EUVD-2026-98024

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing booking page is stored without neutralization. Unauthenticated attackers can submit crafted content that is rendered as raw HTML in a...

EUVD-2026-98006

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored record names into markup without escaping. Authenticated users able to create records can store crafted record names that execute script in the...

EUVD-2026-98001

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into markup without escaping. An authenticated user able to create such records can give them malicious names, executing script in the...

EUVD-2026-98160

Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents or .Fragments.ToHTML output to inject...

EUVD-2026-98073

A security vulnerability has been detected in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform/formQoS of the component QoS Page. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may ...

EUVD-2023-60715

Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability because the html2text function weakly sanitizes user input. Authenticated attackers can supply crafted HTML that is insufficiently sanitized by html2text, executing scripts in the browsers of users who vie...

EUVD-2026-98154

A weakness has been identified in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the file /goform/formPortFw of the component Port Forwarding Page. Executing a manipulation can lead to cross site scripting. The attack may be performed from remote. The exploit has...

EUVD-2024-55786

Frappe before 14.58.0 and 15.x before 15.4.0 contains a cross-site scripting vulnerability in printview because printview parameters are not escaped before being rendered. Remote attackers can craft a malicious printview URL that, when visited by a victim, injects HTML and executes script in the...

EUVD-2025-211074

Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a certain page, allowing arbitrary JavaScript to execute in authenticated sessions. Remote attackers can lure a logged-in user into opening a crafted UR...

EUVD-2026-97967

A vulnerability was determined in Netcore NR268 1.7.121109. This impacts the function eval of the file filterhostsdump.cgi of the component DHCP Hostname Handler. This manipulation of the argument Hostname causes cross site scripting. Remote exploitation of the attack is possible. The exploit has...

EUVD-2026-97981

A security flaw has been discovered in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unknown functionality of the file /goform/formUrlb of the component HTTP Blocking Page. Performing a manipulation results in cross site scripting. The attack is possible to be carried out remotely...

EUVD-2026-97976

A vulnerability was identified in Edimax BR-6208AC 1.32. Affected is an unknown function of the file /goform/formFilter. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about...

EUVD-2026-98197

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal...

CVE-2026-89117 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal...

CVE-2026-89117

SAP NetWeaver Enterprise Portal is vulnerable to a Cross-Site Scripting (XSS) flaw (CWE-79). An unauthenticated attacker can inject malicious scripts into a URL parameter , which are reflected in the server response and executed in a victim's browser upon visiting a crafted URL. This can lead to ...

CVE-2026-89106 Cross Site Scripting (XSS) vulnerability in SAPUI5

SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially crafted content that is later rendered in a victim's browser. This vulnerability has a low impact on confidentiality and integrity. There is no impact on...

CVE-2026-89106

The SAPUI5 framework is vulnerable to a Cross-Site Scripting (XSS) vulnerability due to insufficient input validation under specific configurations. An attacker with low privileges can submit specially crafted content that executes in a victim's browser. The impact on confidentiality and integrit...

CVE-2026-76976

Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP are vulnerable to a Cross-Site Scripting (XSS) vulnerability due to insufficient sanitization of user-supplied content in certain functionalities. An authenticated attacker can send malicious content to another user; ...

CVE-2026-76976 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)

Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenticated attacker to send malicious content to another user. If the victim interacts with the affected content, malicious...

CVE-2026-76975 Cross-Site Scripting (XSS) vulnerability in SAPUI5 (Support Assistant Overlay)

Due to a DOM-Based Cross-Site Scripting XSS vulnerability, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user accesses this link, client-side code reads the attacker-controlled input and writes it into the DOM without proper...