CVE-2025-63915-There-is-a-Reflected-xss-vulnerability-exists-in-DoraCMS

CVE-2025-63915 Target:https://www.html-js.cn Github:https://github.com/doramart/DoraCMS Version:V2.1.8 Vulnerability Name:Reflected Cross-Site Scripting XSS Vulnerability in DoraCMS V2.1.8 CWE-79 Vulnerability Type: Reflected Cross-Site Scripting Reflected XSS Discovery Date: 2025-10-17...

Wildfire

CVE-2026-39154 · Stored XSS in CometChat group messages JS SDK 3.0.12 This directory holds an honest, self-contained reproduction of the render sink behind CVE-2026-39154: a stored cross-site scripting defect in the CometChat JavaScript SDK 3.0.12, where a group message's data.text field is...

CVE-2026-76564

Stored XSS via User-Agent in Admin Order View in PhocaCart PhocaCart ≤ 6.1.7 — Unauthenticated Attacker Stores XSS Payload via Checkout. Executes in Admin Browser Context SUMMARY PhocaCart 6.1.7 for Joomla stores the raw HTTP User-Agent header from checkout requests in the orders database table...

CVE-2018-1000529

CVE-2018-1000529 NVD CVE-2018-1000529: https://nvd.nist.gov/vuln/detail/CVE-2018-1000529 MITRE CVE-2018-1000529: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-1000529 Stored XSS in Grails Fields Plugin =2.2.7 This repository was used to demonstrate a proof of concept of the vulnerability fo...

EUVD-2026-54213

GitHub CLI allows path traversal through unescaped request URL components...

CVE-2026-106157

In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href attribute without proper encoding. An attacker who can control an item URL can inject additional HTML attributes,...

CVE-2026-106163 Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser

In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-controlled name containing script-related HTML can execute...

CVE-2026-106163: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-controlled name containing script-related HTML can execute...

ROS-20260922-73-0122

The vulnerability in log4j is related to a lack of mechanisms for encoding or shielding output data. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

CVE-2026-77404

A flaw was found in RabbitMQ amqp091-go. The URI.String function in uri.go concatenates TLS asset path values directly into an AMQPS query string without proper encoding. If an application processes a TLS asset path containing special characters like ampersand or equals delimiters, these can be...

CVE-2026-77404

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client library. Prior to 1.13.0 , the URI.String method in uri.go concatenates CertFile, KeyFile, CACertFile, and ServerName values directly into the AMQPS query string without URL-encoding them. If an application accepts a TLS asset path containing ampersan...

CVE-2026-77404

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, URI.String in uri.go concatenates CertFile, KeyFile, CACertFile, and ServerName values directly into an AMQPS query string instead of encoding them as URL query parameters with url.Values. If an application accepts a TLS asset path...

CVE-2026-55374

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl joins values returned by Request::getPathVariables without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When ...

CVE-2026-55374

canto-saas-api is a PHP library for interacting with the Canto SaaS API . In versions prior to 3.0.0 , Request::buildRequestUrl() joins path variable values without URL-encoding each segment. An attacker who controls a path variable value (e.g., scheme or contentId) through a consuming applicatio...

EUVD-2026-78905

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl joins values returned by Request::getPathVariables without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When ...

CVE-2026-55374 canto-saas-api: Authenticated API requests can be redirected via unencoded path variables

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl joins values returned by Request::getPathVariables without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When ...

CVE-2026-55374 canto-saas-api: Authenticated API requests can be redirected via unencoded path variables

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl joins values returned by Request::getPathVariables without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When ...

CVE-2026-90583 kagisearch smallweb Query String Rendering sw.py index cross site scripting

A security flaw has been discovered in kagisearch smallweb up to 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf. The affected element is the function index of the file app/sw.py of the component Query String Rendering. Performing a manipulation of the argument qs results in cross site scripting. The...

CVE-2026-89724

In the Linux kernel, the following vulnerability has been resolved: media: vicodec: fix out-of-bounds write in FWHT encoder vidiocsfmtvidout sizes the encoder CAPTURE buffer from the compressed descriptor pixfmtfwht, whose sizeimagemult is 3: codedw codedh 3 + sizeofstruct fwhtcframehdr...

EUVD-2026-76447

Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The customslot savetemplate endpoint authorizes the request only against the target board instance canEditBoardContents and then persists the client-supplied selectedTemplateOptioncollection verbatim,...