CVE-2026-78391 Stored Cross-Site Scripting via Untrusted Cryptocurrency Address Rendering in RansomLook

RansomLook contains a stored cross-site scripting XSS vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored without sufficient validation and later...

CVE-2023-43356-CMSmadesimple-Stored-XSS---Global-Settings

CMSmadesimple Stored XSS v2.2.18 Autor: Sergio Beschreibung: Cross Site Scripting Schwachstelle in CMSmadesimple v.2.2.18 erlaubt einem lokalen Angreifer, beliebigen Code über ein manipuliertes Skript in die Global Meatadata im Menü "Settings- Global Settings Menu" einzuschleusen. Angriffsvektore...

CVE-2026-17033 CVE-2026-17033 CVE Record

An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders...

CVE-2026-17033 CVE-2026-17033 CVE Record

An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders...

EUVD-2026-64887

An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders...

CVE-2026-17033

Grafana OSS is vulnerable to a stored cross-site scripting (XSS) flaw in how it handles external Alertmanager alerts. An authenticated attacker with Editor access or alert.instances.external:write can submit an alert containing a crafted generatorURL field. Grafana renders this value directly as ...

CVE-2023-43353-CMSmadesimple-Stored-XSS---News---Extra

CMSmadesimple Stored XSS v2.2.18 लेखक: सर्जियो विवरण: CMSmadesimple v.2.2.18 में क्रॉस-साइट स्क्रिप्टिंग भेद्यता एक स्थानीय हमलावर को Content - News Menu के Extra में क्राफ्टेड स्क्रिप्ट के माध्यम से मनमाना कोड निष्पादित करने की अनुमति देती है। हमले के वेक्टर: स्क्रिप्टिंग "Content - News Menu" क...

CVE-2023-43346-Quick-CMS-Stored-XSS---Languages-Backend

Quick CMS Stored XSS v6.7 Autore: Sergio Descrizione: Una vulnerabilità di Cross-Site Scripting XSS in Quick CMS v6.7 consente a un utente malintenzionato locale di eseguire codice arbitrario tramite uno script appositamente creato nel Backend - Dashboard nel menu Lingue. Vettori di attacco:...

OpenNebula-CVE-2025-56536

OpenNebula-CVE-2025-56536 Titolo exploit : OpenNebula 6.10.0.1 - XSS persistente Cross-site Scripting nelle informazioni utente Autore exploit : Mark Artamonov Homepage del fornitore : https://opennebula.io/ Versione testata : OpenNebula 6.10.0.1 Versioni interessate : OpenNebula Prova di concett...

CVE-2026-78337

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an...

DEBIAN-CVE-2026-10618

Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string as it is stored, deliberately dropping...

CVE-2026-10618

Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string as it is stored, deliberately dropping...

CVE-2023-43360-CMSmadesimple-Stored-XSS---File-Picker-extension

CMSmadesimple Stored XSS v2.2.18 Autor: Sergio Beschreibung: Eine Cross-Site-Scripting-Schwachstelle in CMSmadesimple v.2.2.18 ermöglicht es einem lokalen Angreifer, beliebigen Code über ein manipuliertes Skript im Top Directory im File-Picker-Menü auszuführen. Angriffsvektoren: Skripting. Eine...

CVE-2026-78337 Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an...

CVE-2023-43343-Quick-CMS-Stored-XSS---Pages-Files

Quick CMS Stored XSS v6.7 Autor: Sergio Beschreibung: Mehrere Cross-Site-Scripting-Schwachstellen XSS in Quick CMS v6.7 ermöglichen es einem lokalen Angreifer, beliebigen Code über ein manipuliertes Skript an die Beschreibung der Dateien Files – Description im Seitenmenü Pages Menu auszuführen...

CVE-2023-43345-Quick-CMS-Stored-XSS---Pages-Content

Quick CMS XSS Armazenado v6.7 Autor: Sergio Descrição: Uma vulnerabilidade de Cross-Site Scripting XSS no Quick CMS v6.7 permite que um atacante local execute código arbitrário através de um script malicioso no campo Content - Name no menu Pages. Vetores de Ataque: Scripting: uma vulnerabilidade ...

CVE-2026-10618 Hugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute Values

Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string as it is stored, deliberately dropping...

CVE-2026-10618 Hugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute Values

Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string as it is stored, deliberately dropping...

EUVD-2026-64776

Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string as it is stored, deliberately dropping...

CVE-2026-10618

Hugo versions 0.93.0 through 0.165.0 are affected by a stored cross-site scripting vulnerability in the default fenced-code-block renderer. The root cause is in markup/internal/attributes/attributes.go: the New function converts attribute values from byte slices to strings before storage, bypassi...