1136157 matches found
Filament: Disabled RichEditor field state can be used for XSS
In Filament v3, a disabled RichEditor field rendered its raw state without sanitizing HTML. Where the data stored in this field's state isn't sanitized already when the form state was filled, an attacker could plant malicious HTML or JavaScript and achieve XSS that executes for users who view the...
GHSA-52MM-H59V-F3C7 earmark: Stored XSS via unescaped HTML attribute values
Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values. 'Elixir.Earmark.Transform':makeatt1/2 in lib/earmark/transform.ex splices attribute values verbatim between two literal " bytes: ...
EUVD-2025-210251
Unauthenticated Cross Site Scripting XSS in Avante 3.0.5 versions...
EUVD-2025-210260
Unauthenticated Cross Site Scripting XSS in SweetDate Core 1.1.5 versions...
EUVD-2026-37635
Unauthenticated Cross Site Scripting XSS in Popup box = 6.2.9 versions...
EUVD-2026-37636
Unauthenticated Cross Site Scripting XSS in JetFormBuilder = 3.6.0.1 versions...
EUVD-2026-37633
Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.10 versions...
EUVD-2026-37634
Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.10 versions...
EUVD-2026-37624
Unauthenticated Cross Site Scripting XSS in WPFunnels Pro = 2.9.4 versions...
EUVD-2026-37616
Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.9.1 versions...
EUVD-2026-37606
Unauthenticated Cross Site Scripting XSS in Kapee 1.7.1 versions...
EUVD-2026-37608
Unauthenticated Cross Site Scripting XSS in Profile Builder Pro = 3.15.0 versions...
EUVD-2026-37603
Unauthenticated Cross Site Scripting XSS in collectchat = 2.4.9 versions...
EUVD-2026-37590
Unauthenticated Cross Site Scripting XSS in WPZOOM Addons for Elementor = 1.3.4 versions...
EUVD-2026-37577
An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat in this case, registration action IS required who has the vulnerable software could, introduce arbitrary JavaScript by injecting a Cross-site Scripting XSS payload into the 'Hostname' field of the configuration...
EUVD-2026-37652
Unauthenticated Cross Site Scripting XSS in Skillate = 1.2.10 versions...
EUVD-2026-37651
Unauthenticated Cross Site Scripting XSS in Auto Repair = 22.6 versions...
EUVD-2026-37659
Unauthenticated Cross Site Scripting XSS in WPJobster = 6.3.5 versions...