CVE-2026-3008

CVE-2026-3008 — Notepad++ 8.9.3 Format String Injection via nativeLang.xml Vulnerability When a search operation produces results, sub1400916C0 formats a hit count label by retrieving a localized string from nativeLang.xml and passing it directly as the format string to wsprintfW: root@kitploit:...

bing-ip2hosts

Bing-ip2hosts Bing-ip2hosts is a Bing.com web scraper to discover hostnames by IP address. Description Bing-ip2hosts is a Bing.com web scraper that discovers hostnames by IP address. Bing is the flagship Microsoft search engine formerly known as MSN Search and Live Search. It provides a feature...

CVE-2026-87813

SiYuan before v3.8.2 is affected by a stored cross-site scripting (XSS) vulnerability in the Search Assets result list , where asset filenames are interpolated into HTML without proper escaping. An authenticated attacker can craft asset filenames containing malicious markup that executes JavaScri...

CVE-2026-85982

The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting XSS issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on...

CVE-2026-85982

The Auth0 AD/LDAP Connector is affected by a stored Cross-Site Scripting (XSS) vulnerability caused by improper HTML encoding in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes—or a low-privileged local user...

CVE-2026-85982 Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector

The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting XSS issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on...

liferay-xss-7.2.1GA2-poc-report-CVE-2020-7934

Authenticated Stored XSS in LifeRay 7.2.1 GA2 via MyAccountPortlet executed by Search Results In LifeRay version 7.1.0 through 7.2.1 GA2 the First Name, Middle Name, and Last Name fields for user accounts are all vulnerable to a Stored XSS issue. Any user can modify these fields with a particular...

CVE-2026-53529

LeafWiki is a self-hosted wiki application. Prior to version 0.10.2 , a stored XSS vulnerability existed in the search functionality: page titles returned by the search API were rendered as raw HTML in the frontend via dangerouslySetInnerHTML in the highlight() function. A user with editor or adm...

CVE-2026-53529 LeafWiki vulnerable to stored XSS via search-result title (highlight() returns raw title into dangerouslySetInnerHTML)

LeafWiki is a self-hosted wiki. Prior to version 0.10.2, page titles returned by the search API could be rendered as raw HTML in the frontend. A user with editor or administrator permissions could create or modify a page title containing an HTML/JavaScript payload. When another user searched for ...

CVE-2026-53529 LeafWiki vulnerable to stored XSS via search-result title (highlight() returns raw title into dangerouslySetInnerHTML)

LeafWiki is a self-hosted wiki. Prior to version 0.10.2, page titles returned by the search API could be rendered as raw HTML in the frontend. A user with editor or administrator permissions could create or modify a page title containing an HTML/JavaScript payload. When another user searched for ...

CVE-2026-44230 RT: Reflected Cross-Site Scripting in search results chart

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to but not including 5.0.10, and 6.0.0 up to but not including 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability where an attacker who can induce an authenticated RT user to visit a crafted U...

CVE-2026-44230 RT: Reflected Cross-Site Scripting in search results chart

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to but not including 5.0.10, and 6.0.0 up to but not including 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability where an attacker who can induce an authenticated RT user to visit a crafted U...

CVE-2026-44230

RT (Request Tracker) contains a reflected Cross‑Site Scripting (XSS) vulnerability in search results/chart rendering. Versions 5.0.4 up to but not including 5.0.10, and 6.0.0 up to but not including 6.0.3 are affected if an authenticated user is induced to visit a crafted URL, enabling arbitrary ...

CVE-2026-44230 RT: Reflected Cross-Site Scripting in search results chart

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to but not including 5.0.10, and 6.0.0 up to but not including 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability where an attacker who can induce an authenticated RT user to visit a crafted U...

EUVD-2026-45876

The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not sanitize or escape Google review content fetched from the Serp API before rendering it in the Google Reviews widget output, allowing unauthenticated attackers who submit a malicious review on the targeted business's Goog...

PYSEC-2026-730 Plone Cross-site Scripting vulnerability in the LiveSearch module

Cross-site scripting XSS vulnerability in the LiveSearch module in Plone before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the Description field for search results, as demonstrated using the onerror Javascript even in an IMG tag...

CVE-2017-20266

Joomla SP Movie Database 1.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the searchword parameter. Attackers can send GET requests to the searchresults view with crafted SQL payloads in the...

EUVD-2026-36511

Typesense is a fast, typo-tolerant search engine. Prior to versions 29.1 and 30.2, there is a cache isolation issue affecting search requests that use both server-side search result caching and Scoped Search API Keys. Under specific request ordering, cached search results could be reused across...

CVE-2026-47225 Improper Search Cache Isolation for Scoped Search API Keys in Typesense

Typesense is a fast, typo-tolerant search engine. Prior to versions 29.1 and 30.2, there is a cache isolation issue affecting search requests that use both server-side search result caching and Scoped Search API Keys. Under specific request ordering, cached search results could be reused across...

CVE-2026-28511

CVE-2026-28511 affects eLabFTW. Before version 5.4.2, an authenticated user performing a numeric reference/search could receive results that include resources the user is not authorized to view. The exposed data is limited to resource titles; attempts to access the underlying protected content re...