CVE-2026-47666

Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through custom font family names, which are interpolated into a @font-face CSS rule and injected into the page as HTML without sanitization. Becaus...

CVE-2026-45694

LibreNMS is a network monitoring system. In versions up to and including 26.4.0, the Proxmox application view is vulnerable to reflected cross-site scripting through the user-supplied instance and vmid GET parameters, which are reflected into the page title without adequate encoding. The paramete...

PT-2026-68191

Name of the Vulnerable Software and Affected Versions ProjectSend version r2029 Description Reflected cross-site scripting occurs in the 'thumbnails-regenerate.php' endpoint. Remote attackers can inject arbitrary HTML and JavaScript by providing unsanitized values through the start date and end...

PT-2025-42756

Name of the Vulnerable Software and Affected Versions Tawk Live Chat affected versions not specified Description A stored Cross-Site Scripting XSS issue exists in Tawk Live Chat. An attacker can execute JavaScript code in a victim’s browser by uploading a malicious PDF file containing a JavaScrip...

CVE-2025-8571

Concrete CMS 9 to 9.4.2 and versions below 8.5.21 are vulnerable to Reflected Cross-Site Scripting XSS in the Conversation Messages Dashboard Page. Unsanitized input could cause theft of session cookies or tokens, defacement of web content, redirection to malicious sites, and if victim is an admi...

PT-2024-30252

Name of the Vulnerable Software and Affected Versions ZZCMS2023 affected versions not specified Description A stored cross-site scripting XSS issue exists in the ask/show.php file at line 21. An attacker can exploit this by sending a specially crafted POST request to "/user/ask...

Code injection

An issue was discovered in HiveMQ Broker Control Center 4.3.2. A crafted clientid parameter in an MQTT packet sent to the Broker is reflected in the client section of the management console. The attacker's JavaScript is loaded in a browser, which can lead to theft of the session and cookie of the...