CVE-2025-56795

CVE-2025-56795 Descrizione Sono state identificate due vulnerabilità di Cross-Site Scripting XSS persistente nella funzionalità di creazione di ricette di Mealie , che interessano tutte le versioni fino alla 3.0.1 inclusa. L'input utente non sanificato fornito durante la creazione di una ricetta...

CVE-2026-48849-Roundcube-Webmail-Stored-XSS

CVE-2026-48849 - XSS persistente, HTML Injection e CSS Injection in Roundcube Webmail Panoramica Questo repository contiene un Proof-of-Concept PoC per CVE-2026-48849 , una vulnerabilità di XSS persistente, HTML Injection e CSS Injection in Roundcube Webmail. La vulnerabilità permette che HTML, C...

CVE-2023-44758_GDidees-CMS-Stored-XSS---Title

GDidees Gespeichertes XSS v3.0 Autor: Sergio Beschreibung: Cross Site Scripting-Schwachstelle in GDidees v.3.0 ermöglicht es einem lokalen Angreifer, beliebigen Code über ein manipuliertes Skript im Seitentitel auszuführen. Angriffsvektoren: Scripting: Eine Schwachstelle in der Bereinigung der...

CVE-2026-78414

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...

CVE-2026-78391

RansomLook contains a stored cross-site scripting XSS vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored without sufficient validation and later...

DEBIAN-CVE-2026-65053

Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, IMPrender obtains the name of the data part with IMPContents::getPartName, which returns the MIME part's own name parameter as...

CVE-2026-65053

Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, IMPrender obtains the name of the data part with IMPContents::getPartName, which returns the MIME part's own name parameter as...

CVE-2026-65053 Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name

Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, IMPrender obtains the name of the data part with IMPContents::getPartName, which returns the MIME part's own name parameter as...

CVE-2026-65053 Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name

Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, IMPrender obtains the name of the data part with IMPContents::getPartName, which returns the MIME part's own name parameter as...

EUVD-2026-64899

Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, IMPrender obtains the name of the data part with IMPContents::getPartName, which returns the MIME part's own name parameter as...

CVE-2026-65053

Horde IMP (webmail application) contains a stored cross-site scripting vulnerability in its AppleDouble MIME viewer. In lib/Mime/Viewer/Appledouble.php, the _IMPrender() method passes the MIME part's name parameter through sprintf into an IMP_Mime_Status object without escaping; IMP_Mime_Status::...

CVE-2026-65053 Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name

Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, IMPrender obtains the name of the data part with IMPContents::getPartName, which returns the MIME part's own name parameter as...

CVE-2026-65053

Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, IMPrender obtains the name of the data part with IMPContents::getPartName, which returns the MIME part's own name parameter as...

liferay-xss-7.2.1GA2-poc-report-CVE-2020-7934

XSS Archiviato Autenticato in LifeRay 7.2.1 GA2 tramite MyAccountPortlet eseguito dai Risultati di Ricerca In LifeRay versione 7.1.0 fino a 7.2.1 GA2 i campi Nome, Secondo Nome e Cognome per gli account utente sono tutti vulnerabili a un problema di XSS Archiviato. Qualsiasi utente può modificare...

CVE-2026-17033

An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders...

CVE-2026-78391

RansomLook contains a stored XSS in its cryptocurrency wallet detail view. Untrusted cryptocurrency addresses and blockchain names—sourced from external feeds such as the public ransomwhe.re crowd-sourcing feed—were stored without sufficient validation and rendered inside an inline JavaScript onc...

EUVD-2026-64891

RansomLook contains a stored cross-site scripting XSS vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored without sufficient validation and later...

CVE-2026-78391 Stored Cross-Site Scripting via Untrusted Cryptocurrency Address Rendering in RansomLook

RansomLook contains a stored cross-site scripting XSS vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored without sufficient validation and later...

CVE-2026-78391 Stored Cross-Site Scripting via Untrusted Cryptocurrency Address Rendering in RansomLook

RansomLook contains a stored cross-site scripting XSS vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored without sufficient validation and later...

CVE-2023-43356-CMSmadesimple-Stored-XSS---Global-Settings

CMSmadesimple Stored XSS v2.2.18 Autor: Sergio Beschreibung: Cross Site Scripting Schwachstelle in CMSmadesimple v.2.2.18 erlaubt einem lokalen Angreifer, beliebigen Code über ein manipuliertes Skript in die Global Meatadata im Menü "Settings- Global Settings Menu" einzuschleusen. Angriffsvektore...