html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2025-14340

XSS до захвата учетной записи администратора CVE-2025-14340 Уязвимость межсайтового скриптинга XSS в интерфейсе управления REST Payara позволяет выполнять JavaScript, контролируемый злоумышленником, что приводит к захвату учетной записи администратора. Это происходит из-за: 1. Панель использует...

CVE-2026-10104-POC

CVE-2026-10104: Хранимая межсайтовая скриптовая уязвимость XSS в Product Video Gallery for WooCommerce Сводка...

CVE-2021-45744

CVE-2021-45744 Exploit Title: Bludit 3.13.1 - Хранимая межсайтовая подмена сценариев XSS в поле TAGS Автор эксплойта: SANU P.L CVE: CVE-2021-45744 CVSS: 5.4 СРЕДНИЙ Ссылки: https://www.plsanu.com/bludit-3-13-1-tags-field-stored-cross-site-scripting-xss...

CVE-2024-40507

CVE-2024-40507 Уязвимость межсайтового скриптинга в openPetra v.2023.02 через функцию serverMPersonnel.asmx. Описание : Неаутентифицированный пользователь может украсть файлы cookie у аутентифицированного пользователя, используя XSS в openPetra v.2023.02 через функцию serverMPersonnel.asmx...

CVE-2026-51565

CVE-2026-51565 CVE-2026-51565 보안 권고 설명 Milk admin =0.9.8의 Modules/Docs/DocsController.php에 있는 사이트 간 스크립팅XSS 취약점으로 인해 원격 공격자가 조작된 요청의 action 매개변수를 통해 임의의 웹 스크립트 또는 HTML을 주입할 수 있습니다. 완화 조치 게시 시점 기준으로 이 취약점에 대한 공식 패치는 제작자로부터 제공되지 않았으며, 제가 이를 보고한 지 5개월이 지났습니다. 업데이트된 버전이 출시될 때까지는 취약한 action 매개변수를 노린 악...

CVE-2023-46974

CVE-2023-46974 POC Описание Межсайтовый скриптинг XSS в Best Courier Management System v.1.000 позволяет удалённому злоумышленнику выполнить произвольный код через специальную полезную нагрузку в параметре page в URL. Тип уязвимости Межсайтовый скриптинг XSS Производитель продукта...

CVE-2026-90615

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /subject1.php. Such manipulation of the argument subject leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed...

CVE-2026-90615 SourceCodester Class and Exam Timetabling System subject1.php cross site scripting

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /subject1.php. Such manipulation of the argument subject leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed...

CVE-2026-90615

CVE-2026-90615 affects SourceCodester Class and Exam Timetabling System 1.0 . The vulnerability is a cross-site scripting (XSS) flaw in the file /subject1.php, triggered by manipulation of the subject argument. The attack is executable remotely and requires user interaction but no authentication....

CVE-2026-36226

CVE-2026-36226: Advantech WebAccess/SCADA Создание нового пользователя проекта XSS PoC Этот репозиторий содержит безвредное доказательство концепции для CVE-2026-36226, проблемы межсайтового скриптинга в Advantech WebAccess/SCADA 8.0-2015.08.16. Этот репозиторий предназначен только для...

EUVD-2026-77131

A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this vulnerability is the function renderHistory of the file ImageStudio.js of the component Studio Components. This manipulation causes cross site scripting. The attack may be initiated remotely. The...

CVE-2026-90604

A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. This affects an unknown part of the component Anchor Tag Handler. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and ma...

CVE-2025-63842

A Cross-Site Scripting XSS vulnerability in the web backend for the Repetico app 1.9.7.31 for Android allows a remote authenticated user to execute arbitrary JavaScript code in the app's context via crafted input in the multiple-choice question text field...

CVE-2023-28148

A bodyclass XSS issue was discovered in Paessler PRTG before 23.3.86.1520...

CVE-2023-28148

Paessler PRTG Network Monitoring is affected by a bodyclass Cross-Site Scripting (XSS) vulnerability in versions prior to 23.3.86.1520 . The vulnerability allows an attacker to inject scripts via the body class parameter, with a CVSS 3.1 score of 7.2 (HIGH) (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), ...

RHEL 9 : grafana-pcp (RHSA-2026:67160)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:67160 advisory. The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and...

PT-2026-91025

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /subject1.php. Such manipulation of the argument subject leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed...

PT-2026-91179

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Syncope. The notification message, as optionally shown by Console's and Enduser's login pages can be instructed to display HTML tags with unsafe JS inline, via malicious HTTP link generation...

CVE-2023-51769

Frappe before 14.49.0 is vulnerable to a Cross-Site Scripting (XSS) attack that affects blog pages and exception pages . The CVSS 3.1 score is 6.1 (MEDIUM) , with a network attack vector, low complexity, no privileges required, but user interaction required , and a changed scope leading to low im...