CVE-2026-105173

A cross-site scripting (XSS) vulnerability exists in code-projects Human Resource Management 1.0 . The flaw is located within the Event Creation component, specifically affecting an unknown part of the file /humanresourcemanagementsystem/src/store/EventStore.php. By manipulating the eventSubject ...

PT-2026-106027

A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulting in cross-site scripting XSS. Because the application does not validate the redirect destination before navigating, this flaw allows the execution of arbitrary script in the context of...

CVE-2026-105289: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialcharsdecode of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the component Create Customer Endpoint. Performing a manipulation of the argument customerformremark resul...

CVE-2026-105291: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function GroupController::index of the file App/Feelcrm/Index/Controller/GroupController.class.php of the component Department Search Endpoint. The manipulation of the argument keyword leads to cross...

EUVD-2026-92703

Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting XSS in the Organization name field...

PT-2026-104662

A flaw has been found in code-projects Human Resource Management 1.0. This affects an unknown part of the file /humanresourcemanagementsystem/src/store/EventStore.php of the component Event Creation. Executing a manipulation of the argument eventSubject can lead to cross site scripting. The attac...

PT-2026-106012

🚨 CVE-2026-102778 Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension 6.6.0 - The page a shared image link opens the share mini page of the front end can link the article the image was shared from when the option "Share artic...

PT-2026-106000

LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the update questio...

CVE-2026-95165: Undefined Security Weakness

Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting XSS in the Organization name field...

Debian dla-4823 : roundcube - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4823 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4823-1 [email protected]...

RHEL 7 : rhc-worker-script (RHSA-2026:75689)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:75689 advisory. Remote Host Configuration rhc worker for executing scripts on hosts managed by Red Hat Lightspeed. Security Fixes: encoding/asn1: golang: G...

AlmaLinux 9 : osbuild-composer (ALSA-2026:69293)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:69293 advisory. golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass CVE-2026-27136 golang.org/x/net/html:...

AlmaLinux 10 : osbuild-composer (ALSA-2026:66432)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:66432 advisory. golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39821...

CVE-2002-0346

CVE-2002-0346 Cobalt RAQ 4 のクロスサイトスクリプティングの脆弱性により、リモートの攻撃者が 1 service.cgi または 2 alert.cgi への URL 内の JavaScript を介して、他の Cobalt ユーザーとして任意のスクリプトを実行できる可能性があります。 Packetstorm 公開: https://packetstormsecurity.com/files/25837/Colbalt-RAQ-v4.txt.html SecurityFocus 公開: https://www.securityfocus.com/bid/4211...

CVE-2023-50465

MonicaHQ XSS MonicaHQ XSS の悪用 アカウントを作成する 連絡先を作成する Documents で悪意のある SVG ファイルをアップロードする alert"Monicahq XSS Poc"; アップロードしたファイルにアクセスする...

CVE-2024-33209

CVE-2024-33209 FlatPress 1.3は、クロスサイトスクリプティング（XSS）に対して脆弱です。攻撃者は「Add New Entry」セクションに悪意のあるJavaScriptコードを注入することができ、被害者のウェブブラウザのコンテキストで任意のコードを実行できるようになります。 脆弱性の種類: クロスサイトスクリプティング（XSS） 製品ベンダー : flatpress CMS 影響を受ける製品コードベース : Flatpress v1.3 - FlatPressバージョン1.3で修正される予定です。 影響を受けるコンポーネント 管理パネルの「Add New...

CVE-2023-29489

CVE-2023-29489 exploit このスクリプトはCVE-2023-29489（XSS脆弱性）を利用して多くのウェブサイトを攻撃できます 使用方法 python3 CVE-2023-29489.py list.txt 私のチャンネル :...

cve-2019-10070-apache-atlas-xss

このリポジトリには README がありません。...

CVE-2023-49540

CVE-2023-49540 Book Store Management System v1.0 - /index.php/history にクロスサイトスクリプティング（XSS）の脆弱性 - 脆弱なフィールド: "顧客名" 説明 : Book Store Management System v1.0 に、/bsmsci/index.php/history にクロスサイトスクリプティング（XSS）の脆弱性が含まれていることが発見されました。ペイロードは /bsmsci/index.php/transaction...

CVE-2023-49984

CVE-2023-49984 School Fees Management System v1.0 - 「/management/settings」の「name」フィールド/パラメータにおけるクロスサイトスクリプティング（XSS）脆弱性 説明 : School Fees Management System v1.0 の「/management/settings」コンポーネントにおけるクロスサイトスクリプティング（XSS）の脆弱性により、攻撃者が name パラメータに注入した細工されたペイロードを介して、任意の Web スクリプトまたは HTML を実行できる可能性があります。...