CVE-2026-19904

A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file /admin/index.php?page=sitesettings of the component System Settings Module. The manipulation results in cross site scripting. The attack can be executed remotely. The...

EUVD-2026-59783

A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file /admin/index.php?page=sitesettings of the component System Settings Module. The manipulation results in cross site scripting. The attack can be executed remotely. The...

MINI-JQGP-JMM7-RVVQ

Bulletin has no description...

CVE-2026-14230

The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers gated only by a capability-agnostic nonce that any editposts user obtains from the Elementor editor, so a Contributor can write a data-source binding into any post —...

CVE-2026-14433

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'businessid' parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-73057

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description A cross-site scripting issue exists in the unicode2Emoji function due to a failure to sanitize codepoint branch output. This allows attackers to create document icons containing hex-encoded markup. Wh...

PT-2026-73055

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Stored cross-site scripting is possible due to a failure to validate or escape the color field in attribute-view select options across eight unescaped render sites. An attacker can inject event-handle...

CVE-2026-19904: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file /admin/index.php?page=sitesettings of the component System Settings Module. The manipulation results in cross site scripting. The attack can be executed remotely. The...

CVE-2026-73053: Improper Neutralization of Input During Web Page Generation

SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attackers can craft document icons with hex-encoded markup that executes in the renderer with Node integration enabled, achieving arbitrary code...

PT-2026-73044

Name of the Vulnerable Software and Affected Versions SourceCodester Online Book Store System version 1.0 Description Cross site scripting occurs in the System Settings Module within the file '/admin/index.php?page=site settings'. This issue allows a remote attacker to execute malicious scripts...

PT-2026-73061

Name of the Vulnerable Software and Affected Versions code-projects Online Food Order System version 1.0 Description An issue exists in the edit food items.php file where manipulating the dname argument allows for cross-site scripting XSS, a technique used to inject malicious scripts into web pag...

CVE-2026-19916: Improper Neutralization of Input During Web Page Generation

A vulnerability was detected in code-projects Online Food Order System 1.0. The affected element is an unknown function of the file editfooditems.php. Performing a manipulation of the argument dname results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now...

CVE-2026-17209

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting...

CVE-2026-17209 IBM Db2 Mirror for i is affected by multiple vulnerabilities

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting...

CVE-2026-17209

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting...

CVE-2026-17209

IBM Db2 Mirror for i 7.4–7.6 is affected by CVE-2026-17209: the GUI could be exploited by a remote authenticated attacker to execute arbitrary scripts via cross-site scripting. This aligns with the IBM bulletin listing multiple vulnerabilities in Db2 Mirror for i; the CVSS base score is 6.3 (Medi...

CVE-2026-17209 IBM Db2 Mirror for i is affected by multiple vulnerabilities

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting...

EUVD-2026-58767

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting...

CVE-2026-63361

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding...

CVE-2026-66807

A flaw was found in console. The getCodeSpan helper in SharedResourceWarning.js constructs an HTML string using string concatenation without proper HTML encoding. This unescaped string is then rendered via React's dangerouslySetInnerHTML. While current Kubernetes DNS-1123 name validation prevents...