97543 matches found
CVE-2026-6184-stored-XSS
XSS Almacenado en el Título de Noticias - Sistema de Gestión de Contenidos Simple PHP Descripción Existe una vulnerabilidad de Cross-Site Scripting XSS Almacenado en el Sistema de Gestión de Contenidos Simple PHP. El campo Título de Noticias en el panel de administración no sanitiza la entrada de...
CVE-2026-10289-XSS
Sistema de Reservas de Hotel y Turismo - Cross-Site Scripting XSS Almacenado Detalles de la Vulnerabilidad...
CVE-2026-3228
CVE-2026-3228 - Escáner y Exploit de XSS Almacenado para el Plugin de WordPress NextScripts https://img.shields.io/badge/python-3.6+-blue.svg https://img.shields.io/badge/license-MIT-green https://img.shields.io/badge/WordPress-Plugin-red Autor: NULL200OK Una herramienta integral en Python para...
CVE-2024-33298
CVE-2024-33298 Vulnerabilidad de Cross Site Scripting almacenado en Microweber = 2.0.9 Resumen : Una vulnerabilidad de Cross Site Scripting almacenado en Microweber v.2.0.9 permite a un atacante remoto ejecutar código arbitrario mediante la función de crear nueva copia de seguridad en el endpoint...
CVE-2024-33297
CVE-2024-33297 Stored Cross Site Scripting vulnerability in Microweber = 2.0.9 Summary : A Stored Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the campaign Name Internal Name field in the "Add new campaign" function. Requirements ...
CVE-2024-33299
CVE-2024-33299 Vulnerabilidad de Cross Site Scripting almacenado en Microweber = 2.0.9 Resumen : Una vulnerabilidad de Cross Site Scripting almacenado en Microweber v.2.0.9 permite a un atacante remoto ejecutar código arbitrario a través de los parámetros Nombre y Apellido en el endpoint...
CVE-2026-2600-POC
CVE-2026-2600 ElementsKit Elementor Addons = 3.7.9 — Cross-Site Scripting Almacenado Autenticado Contributor+...
CVE-2026-30082
Vulnerabilidades de Cross-site Scripting XSS Almacenado en la función Editar de la página Lista de Paquetes de Software de IngEstate Server Versión afectada: IngEstate Server - 11.14.0 Función afectada API afectada: API afectada: PUT /emgui/rest/appDatasheet//?full=true HTTP/1.1 PoC Para explotar...
CVE-2025-61319
CVE-2025-61319: Stored XSS in ReNgine 2. After scan completion, open the Vulnerabilities tab in ReNgine and view results. 3. The payload executes in the admin's browser context. Affected versions ReNgine = 2.2.0 Remediation Sanitize and escape user-supplied input before rendering scan results...
CVE-2026-30048
CVE-2026-30048 - Cross-Site Scripting XSS Almacenado en NotChatbot WebChat = 1.5.0 Resumen Existe una vulnerabilidad de Cross-Site Scripting XSS almacenado en el paquete @developer.notchatbot/webchat en versiones hasta la 1.5.0 inclusive. La entrada proporcionada por el usuario no se sanitiza...
Kotaemon-CVE-2025-56526-56527-disclosure
Divulgación pública de Kotaemon CVE-2025-56526 y CVE-2025-56527 El Cross-Site Scripting almacenado en el Panel de Información de Kotaemon se combina con el almacenamiento de credenciales en texto plano en localStorage, lo que permite el compromiso total de la sesión a partir de una única carga de...
EUVD-2026-81290
Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescaping and fails to encode cached values. Content editors can inject malicious JavaScript through editable fields that executes in authenticate...
EUVD-2026-81284
AVideo through 29.0 current revision e01e41ecc contains a stored cross-site scripting vulnerability. The unauthenticated view-counter endpoint objects/videoAddViewCount.json.php reaches VideoStatistic::save, which writes the caller's User-Agent via getUserAgentInfo, which returns unrecognized age...
CVE-2026-12948
CVE-2026-12948 Resumen de la vulnerabilidad Se identificó una vulnerabilidad de cross-site scripting XSS almacenado en la interfaz de gestión web del Digi PortServer TS 4 H MEI. Una solicitud autenticada especialmente manipulada permite que un payload de script se escriba permanentemente en el...
Geomap MapLibre XSS
A stored cross-site scripting vulnerability in the Geomap panel’s MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user’s session by hosting a malicious style configuration, enabling escalation to Org Admin...
WordPress Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Custom Twitter Feeds Tweets Widget versions = 2.8.0...
CVE-2026-92590
Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescaping and fails to encode cached values. Content editors can inject malicious JavaScript through editable fields that executes in authenticate...
CVE-2026-92584
AVideo through 29.0 current revision e01e41ecc contains a stored cross-site scripting vulnerability. The unauthenticated view-counter endpoint objects/videoAddViewCount.json.php reaches VideoStatistic::save, which writes the caller's User-Agent via getUserAgentInfo, which returns unrecognized age...
Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav
Summary Grav 2.0.0-rc.9 and the current 2.0 branch still allow stored CSS injection through Markdown image media actions. The prior media hardening rejects direct ?style= payloads and unsafe attribute fallbacks, but the adjacent resize action still writes caller-controlled values directly into...