1137174 matches found
EUVD-2026-37511
Remark42: Cross-Site Scripting XSS on /api/v1/img via content-type spoofing...
Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing
Summary The remark42 image proxy fetches an arbitrary remote URL and re-serves the response from remark42's own origin. The download path decides whether the fetched resource is an image by looking only at the Content-Type header the remote server claims — it never inspects the actual bytes. The...
CVE-2026-52781 OpenProject: Stored XSS on openproject.example.com through /api/v3/projects/{project}/work_packages via POST parameter "description"
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the HTML sanitizer grants elements unrestricted data- attributes via :data wildcard. An attacker injects data-controller="poll-for-changes" into a work package description, causing Stimulus.js to mount ...
CVE-2026-52781
OpenProject CVE-2026-52781 affects the open-source, web-based project management software. Prior to versions 17.3.3 and 17.4.1, the HTML sanitizer allowed elements to have unrestricted data-* attributes via a :data wildcard. An attacker could inject data-controller="poll-for-changes" into a work...
Security Bulletin: IBM Terracotta is affected by a Spring Framework vulnerability that could allow Cross-site Scripting attacks, Denial of Service (DoS) attacks, and Server-Side Request Forgery attacks
Summary IBM Terracotta uses Spring Framework as an application foundation within the product. Vulnerability Details CVEID:CVE-2026-41839 DESCRIPTION: A WebFlux application with a compromised subdomain for example, compromised via cross-site scripting XSS is vulnerable to an escalation attack...
EUVD-2025-210360
Contributor Cross Site Scripting XSS in Image Carousel = 1.0.0.41 versions...
EUVD-2025-210361
Contributor Cross Site Scripting XSS in BNE Testimonials = 2.0.8 versions...
CVE-2026-57656
Author Cross Site Scripting XSS in Hester Core = 1.1.8 versions...
CVE-2026-57651
Contributor Cross Site Scripting XSS in Ghost Kit = 3.6.0 versions...
CVE-2026-57650
Contributor Cross Site Scripting XSS in Magazine Blocks = 1.8.3 versions...
CVE-2026-57638
Contributor Cross Site Scripting XSS in Fluent Booking = 2.1.0 versions...
CVE-2026-57629
Contributor Cross Site Scripting XSS in StatCounter = 2.1.1 versions...
CVE-2026-57325
Unauthenticated Cross Site Scripting XSS in NanoMag = 1.8 versions...
CVE-2026-57618
Contributor Cross Site Scripting XSS in Neve PRO = 3.1.2 versions...
CVE-2026-57617
Contributor Cross Site Scripting XSS in SeedProd Pro 6.19.5 versions...
CVE-2026-57317
Unauthenticated Cross Site Scripting XSS in Simply Schedule Appointments = 1.6.12.2 versions...
CVE-2026-57322
Unauthenticated Cross Site Scripting XSS in weMail = 2.1.2 versions...
CVE-2026-57314
Unauthenticated Cross Site Scripting XSS in SureCart = 4.3.2 versions...