1163224 matches found
CVE-2026-63361
LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding...
CVE-2026-66807
A flaw was found in console. The getCodeSpan helper in SharedResourceWarning.js constructs an HTML string using string concatenation without proper HTML encoding. This unescaped string is then rendered via React's dangerouslySetInnerHTML. While current Kubernetes DNS-1123 name validation prevents...
SUSE CVE-2026-73492
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references...
CVE-2026-63361
LimeSurvey Community Edition 7.0.5 is affected by an authenticated reflected XSS in the HTML editor popup endpoint. The vulnerability arises because the text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding, enabling ...
CVE-2026-73417
A flaw was found in JupyterLab. Improper validation of sideBySideLeftMarginOverride and sideBySideRightMarginOverride settings within the overrides.json file allows for cross-site scripting XSS. An attacker can exploit this by convincing a user to import a specially crafted settings file, or by...
MINI-CF7V-M64R-GPR2
Bulletin has no description...
CVE-2026-53472 Migration-planner: credentialurl validator accepts javascript: urls
A flaw was found in migration-planner. Insufficient validation of the AgentStatusUpdate.CredentialUrl field allows an authenticated attacker to store a malicious javascript: URL. When a victim views this URL in the Hybrid Cloud Console, it can lead to Cross-Site Scripting XSS, enabling script...
CVE-2026-53472
The CVE-2026-53472 issue affects the migration-planner component. Root cause: insufficient validation of AgentStatusUpdate.CredentialUrl allows an authenticated attacker to store a javascript: URL, which a victim can render in the Hybrid Cloud Console to trigger Cross-Site Scripting (XSS). Impact...
CVE-2026-53472 Migration-planner: credentialurl validator accepts javascript: urls
A flaw was found in migration-planner. Insufficient validation of the AgentStatusUpdate.CredentialUrl field allows an authenticated attacker to store a malicious javascript: URL. When a victim views this URL in the Hybrid Cloud Console, it can lead to Cross-Site Scripting XSS, enabling script...
CVE-2026-53472
A flaw was found in migration-planner. Insufficient validation of the AgentStatusUpdate.CredentialUrl field allows an authenticated attacker to store a malicious javascript: URL. When a victim views this URL in the Hybrid Cloud Console, it can lead to Cross-Site Scripting XSS, enabling script...
EUVD-2026-58664
A flaw was found in migration-planner. Insufficient validation of the AgentStatusUpdate.CredentialUrl field allows an authenticated attacker to store a malicious javascript: URL. When a victim views this URL in the Hybrid Cloud Console, it can lead to Cross-Site Scripting XSS, enabling script...
CVE-2026-72821
Grav Form plugin versions before 9.1.15 contain a stored cross-site scripting vulnerability in radio and toggle field option labels rendered with the Twig |raw filter. Attackers with form authoring permissions can inject HTML and script payloads in option labels that execute in the browsers of...
CVE-2026-72821 Grav Form Plugin before 9.1.15 Stored XSS via Radio Toggle
Grav Form plugin versions before 9.1.15 contain a stored cross-site scripting vulnerability in radio and toggle field option labels rendered with the Twig |raw filter. Attackers with form authoring permissions can inject HTML and script payloads in option labels that execute in the browsers of...
WordPress Quill Forms plugin <= 5.7.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Quill Forms versions = 5.7.1...
WordPress Site Reviews plugin <= 8.2.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Jorgson in WordPress Plugin Site Reviews versions = 8.2.0...
WordPress Templately plugin <= 3.7.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Templately versions = 3.7.1...
WordPress W3 Total Cache plugin <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name vulnerability
Unauthenticated Stored Cross-Site Scripting via Comment Author Name vulnerability discovered by daroo in WordPress Plugin W3 Total Cache versions = 2.10.3...
WordPress PPWP - Password Protect Pages plugin <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes vulnerability
WordPress PPWP - Password Protect Pages plugin = 1.9.21 - Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode Attributes vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin PPWP versions = 1.9.21...
WordPress Fluent Forms plugin <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values vulnerability
Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values vulnerability discovered by Adrien Brunner in WordPress Plugin FluentForm versions = 6.2.11...
