150550 matches found
CVE-2026-6127: Improper Neutralization of Input During Web Page Generation
The Elementor Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the elementordata meta field in versions up to, and including, 4.0.4. This is due to insufficient input sanitization when processing form-encoded REST API requests. The plugin registers the...
The vulnerability of the safe() function in the Gogs self-managed Git repository creation tool allows a hacker to perform cross-site scripting attacks.
The vulnerability of the safe function in the Gogs self-managed Git repository creation tool exists because measures to protect the website structure are not taken. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks remotely...
The vulnerability of the Gogs software tool for creating self-governed Git repositories stems from the lack of protective measures taken against the website structure. This allows attackers to perform cross-site scripting attacks.
The vulnerability of the Gogs self-managed Git repository creation software exists because measures to protect the structure of the web interface have not been implemented. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...
EUVD-2026-26258
DocsGPT is a GPT-powered chat for documentation. From version 0.15.0 to before version 0.16.0, an attacker accessing both the official DocsGPT website or any local and public deployment, can craft a malicious payload bypassing the "MCP test" behavior to achieve arbitrary remote code execution RCE...
webkitgtk: A website may be able to track users through Safari web extensions
A flaw was found in WebKitGTK. A malicious website can track users through web extensions due to improper state management...
webkitgtk: Visiting a maliciously crafted website may lead to a cross-site scripting attack
A flaw was found in WebKitGTK. A maliciously crafted web page can cause a logic issue due to improper checks and result in a cross-site scripting attack...
GHSA-F8H4-46XV-H7JJ Jenkins HTML Publisher Plugin has a XSS vulnerability in the legacy wrapper file
Jenkins HTML Publisher Plugin versoins 427 and earlier do not escape the job name and URL in the legacy wrapper file. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. HTML Publisher Plugin 427.1 escapes job name and URL when...
CVE-2026-2902: Improper Neutralization of Input During Web Page Generation
The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frontendrewrite' function's 'WPMETEORNWPMETEOR' placeholder content in all versions up to, and including, 3.4.16 due to insufficient input sanitization and output escaping. Th...
PT-2026-35960
Name of the Vulnerable Software and Affected Versions DocsGPT versions 0.15.0 through 0.15.x Description An attacker accessing the official website or any local and public deployment can craft a malicious payload that bypasses the "MCP test" behavior to achieve arbitrary remote code execution RCE...
Linux Distros Unpatched Vulnerability : CVE-2026-31019
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Website module of Dolibarr ERP & CRM 22.0.4 and below, the application uses blacklist-based filtering to restrict dangerous PHP functions related to syst...
The vulnerability of the Doczilla document automation development program lies in the lack of measures taken to protect the website structure, allowing attackers to perform cross-site scripting attacks (XSS).
The vulnerability of the Doczilla document automation development program is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...
The vulnerability of the Doczilla document automation development program lies in the lack of measures taken to protect the website structure, allowing attackers to perform cross-site scripting attacks (XSS).
The vulnerability of the Doczilla document automation development program is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...
The vulnerability of the Doczilla document automation development program lies in the lack of measures taken to protect the website structure, allowing attackers to execute arbitrary code.
The vulnerability of the Doczilla document automation development program is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
The vulnerability of the Doczilla document automation development program lies in the lack of measures taken to protect the website structure, allowing attackers to perform cross-site scripting attacks (XSS).
The vulnerability of the Doczilla document automation development program is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...
The vulnerability of the Doczilla document automation development program lies in the lack of measures taken to protect the website structure, allowing attackers to perform cross-site scripting attacks (XSS).
The vulnerability of the automated document development program Doczilla is related to the lack of measures taken to protect the structure of the web page...
Linux Distros Unpatched Vulnerability : CVE-2026-31018
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Dolibarr ERP & CRM = 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters,...
EUVD-2026-25233
A critical XSS vulnerability affected hackage-server and hackage.haskell.org. HTML and JavaScript files provided in source packages or via the documentation upload facility were served as-is on the main hackage.haskell.org domain. As a consequence, when a user with latent HTTP credentials browses...
Hackers Use Hidden Website Instructions in New Attacks on AI Assistants
Cybersecurity researchers at Forcepoint uncover new indirect prompt injection attacks that use hidden website code to exploit AI assistants like GitHub Copilot...
web-vulnerability-scanner
web-vulnerability-scanner This Reposito...
CVE-2026-5464: Missing Authorization
The ExactMetrics – Google Analytics Dashboard for WordPress Website Stats Plugin plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation in all versions up to, and including, 9.1.2. This is due to the reports page exposing the 'onboardingkey' transient to a...