1163180 matches found
CVE-2026-66641: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in Video Conferencing with Zoom = 4.6.8 versions...
CVE-2025-9211: Improper Neutralization of Input During Web Page Generation
Unescaped stored values in application security page in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via persistent cross-site scripting...
PT-2026-77114
Name of the Vulnerable Software and Affected Versions Subscribe2 versions prior to 10.47 Description An unauthenticated Cross Site Scripting XSS issue exists in the Subscribe2 WordPress plugin. This flaw allows a remote attacker to execute malicious scripts in the browser of a user without...
PT-2026-78011
Name of the Vulnerable Software and Affected Versions Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 Description A flaw in the Endeca Application Controller component allows a low privileged attacker with network access via HTTP to compromise the system. The...
PT-2026-77222
Name of the Vulnerable Software and Affected Versions reportico-web versions prior to 8.1.1 Description A reflected cross-site scripting XSS issue allows remote attackers to execute arbitrary JavaScript in a user's web browser. This occurs when a malicious payload is included in the loadTemplate...
PT-2026-76924
Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in form templates. Attackers with form authoring privileges can inject arbitrary HTML and JavaScript that executes for all form visitors throug...
PT-2026-77098
Unauthenticated Cross Site Scripting XSS in Chaty Pro = 3.5.8 versions...
PT-2026-77107
Unauthenticated Cross Site Scripting XSS in Contact Form by Supsystic 1.10.0 versions...
PT-2026-77097
Subscriber Cross Site Scripting XSS in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent = 4.3.9 versions...
PT-2026-78245
Name of the Vulnerable Software and Affected Versions PublishPress Series versions prior to 2.17.1 Description Improper neutralization of input during web page generation allows for Stored Cross-site Scripting XSS, a flaw where malicious scripts are permanently stored on the target server and lat...
PT-2026-77083
Name of the Vulnerable Software and Affected Versions WPDM – Premium Packages versions prior to 7.0.6 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication...
PT-2026-78013
Name of the Vulnerable Software and Affected Versions Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 Description A flaw in the Workbench component allows a low-privileged attacker with network access via HTTP to compromise the system. The exploitation requires...
PT-2026-77805
Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Scripting versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of the Oracle Scripting product. An unauthenticated attacker with network access via HTTP can compromise...
PT-2026-76885
A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument first name/last name causes basic cross site scripting. It is possible to...
CVE-2026-68565: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in GeoDirectory = 2.8.172 versions...
CVE-2026-73351: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.1 versions...
CVE-2026-73342: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in WP Multilang = 2.4.31 versions...
CVE-2026-74902: Improper Neutralization of Input During Web Page Generation
SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML. Attackers can craft a malicious filename containing script payloads that execute with full OS command access...