found in SourceCodester Stock Management System 1.0. This vulnerability affects unknown code of the file /php action/printOrder.php. Such manipulation of the argument clientName/clientContact leads to cross site scripting. The attack may be performed from remote. The...

CVE-2026-7808: Improper Input Validation

justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content e.g., script or style to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usage rather than the default JustHTML..., sanitize=Tru...

PT-2026-79776

justhtml versions are preserved, so untrusted input that is safe in to html — including entity-decoded text e.g. script or text from RCDATA/RAWTEXT-parsed elements like , , , and — can be emitted as raw HTML in the Markdown output, enabling a sanitizer bypass and potential cross-site scripting wh...

CVE-2026-77088: Improper Neutralization of Input During Web Page Generation

justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in tomarkdown where inline code spans fail to account for blank lines as block boundaries. Attackers can inject blank lines into code or pre element text to break the inline span, causing sanitized HTML to be...

PT-2026-79775

Name of the Vulnerable Software and Affected Versions justhtml versions prior to 1.16.0 Description Multiple HTML sanitization bypass issues allow active or dangerous content, such as script or style tags, to survive the sanitization process, potentially leading to cross-site scripting. These...

xss-lab

XSS Practice Lab A small local web security lab demonstrating...

dompurify: DOMPurify: Sanitization bypass via hook manipulation

A flaw was found in DOMPurify. An attacker can exploit a vulnerability in how DOMPurify handles its sanitization hooks when default configurations are used. By manipulating the uponSanitizeElement or uponSanitizeAttribute hooks, an attacker can permanently alter the allowed HTML tags and...

dompurify: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName

A flaw was found in DOMPurify. This cross-site scripting XSS vulnerability exists in INPLACE mode, where the software trusts attacker-controlled nodeName on live non-form nodes. A remote attacker can supply hostile live Document Object Model DOM objects with script children. These scripts can...

dompurify: DOMPurify: Cross-Site Scripting vulnerability allows arbitrary code execution

A flaw was found in DOMPurify. This vulnerability, a type of Cross-Site Scripting XSS, occurs when HTML that has been sanitized is reinserted into specific parsing contexts using innerHTML with certain HTML elements like script or iframe. An attacker can craft malicious input that, during...

DOMPurify: DOMPurify: Cross-site scripting due to state leakage in sanitization.

A flaw was found in DOMPurify. This vulnerability allows a remote attacker to perform cross-site scripting XSS by exploiting a state leakage issue. Specifically, function predicates used for adding attributes or tags during sanitization can persist across multiple calls to the sanitize function...

dompurify: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName

A flaw was found in DOMPurify. This cross-site scripting XSS vulnerability exists in INPLACE mode, where the software trusts attacker-controlled nodeName on live non-form nodes. A remote attacker can supply hostile live Document Object Model DOM objects with script children. These scripts can...

java-1.8.0-openjdk: Fix of 6 CVEs

Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u502-b07. That fixes following CVEs: - CVE-2026-46968: JSSE, remote high-complexity integrity flaw in TLS certificate handling - CVE-2026-47010: ImageIO, remote high-complexity low-impact integrity flaw in JPEG handling - CVE-2026-47021: 2D,...

xsslab

XSS Educational Learning Lab 🛡️ An interactive, educational w...

SUSE CVE-2026-77643

A cross-site scripting vulnerability in queryparser/termgeneratorinternal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet. NOTE: this issue exists because of a missed corner case of CVE-2018-0499...

CVE-2026-61824

Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping, and buildExtractorResponse returns this contentHtml without the main pipeline's...

CVE-2026-30890

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the synchro import script. This issue has been fixed in version 3.2.3...

CVE-2026-31880

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the universal search. This issue has been fixed in version 3.2.3...

CVE-2026-30826

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the testing OQL query functionality. This issue has been fixed in version 3.2.3...

Cross-site Scripting (XSS)

Overview yourls/yourls is an is a set of PHP scripts that allow you to run Your Own URL Shortener. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the processing of HTTP Referer headers in statistics chart rendering. An attacker can execute arbitrary JavaScript in...

NPM: Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors

NPM: Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors vulnerability discovered by ? in WordPress Npm defuddle versions = 0.19.0...