Fortinet FortiSIEM 6.4.x < 7.2.7 / 7.3.x < 7.3.5 / 7.4.x < 7.4.1 XSS (FG-IR-26-149)

The version of Fortinet FortiSIEM running on the remote host is 6.4.x through 7.2.x prior to 7.2.7, 7.3.x prior to 7.3.5, or 7.4.0. It is, therefore, affected by a cross-site scripting vulnerability: - An improper neutralization of script-related HTML tags in a web page basic XSS vulnerability in...

RabbitMQ 4.2.x < 4.2.5 XSS via x-internal-purpose Argument

The version of RabbitMQ installed on the remote host is 4.2.x prior to 4.2.5. It is, therefore, affected by a cross-site scripting vulnerability: - The RabbitMQ management UI renders the x-internal-purpose queue or exchange argument into an HTML title attribute without proper escaping on the Queu...

PT-2026-60701

Name of the Vulnerable Software and Affected Versions WooCommerce Placetopay Gateway and PlacetoPay/AvalPay gateway plugins for WordPress versions prior to 3.2.3 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site...

CVE-2026-51081

CVE-2026-51081 is an XSS vulnerability affecting Proxmox Virtual Environment (PVE) 9.x 5.1.8 and PVE 8.x 4.3.16. The issue allows attackers to inject and execute arbitrary web scripts or HTML via a crafted payload, enabling client-side code execution in affected web interfaces. The public documen...

PT-2026-60809

An unauthenticated reflected cross-site scripting XSS vulnerability exists in Sangoma Switchvox SMB Edition version 8.3 104997. The application fails to properly sanitize the portal parameter supplied to the invalid browser and invalid browser login handlers. User-supplied data is reflected into...

PT-2026-60784

The Joomla extension ChronoForms is vulnerable to an unauthenticated stored XSS vulnerability...

PT-2026-60717

Name of the Vulnerable Software and Affected Versions WP Hotel Booking versions prior to 2.3.3 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when an attacker tricks a user into clicking a link...

CVE-2026-51081

A cross-site scripting XSS vulnerability in Proxmox Virtual Environment PVE 9.x 5.1.8 and Proxmox Virtual Environment PVE 8.x 4.3.16 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload...

Security Updates for Microsoft SharePoint Server Subscription Edition (July 2026)

The Microsoft SharePoint Server Subscription Edition installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a...

Security Updates for Microsoft SharePoint Server 2019 (July 2026)

The Microsoft SharePoint Server 2019 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. CVE-2026-505...

SAP NetWeaver Enterprise Portal XSS (3746678)

The version of SAP NetWeaver Application Server Java detected on the remote host is affected by a cross-site scripting vulnerability as referenced in SAP Security Note 3746678: - SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. T...

CVE-2026-58643

Improper neutralization of input during web page generation 'cross-site scripting' in Windows Admin Center allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-62826

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

CVE-2026-44175

Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, Kirby did not securely sanitize the contents of the list field on save, leaving it vulnerable to cross-site scripting XSS. Kirby's list field stores its formatted content as HTML, and unlike other field types...

CVE-2026-45368 Kirby: Cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend

Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the underlying URL methods for the KirbyTags and image blocks components did not filter out malicious URL values that resolve to script execution. The vulnerability affects four first-party Kirby renderers th...

CVE-2026-45368

Kirby CMS is affected in versions prior to 4.9.1 and 5.4.1 by an XSS in URL handling for several first‑party renderers that emit : the (link: …) KirbyTag, the link parameter of (image: …), the image block's link field, and the HTML importer for blocks. The underlying issue does not filter dangero...

CVE-2026-45368 Kirby: Cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend

Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the underlying URL methods for the KirbyTags and image blocks components did not filter out malicious URL values that resolve to script execution. The vulnerability affects four first-party Kirby renderers th...

CVE-2026-44175

Kirby has a stored XSS vulnerability in the list field prior to versions 4.9.1 and 5.4.1 due to server-side sanitization on save not being applied (HTML in list field not escaped without breaking formatting). The content is stored as HTML and could be sent via Kirby’s API bypassing the Panel, the...

CVE-2026-44175 Kirby: Cross-site scripting (XSS) from list field content in the site frontend

Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, Kirby did not securely sanitize the contents of the list field on save, leaving it vulnerable to cross-site scripting XSS. Kirby's list field stores its formatted content as HTML, and unlike other field types...

CVE-2026-44175 Kirby: Cross-site scripting (XSS) from list field content in the site frontend

Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, Kirby did not securely sanitize the contents of the list field on save, leaving it vulnerable to cross-site scripting XSS. Kirby's list field stores its formatted content as HTML, and unlike other field types...