PT-2026-42253

Name of the Vulnerable Software and Affected Versions Open ISES Tickets versions prior to 3.44.2 Description A reflected cross-site scripting issue exists in the 'opena.php' endpoint. Authenticated attackers can inject arbitrary JavaScript by providing an unsanitized value through the frm call GE...

PT-2026-42185

Name of the Vulnerable Software and Affected Versions CityPLus versions prior to V24.29750.1.0 Description Improper neutralization of input during web page generation in CityPLus allows Reflected Cross-Site Scripting XSS, a flaw where an application includes untrusted data in a web page without...

CVE-2026-6871 Obfuscate - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-033

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Obfuscate allows Cross-Site Scripting XSS. This issue affects Obfuscate: from 0.0.0 before 2.0.2...

CVE-2026-29965

HSC MailInspector 5.3.3-7 is vulnerable to Cross Site Scripting XSS in the /police/WarningUrlPage.php endpoint due to improper neutralization of user-supplied input that uses alternate or obfuscated JavaScript syntax...

The vulnerability of the Apache Tomcat application server, related to deficiencies in HTTP request processing, allows attackers to send hidden HTTP requests (HTTP Request Smuggling attack).

The vulnerability of the Apache Tomcat application server is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to send hidden HTTP requests remotely HTTP Request Smuggling attack...

CVE-2018-25337

CVE-2018-25337 affects Joomla JoomOCShop 1.0 and is a Cross-Site Request Forgery vulnerability that allows an attacker to perform unauthorized actions on behalf of authenticated users. The issue enables crafting malicious requests targeting endpoints such as /joomoc2/?route=account/edit to modify...

CVE-2021-47981 Quick.CMS 6.7 Cross-Site Scripting via CSRF to Sliders Form

Quick.CMS 6.7 contains a cross-site scripting vulnerability in the sliders form that allows authenticated attackers to inject malicious scripts by submitting XSS payloads through the sDescription parameter. Attackers can craft CSRF forms targeting the admin.php?p=sliders-form endpoint to execute...

Zor-Seviye-xxe-Lab

AltaySec SOC Policy Manager — Zor Seviye Blind OOB XXE Lab...

CVE-2026-41964

Permission control vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-41965

Use-After-Free UAF vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-41965

Use-After-Free UAF vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-41965

Use-After-Free UAF vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-41965

Technical details (affected product, components, exploit steps, versions, or remediation) are not publicly provided in the supplied documents. Monitor for updates from official sources.

EUVD-2026-30526

Use-After-Free UAF vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-41965

Use-After-Free UAF vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-41964

Permission control vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-41964

Technical details about CVE-2026-41964 are not publicly available in the provided documents. Monitor for updates from Huawei bulletins and CVE records to obtain affected products, impact specifics, and remediation.

CVE-2026-41964

Permission control vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availability...

BlueNoteMKVI PHP Timeclock 跨站脚本漏洞

BlueNoteMKVI PHP Timeclock is an employee attendance and working hours recording system developed by BlueNoteMKVI company, based on PHP and MySQL. Version 1.04 of PHP Timeclock contains a cross-site scripting vulnerability. This vulnerability stems from multiple cross-site scripting issues,...

Open WebUI 跨站脚本漏洞

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted WebUI that is open source. Versions of Open WebUI prior to 0.8.0 had a cross-site scripting vulnerability. This vulnerability stemmed from the insecure preview of Excel file attachments. The specially crafted XLSX file paylo...