1135429 matches found
CVE-2025-51684
CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting XSS. The application does not sanitize untrusted data received via window.postMessage before injecting it into the page DOM. An attacker can craft a malicious message that, when processed by renderCustomHtml, results in execution of...
PT-2026-66449
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the datastore upload function...
PT-2026-66116
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.72 Description An inappropriate implementation in CSS allows a remote attacker to perform Universal Cross-Site Scripting UXSS, which is a vulnerability that enables the execution of arbitrary scripts ...
EUVD-2025-210559
code-projects Blood System 1.0 is vulnerable to Cross Site Scripting XSS in /don.php via the city field...
PT-2026-66628
Name of the Vulnerable Software and Affected Versions OpenClaw Dashboard affected versions not specified Description A stored cross-site scripting issue exists that allows unauthenticated remote attackers to execute arbitrary JavaScript in an administrator's browser session. This occurs when HTML...
PT-2026-66477
Name of the Vulnerable Software and Affected Versions IBM Sterling B2B Integrator versions 6.1.2.0 through 6.1.2.7 2 IBM Sterling B2B Integrator versions 6.2.0.0 through 6.2.0.5 2 IBM Sterling B2B Integrator versions 6.2.1.0 through 6.2.1.1 2 IBM Sterling B2B Integrator versions 6.2.2.0 through...
PT-2026-66448
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the custom attributes function...
PT-2026-66164
Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...
PT-2026-66197
Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...
CVE-2025-65337
Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting XSS in pageEditMember.php via the address field...
CVE-2026-3093
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an attacker to execute arbitrary JavaScript in another user's browser via a crafted URL, due to improper...
EUVD-2026-50486
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an attacker to execute arbitrary JavaScript in another user's browser via a crafted URL, due to improper...
CVE-2026-3093
GitLab CE/EE contains a Cross-site Scripting (XSS) flaw (CVE-2026-3093) caused by improper sanitization of user-controlled input during web page generation. Affected versions are 14.0 up to 19.0.4, 19.1 up to 19.1.2, and 19.2 up to 19.2.0. Under certain conditions, an attacker could trigger arbit...
CVE-2026-3093 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an attacker to execute arbitrary JavaScript in another user's browser via a crafted URL, due to improper...
CVE-2026-54705 mathlive's Lack of Escaping of HTML allows for XSS
MathLive provides web components for math display and input. Prior to 0.110.0, MathLive fails to escape text-mode content in \text and \mbox commands in Box.toMarkup at src/core/box.ts, in xmlEscape, scanText, and text-mode output in src/formats/atom-to-math-ml.ts, and through convertLatexToMarku...
CVE-2026-54705 mathlive's Lack of Escaping of HTML allows for XSS
MathLive provides web components for math display and input. Prior to 0.110.0, MathLive fails to escape text-mode content in \text and \mbox commands in Box.toMarkup at src/core/box.ts, in xmlEscape, scanText, and text-mode output in src/formats/atom-to-math-ml.ts, and through convertLatexToMarku...
EUVD-2026-50421
MathLive provides web components for math display and input. Prior to 0.110.0, MathLive fails to escape text-mode content in \text and \mbox commands in Box.toMarkup at src/core/box.ts, in xmlEscape, scanText, and text-mode output in src/formats/atom-to-math-ml.ts, and through convertLatexToMarku...
CVE-2026-54705
This CVE concerns MathLive web components (pre-0.110.0) where text-mode content in parts of Box.toMarkup (src/core/box.ts), xmlEscape, scanText, and text-mode output in src/formats/atom-to-math-ml.ts, as well as through convertLatexToMarkup, convertLatexToMathMl, , , and the default identity Math...