571 matches found
PT-2026-36880
Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS versions prior to 7.0.0 Description The Command Sender UI uses an unsafe eval function on array-like command parameters. This allows a user-supplied payload to execute in the browser when sending a command, creating a self-XSS...
OpenC3 COSMOS is Vulnerable to Self-XSS Through the Command Sender
Summary The Command Sender UI uses an unsafe eval function on array-like command parameters, which allows a user-supplied payload to execute in the browser when sending a command. This creates a self-XSS risk because an attacker can trigger their own script execution in the victim’s session, if...
PT-2026-34056
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the user dashboard's "Seen successful connections" login history renders the client IP from login logs without HTML escaping. Because the server trusts the X-Real-IP header as the source IP...
Novu has a XSS sanitization bypass
Summary XSS sanitization is incomplete, some attributes are missing such as oncontentvisibilityautostatechange=. This allows for the email preview to render HTML that executes arbitrary JavaScript, Details Sanitization is implemented here:...
PT-2026-41164
Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.6.5 Description Scripts can be injected and executed through the HTML rendering view. The frontend includes a function to visualize HTML content of a chat by embedding it in an iFrame. However, the use of the...
CVE-2026-28355
Canarytokens help track activity and actions on a network. Versions prior to sha-7ff0e12 have a Self Cross-Site Scripting vulnerability in the "PWA" Canarytoken, whereby the Canarytoken's creator can attack themselves or someone they share the link with. The creator of a PWA Canarytoken can inser...
CVE-2026-28355 "PWA" Canarytoken Vulnerable to Stored Self Cross-Site Scripting
Canarytokens help track activity and actions on a network. Versions prior to sha-7ff0e12 have a Self Cross-Site Scripting vulnerability in the "PWA" Canarytoken, whereby the Canarytoken's creator can attack themselves or someone they share the link with. The creator of a PWA Canarytoken can inser...
PT-2026-22402
Name of the Vulnerable Software and Affected Versions Canarytokens versions prior to sha-7ff0e12 Description The Canarytokens PWA Canarytoken has a Self Cross-Site Scripting issue. A Canarytoken creator can execute Javascript code by inserting it into the title field of their PWA token. This allo...
CVE-2018-12580
library/DBTech/Security/Action/Sessions.php in DragonByte vBSecurity 3.x through 3.3.0 for vBulletin 3 and vBulletin 4 allows self-XSS via $session'useragent' in the "Login Sessions" feature...
CVE-2021-31803
cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile SEC-581...
CVE-2016-10822
cPanel before 55.9999.141 allows self XSS in X3 Reseller Branding Images SEC-88...
CVE-2016-10813
cPanel before 57.9999.54 allows self XSS during ftp account creation under addon domains SEC-118...
CVE-2016-10781
cPanel before 60.0.25 allows self XSS in the UIconfirm API SEC-180...
CVE-2016-10774
cPanel before 60.0.25 allows self XSS in the tailea4migration.cgi interface SEC-172...
CVE-2017-18473
cPanel before 62.0.4 allows self XSS on the webmail Password and Security page SEC-199...
CVE-2017-18456
cPanel before 62.0.17 allows self XSS in the WHM cPAddons showsecurity interface SEC-217...
CVE-2019-20493
cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled SEC-520...
CVE-2020-10113
cPanel before 84.0.20 allows self XSS via a temporary character-set specification SEC-515...
CVE-2024-41663
Canarytokens help track activity and actions on a network. A Cross-Site Scripting vulnerability was identified in the "Cloned Website" Canarytoken, whereby the Canarytoken's creator can attack themselves. The creator of a slow-redirect Canarytoken can insert Javascript into the destination URL of...