CVE-2026-110219: Improper Neutralization of Input During Web Page Generation

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject scripts through the price parameter of the back-office Additional Facilities form. Attackers can induce an authenticated back-office user to submit a crafted request whose unescape...

Microsoft SharePoint: CVE-2026-88208: Microsoft Office SharePoint Spoofing Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

PT-2026-111385

Name of the Vulnerable Software and Affected Versions Siematic S7 affected versions not specified Description Devices fail to properly sanitize signal names within imported CSV trace files before they are rendered in selection menus on the Trace page. This flaw allows an attacker to trick an...

VulnCheck KEV: CVE-2024-5544

The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the order parameter in all versions up to, and including, 3.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

PT-2026-111383

Name of the Vulnerable Software and Affected Versions Siematic affected versions not specified Description Devices fail to properly sanitize comment fields within imported trace files before they are rendered on the Trace page. This flaw allows an attacker to trick an authorized user with the "Re...

VulnCheck KEV: CVE-2026-54188

Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.10 versions...

PT-2026-111142

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Enterprise Portal affected versions not specified Description An unauthenticated attacker can inject malicious scripts into a URL parameter. These scripts are reflected in the server response and executed in the browser of a user...

XSS vulnerability in Shopware 6 enables Admin Token Theft and RCE

Overview Shopware 6.7 contains a stored cross-site scripting XSS vulnerability in its media upload functionality that can lead to administrator credential compromise and remote code execution. Description Shopware is an open-source e-commerce platform used to build and manage online stores. It...

PT-2026-111180

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 19.1 through 19.2.7 GitLab CE/EE versions 19.3 through 19.3.4 GitLab CE/EE versions 19.4 through 19.4.1 Description An issue exists where improper sanitization of HTML attributes in syntax-highlighted output allows an...

PT-2026-111130

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A DOM-Based Cross-Site Scripting XSS issue exists where an unauthenticated attacker can create a malicious link. When an authenticated user visits this link,...

PT-2026-111129

Name of the Vulnerable Software and Affected Versions SAP Manufacturing Integration and Intelligence affected versions not specified Description A Cross-Site Scripting XSS flaw allows an attacker to store malicious content that the application later renders. When an authenticated user accesses a...

PT-2026-111134

Name of the Vulnerable Software and Affected Versions SAP UI5 affected versions not specified Description Insufficient input validation under certain configurations allows a low-privileged attacker to submit specially crafted content. This content is subsequently rendered in a victim's browser,...

PT-2026-111131

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server ABAP affected versions not specified Description Applications based on SAP GUI for HTML do not sufficiently sanitize user-supplied content in certain functionality. This allows an authenticated attacker to send...

PT-2026-113304

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

PT-2026-113303

Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...

PT-2026-113305

Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...

PT-2026-113301

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager affected versions not specified Description Stored Cross-Site Scripting XSS allows an attacker to inject malicious scripts into vulnerable form fields. When a victim visits the page containing the affected field, the...

PT-2026-113012

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Improper neutralization of input during web page generation leads to cross-site scripting XSS, a technique where malicious scripts are injected into trusted websites. This...

PT-2026-113312

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager affected versions not specified Description A stored Cross-Site Scripting XSS issue allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. This results in the execution of malicious...

PT-2026-113317

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager affected versions not specified Description Adobe Experience Manager contains a DOM-based Cross-Site Scripting XSS flaw, which occurs when an application contains client-side JavaScript that processes data from an...