CVE-2025-51863

CVE-2025-51863 Descripción de la vulnerabilidad ChatGPTUtil es un asistente de chatbot impulsado por IA, que proporciona acceso tanto a ChatGPT como a un generador de imágenes de IA. Existe una vulnerabilidad de Cross-Site Scripting propio Self-XSS en el componente de chat. Esto puede conducir al...

CVE-2025-51858

CVE-2025-51858 Descripción de la vulnerabilidad ChatPlayground.ai es una aplicación web popular para comparar modelos de IA. Existe una vulnerabilidad de Cross-Site Scripting XSS en el componente de chat. Esto puede llevar al robo de tokens JWT y al secuestro remoto de cuentas. Además, el endpoin...

CVE-2023-30943

CVE-2023-30943Moodle self-xss Descargo de responsabilidad Todo el contenido se proporciona "tal cual", sin ninguna garantía, explícita o implícita. Los autores no se hacen responsables de ningún daño, directo o indirecto, que pueda surgir del uso de la información o el software asociado con este...

GO-2026-6446 LF Edge eKuiper: Self-XSS in External Service Creation in github.com/lf-edge/ekuiper

LF Edge eKuiper: Self-XSS in External Service Creation in github.com/lf-edge/ekuiper...

CVE-2026-55650

Outerbase Studio is a lightweight browser-based database GUI supporting PostgreSQL, MySQL, and SQLite. In version 0.10.2 and earlier, TextComponent in src/components/chart/index.tsx renders unsanitized Text Widget content through dangerouslySetInnerHTML, allowing injected markup with script-capab...

EUVD-2026-78591

Outerbase Studio is a lightweight browser-based database GUI supporting PostgreSQL, MySQL, and SQLite. In version 0.10.2 and earlier, TextComponent in src/components/chart/index.tsx renders unsanitized Text Widget content through dangerouslySetInnerHTML, allowing injected markup with script-capab...

CVE-2026-55650 Outerbase Studio: Stored XSS in Text Widget Leads to Authentication Token Exposure

Outerbase Studio is a lightweight browser-based database GUI supporting PostgreSQL, MySQL, and SQLite. In version 0.10.2 and earlier, TextComponent in src/components/chart/index.tsx renders unsanitized Text Widget content through dangerouslySetInnerHTML, allowing injected markup with script-capab...

CVE-2026-55650 Outerbase Studio: Stored XSS in Text Widget Leads to Authentication Token Exposure

Outerbase Studio is a lightweight browser-based database GUI supporting PostgreSQL, MySQL, and SQLite. In version 0.10.2 and earlier, TextComponent in src/components/chart/index.tsx renders unsanitized Text Widget content through dangerouslySetInnerHTML, allowing injected markup with script-capab...

CVE-2026-55650

Outerbase Studio (a browser-based GUI for PostgreSQL, MySQL, and SQLite) versions 0.10.2 and earlier contain a Stored XSS in the Text Widget component (src/components/chart/index.tsx). Unsanitized HTML is rendered via dangerouslySetInnerHTML, allowing injected markup with script-capable event han...

CVE-2026-55650 Outerbase Studio: Stored XSS in Text Widget Leads to Authentication Token Exposure

Outerbase Studio is a lightweight browser-based database GUI supporting PostgreSQL, MySQL, and SQLite. In version 0.10.2 and earlier, TextComponent in src/components/chart/index.tsx renders unsanitized Text Widget content through dangerouslySetInnerHTML, allowing injected markup with script-capab...

CVE-2026-55650: Improper Neutralization of Input During Web Page Generation

Outerbase Studio is a lightweight browser-based database GUI supporting PostgreSQL, MySQL, and SQLite. In version 0.10.2 and earlier, TextComponent in src/components/chart/index.tsx renders unsanitized Text Widget content through dangerouslySetInnerHTML, allowing injected markup with script-capab...

LF Edge eKuiper: Self-XSS in External Service Creation

Summary A Cross-Site Scripting XSS vulnerability in external service creation allows an authenticated attacker to inject HTML/script payloads into external service names, which may execute in a user's browser when rendered by administrative web interfaces. Details Prior to v2.4.0, external servic...

Open WebUI has stored XSS via the HTML renedering view

SummaryThrough the HTML rendering view, scripts can be injected and executed. The finding resulted from a penetration test for a customer. It is suspected that the root cause of the issue lies within the core of Open WebUI, which is why it is being reported as a security issue here. Tested on Ope...

PYSEC-2026-2535 JupyterLab vulnerable to SXSS in Markdown Preview

Impact The vulnerability depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature. A malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user...

PT-2026-59348

Summary Through the HTML rendering view, scripts can be injected and executed. The finding resulted from a penetration test for a customer. It is suspected that the root cause of the issue lies within the core of Open WebUI, which is why it is being reported as a security issue here. Tested on Op...

CVE-2026-4765: Improper Neutralization of Input During Web Page Generation

Self Cross-Site Scripting Self-XSS vulnerability in the RD Station Conversas chat feature. The vulnerability lies in the ‘name’ parameter of the initialisation process due to incorrect sanitisation of user-supplied input. Exploitation allows specially crafted JavaScript code to be injected, which...

CVE-2026-42086

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to version 7.0.0, the Command Sender UI uses an unsafe eval function on array-like command parameters, which allows a user-supplied payload to execute in the browser when...

PYSEC-2026-105

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to version 7.0.0, the Command Sender UI uses an unsafe eval function on array-like command parameters, which allows a user-supplied payload to execute in the browser when...

CVE-2026-42086

OpenC3 COSMOS is affected by a Self-XSS in the Command Sender UI prior to version 7.0.0, caused by an unsafe eval() on array-like command parameters. A user-supplied payload could execute in the victim’s browser when sending a command, potentially allowing an attacker to read or modify data in th...

CVE-2026-42086 OpenC3 COSMOS: Self-XSS in the Command Sender

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to version 7.0.0, the Command Sender UI uses an unsafe eval function on array-like command parameters, which allows a user-supplied payload to execute in the browser when...