CVE-2026-54505 TREK: Stored cross-user HTML injection via trip title in the Journey suggestion banner

TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in...

CVE-2026-77075 n8n before 1.123.69 Expression Injection via Resource Locator

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an expression injection vulnerability in resource-locator field link preview rendering. The editor spliced the field's stored value directly into the node type's URL template without checking for expression syntax. An...

CVE-2026-77075

n8n's editor splices resource-locator field values into node URL templates without expression-syntax checks, enabling an authenticated user to inject JavaScript evaluated in another user's session. CVSS 8.4 HIGH. Affected: <1.123.69, 2.x <2.33.4, 2.34.x

PT-2026-78931

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.69 n8n versions 2.x prior to 2.33.4 n8n versions 2.34.x prior to 2.34.1 Description An expression injection issue exists in the link preview rendering of the resource-locator field. The editor directly splices the...

CVE-2025-23581 WordPress Demo User DZS plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in digitalzoomstudio Demo User DZS demo-user-dzs-showcase-your-admin-safely allows Stored XSS.This issue affects Demo User DZS: from n/a through = 1.1.0...

CVE-2020-13911

Your Online Shop 1.8.0 allows authenticated users to trigger XSS via a Change Name or Change Surname operation...

CVE-2017-8762

GeniXCMS 1.0.2 has XSS triggered by an authenticated user who submits a page, as demonstrated by a crafted oncut attribute in a B element...

Perforce P4web 2011/2012 Web Client XSS Vulnerability

Exploit for php platform in category web applications Exploit Title: Perforce P4web 2011/2012 Web Client XSS Vulnerability Date: 21 Jan 2013 Researcher: Christy Philip Mathew Email: email protected Vendor or Software Link: http://filehost.perforce.com/perforce/r11.1/bin.ntx86/p4webinst.exe...