CVE-2026-10618 Hugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute Values

Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string as it is stored, deliberately dropping...

EUVD-2026-64776

Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string as it is stored, deliberately dropping...

CVE-2026-10618

Hugo versions 0.93.0 through 0.165.0 are affected by a stored cross-site scripting vulnerability in the default fenced-code-block renderer. The root cause is in markup/internal/attributes/attributes.go: the New function converts attribute values from byte slices to strings before storage, bypassi...

CVE-2023-43877-RiteCMS-Stored-XSS---Home

Rite CMS v3.0 Multiple XSS Memorizzate Autore: Sergio Descrizione: Rite CMS 3.0 è affetto da una vulnerabilità multipla di Cross-Site scripting XSS memorizzato che consente agli attaccanti di eseguire codice arbitrario tramite un payload creato nei campi della Home Page nel menu di Amministrazion...

Astra Linux – Vulnerability in Zabbix

A authenticated user can create a hosts group using the configuration with XSS payload, which will be available to other users. When XSS is stored by an authenticated malicious actor, and other users attempt to search for groups during the creation of new hosts, the XSS payload will activate,...

Astra Linux – Vulnerability in Zabbix

Stored or persistent cross-site scripting XSS is a type of XSS attack where the attacker first sends the malicious payload to the web application. The application then stores the payload e.g., in a database or server-side text files. Eventually, the application inadvertently executes the payload...

CVE-2023-43344-Quick-CMS-Stored-XSS---SEO-Meta-description

Quick CMS XSS Armazenado v6.7 Autor: Sergio Descrição: Uma vulnerabilidade de Cross-Site Scripting XSS no Quick CMS v6.7 permite que um atacante local execute código arbitrário através de um script malicioso na descrição Meta do SEO no Menu de Páginas. Vetores de Ataque: Scripting Uma...

CVE-2026-34212

CVE-2026-34212 O Docmost aceitou uma URL javascript: dentro de um nó de anexo, preservou-a durante o armazenamento e a renderização, e a transformou novamente em um âncora clicável na origem do Docmost. Introdução Identifiquei, divulguei responsavelmente e reproduzi um problema de XSS armazenado ...

CVE-2023-43359-CMSmadesimple-Stored-XSS----Content-Manager

CMSmadesimple XSS Memorizzato v2.2.18 Autore: Sergio Descrizione: Molteplici vulnerabilità cross-site scripting XSS in CMSmadesimple v.2.2.18 consentono a un utente malintenzionato locale di eseguire codice arbitrario tramite uno script appositamente predisposto nei dati Page Specific Metadata e...

CVE-2023-43873-e107-CMS-Stored-XSS---Manage

e107 CMS Stored XSS v2.3.2 Autore: Sergio Descrizione: La vulnerabilità Cross Site Scripting XSS in e017 CMS v.2.3.2 consente a un attaccante locale di eseguire codice arbitrario tramite uno script appositamente creato nel campo Name nel menu Manage. Vettori d'attacco: Scripting: una vulnerabilit...

CVE-2023-44771_ZenarioCMS--Stored-XSS---Page-Layout

ZenarioCMS Stored XSS v.9.4.59197 Autore: Sergio Descrizione: La vulnerabilità di Cross Site Scripting in ZenarioCMS v.9.4.59197 consente a un attaccante locale di eseguire codice arbitrario tramite uno script appositamente predisposto nel Page Layout. Vettori di attacco: Sfruttare una...

CVE-2023-44766_ConcreteCMS-Stored-XSS---SEO

ConcreteCMS Stored XSS v.9.2.1 Autore: Sergio Descrizione: La vulnerabilità di Cross Site Scripting in ConcreteCMS v.9.2.1 consente a un attaccante locale di eseguire codice arbitrario tramite uno script appositamente creato nella sezione SEO - Extra dalle Impostazioni della Pagina. Vettori di...

CVE-2023-44764_ConcreteCMS-Stored-XSS---Site_Installation

ConcreteCMS XSS Memorizzato v.9.2.1 Author: Sergio Descrizione: La vulnerabilità di Cross Site Scripting in ConcreteCMS v.9.2.1 consente a un attaccante locale di eseguire codice arbitrario tramite uno script appositamente predisposto nel parametro SITE durante l'installazione o nelle Impostazion...

CVE-2023-43874-e107-CMS-Stored-XSS---MetaCustomTags

e107 CMS Stored XSS v2.3.2 Autore: Sergio Descrizione: La vulnerabilità di Cross Site Scripting XSS multiplo in e017 CMS v.2.3.2 consente a un attaccante locale di eseguire codice arbitrario tramite uno script appositamente creato nei campi Copyright e Author nel menu Meta & Custom Tags. Vettori ...

TarantuBench

TarantuBench v1 Ein Benchmark zur Bewertung von KI-Agenten bei Web-Sicherheitsherausforderungen, generiert von der TarantuLabs-Engine. Was ist das? TarantuBench ist eine Sammlung von 100 angreifbaren Webanwendungen, die jeweils eine versteckte Flagge TARANTU... enthalten. Die Aufgabe eines Agente...

CVE-2026-78213

Heptabase developed by Hepta Platforms, Inc. has a Stored Cross-Site Scripting vulnerability. Authenticated remote attackers can inject persistent malicious content into specific pages, causing arbitrary JavaScript code to execute when other users click the crafted content...

CVE-2023-43357-CMSmadesimple-Stored-XSS---Shortcut

CMSmadesimple Stored XSS v2.2.18 Autor: Sergio Descrição: Vulnerabilidade de Cross Site Scripting no CMSmadesimple v.2.2.18 permite que um atacante local execute código arbitrário por meio de um script elaborado no campo Title em My Preferences - Manage Shortcuts Vetores de Ataque: Scripting Uma...

EUVD-2026-64720

Heptabase developed by Hepta Platforms, Inc. has a Stored Cross-Site Scripting vulnerability. Authenticated remote attackers can inject persistent malicious content into specific pages, causing arbitrary JavaScript code to execute when other users click the crafted content...

CVE-2026-78213

Heptabase , developed by Hepta Platforms, Inc., is affected by a Stored Cross-Site Scripting (XSS) vulnerability. Authenticated remote attackers can inject persistent malicious content into specific pages, causing arbitrary JavaScript code to execute when other users click the crafted content. Th...

CVE-2026-78213 Hepta Platforms｜Heptabase - Stored Cross-Site Scripting

Heptabase developed by Hepta Platforms, Inc. has a Stored Cross-Site Scripting vulnerability. Authenticated remote attackers can inject persistent malicious content into specific pages, causing arbitrary JavaScript code to execute when other users click the crafted content...