CVE-2026-100133

Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,...

CVE-2026-100133 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,...

CVE-2026-100133

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79 ) that allows an attacker to inject malicious scripts into vulnerable form fields. If a victim views the page containing these fields, the malicious JavaScript may execute in their browser, potentially leading...

CVE-2026-92911

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79). A low-privileged attacker can inject malicious scripts into vulnerable form fields, which may execute in a victim's browser when they visit the affected page. This could result in the attacker gaining elevat...

CVE-2026-92911 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerabl...

CVE-2026-92911

Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerabl...

CVE-2026-104937

Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enabling stored cross-site scripting XSS. When a malicious uploaded file containing an embedded JavaScript payload is viewed by an administrator, the attacker...

WordPress FV Flowplayer Video Player plugin <= 7.5.54.7212 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin FV Flowplayer Video Player versions = 7.5.54.7212...

CVE-2024-48910-POC

CVE-2024-48910 Proof of Concept This is a proof of concept for CVE-2024-48910. This is a vulnerability that was present in DOMPurify, an XSS sanitizer for HTML, SVG, and MathML. This version of DOMPurify is vulnerable to prototype pollution, where an atatcker can inject properties into any JS...

CVE-2026-55562

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.fullname value into HTML without applying encodeentities and inserts the result...

CVE-2026-110103

bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the multipart Content-Type in POST /api/upload. Attackers can upload script-bearing documents served inline from /res and send their URLs to...

CVE-2026-110101

Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME restrictions. Attackers can upload HTML payloads via POST /api/data/id/file, served as text/html from public/uploads, executin...

CVE-2026-104250

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. Prior to 0.24.1, partitionhtmlhtmlparserversion="v2" and the VLM partitioner can preserve untrusted document tags, attributes, text, a...

CVE-2026-102989

TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an...

CVE-2026-5513

CVE-2026-5513 https://t.me/FreeToolsCpa CVE-2026-5513 — Bookly ≤ 27.2 Stored XSS via Cookie CVE-2026-5513 — Bookly ≤ 27.2 Stored XSS via Cookie CVE CVSS Type Auth https://t.me/FreeToolsCpa CVE file In Group Overview Field Value CVE ID CVE-2026-5513 Vulnerability Stored Cross-Site Scripting XSS...

loxs-optimized

loxs-optimized Project from https://github.com/coffinxp/loxs CSP-Bypass-xss.txt Note: It mainly bypasses the CSP payload 2024-11-06 Add CSP-Bypass-xss.txt to xss.txt 2024-11-07 Removing interfering information Only the vulnerable information is displayed 2024-11-11 Solves the problem that the...

CVE-2023-30212-Lab

CVE-2023-30212-Lab GitHub repository with Dockerfile and files to create a vulnerable environment for CVE-2023-30212, enabling exploration of the exploitability of this security vulnerability. Ideal for research and security enthusiasts to study and understand the impact of the vulnerability in a...

CVE-2023-36146

CVE-2023-36146 PoC of CVE-2023-36146 - Multilaser RE 170 Firmware 2.2.6733 Authenticated stored Cross Site Scripting Steps to Reproduce: 1. Log in the equipment via your web browser 2. Go to Security IP Filtering 3. In the "Description" field inject the payload "" 4. Click Add 5. Exploit!...

CVE-2026-110103

bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the multipart Content-Type in POST /api/upload. Attackers can upload script-bearing documents served inline from /res and send their URLs to...

CVE-2026-110103

bbs-go version 4.4.6 and earlier is vulnerable to a stored cross-site scripting (XSS) vulnerability. The root cause is that the application allows authenticated users to upload HTML or SVG files by spoofing the multipart Content-Type during a POST request to /api/upload . Attackers can upload doc...