Astra Linux – Vulnerability in Zabbix

Stored or persistent cross-site scripting XSS is a type of XSS attack where the attacker first sends the malicious payload to the web application. The application then stores the payload e.g., in a database or server-side text files. Eventually, the application inadvertently executes the payload...

CVE-2023-43344-Quick-CMS-Stored-XSS---SEO-Meta-description

Quick CMS XSS Armazenado v6.7 Autor: Sergio Descrição: Uma vulnerabilidade de Cross-Site Scripting XSS no Quick CMS v6.7 permite que um atacante local execute código arbitrário através de um script malicioso na descrição Meta do SEO no Menu de Páginas. Vetores de Ataque: Scripting Uma...

CVE-2026-34212

CVE-2026-34212 O Docmost aceitou uma URL javascript: dentro de um nó de anexo, preservou-a durante o armazenamento e a renderização, e a transformou novamente em um âncora clicável na origem do Docmost. Introdução Identifiquei, divulguei responsavelmente e reproduzi um problema de XSS armazenado ...

CVE-2023-43359-CMSmadesimple-Stored-XSS----Content-Manager

CMSmadesimple XSS Memorizzato v2.2.18 Autore: Sergio Descrizione: Molteplici vulnerabilità cross-site scripting XSS in CMSmadesimple v.2.2.18 consentono a un utente malintenzionato locale di eseguire codice arbitrario tramite uno script appositamente predisposto nei dati Page Specific Metadata e...

CVE-2023-43873-e107-CMS-Stored-XSS---Manage

e107 CMS Stored XSS v2.3.2 Autore: Sergio Descrizione: La vulnerabilità Cross Site Scripting XSS in e017 CMS v.2.3.2 consente a un attaccante locale di eseguire codice arbitrario tramite uno script appositamente creato nel campo Name nel menu Manage. Vettori d'attacco: Scripting: una vulnerabilit...

CVE-2023-44771_ZenarioCMS--Stored-XSS---Page-Layout

ZenarioCMS Stored XSS v.9.4.59197 Autore: Sergio Descrizione: La vulnerabilità di Cross Site Scripting in ZenarioCMS v.9.4.59197 consente a un attaccante locale di eseguire codice arbitrario tramite uno script appositamente predisposto nel Page Layout. Vettori di attacco: Sfruttare una...

CVE-2023-44766_ConcreteCMS-Stored-XSS---SEO

ConcreteCMS Stored XSS v.9.2.1 Autore: Sergio Descrizione: La vulnerabilità di Cross Site Scripting in ConcreteCMS v.9.2.1 consente a un attaccante locale di eseguire codice arbitrario tramite uno script appositamente creato nella sezione SEO - Extra dalle Impostazioni della Pagina. Vettori di...

CVE-2023-44764_ConcreteCMS-Stored-XSS---Site_Installation

ConcreteCMS XSS Memorizzato v.9.2.1 Author: Sergio Descrizione: La vulnerabilità di Cross Site Scripting in ConcreteCMS v.9.2.1 consente a un attaccante locale di eseguire codice arbitrario tramite uno script appositamente predisposto nel parametro SITE durante l'installazione o nelle Impostazion...

CVE-2023-43874-e107-CMS-Stored-XSS---MetaCustomTags

e107 CMS Stored XSS v2.3.2 Autore: Sergio Descrizione: La vulnerabilità di Cross Site Scripting XSS multiplo in e017 CMS v.2.3.2 consente a un attaccante locale di eseguire codice arbitrario tramite uno script appositamente creato nei campi Copyright e Author nel menu Meta & Custom Tags. Vettori ...

TarantuBench

TarantuBench v1 Ein Benchmark zur Bewertung von KI-Agenten bei Web-Sicherheitsherausforderungen, generiert von der TarantuLabs-Engine. Was ist das? TarantuBench ist eine Sammlung von 100 angreifbaren Webanwendungen, die jeweils eine versteckte Flagge TARANTU... enthalten. Die Aufgabe eines Agente...

CVE-2026-78213

Heptabase developed by Hepta Platforms, Inc. has a Stored Cross-Site Scripting vulnerability. Authenticated remote attackers can inject persistent malicious content into specific pages, causing arbitrary JavaScript code to execute when other users click the crafted content...

CVE-2023-43357-CMSmadesimple-Stored-XSS---Shortcut

CMSmadesimple Stored XSS v2.2.18 Autor: Sergio Descrição: Vulnerabilidade de Cross Site Scripting no CMSmadesimple v.2.2.18 permite que um atacante local execute código arbitrário por meio de um script elaborado no campo Title em My Preferences - Manage Shortcuts Vetores de Ataque: Scripting Uma...

EUVD-2026-64720

Heptabase developed by Hepta Platforms, Inc. has a Stored Cross-Site Scripting vulnerability. Authenticated remote attackers can inject persistent malicious content into specific pages, causing arbitrary JavaScript code to execute when other users click the crafted content...

CVE-2026-78213

Heptabase , developed by Hepta Platforms, Inc., is affected by a Stored Cross-Site Scripting (XSS) vulnerability. Authenticated remote attackers can inject persistent malicious content into specific pages, causing arbitrary JavaScript code to execute when other users click the crafted content. Th...

CVE-2026-78213 Hepta Platforms｜Heptabase - Stored Cross-Site Scripting

Heptabase developed by Hepta Platforms, Inc. has a Stored Cross-Site Scripting vulnerability. Authenticated remote attackers can inject persistent malicious content into specific pages, causing arbitrary JavaScript code to execute when other users click the crafted content...

CVE-2023-43879-RiteCMS-Stored-XSS---GlobalContent

Rite CMS v3.0 Mehrere gespeicherte XSS Autor: Sergio Beschreibung: Rite CMS 3.0 ist von einer gespeicherten Cross-Site-Scripting XSS-Schwachstelle betroffen, die es Angreifern ermöglicht, über einen präparierten Payload beliebigen Code in den Global Content Blocks im Administrationsmenü...

CVE-2026-66418-OpenClaw-Dashboard-v3.0.0-Stored-XSS-via-Failed-Login-Username-Field

Advisory di sicurezza: Cross-Site Scripting persistente non autenticato che porta al takeover dell'account amministratore openclaw-dashboard Titolo: OpenClaw Dashboard v3.0.0 Stored XSS tramite il campo Username del login fallito ID CVE assegnato: CVE-2026-66418 Repository target:...

PT-2026-80879

Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description An authenticated attacker with Editor access or alert.instances.external:write permissions can submit an external Alertmanager alert containing a controlled generatorURL. The software renders...

12 Step Meeting List < 3.19.17 - Unauthenticated Stored Cross-Site Scripting

Description The 12 Step Meeting List plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.19.16. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

PT-2026-80898

Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, IMPrender obtains the name of the data part with IMP Contents::getPartName, which returns the MIME part's own name parameter as...