CVE-2026-107682: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-110077: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

PT-2026-113307

Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...

CVE-2026-110075: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

PT-2026-111386

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Improper sanitization of calculated signal names within imported CSV trace files allows for Cross-Site Scripting XSS on the Trace page. An attacker can social...

PT-2026-111387

Name of the Vulnerable Software and Affected Versions Siematic affected versions not specified Description Devices fail to properly sanitize calculated signal data within imported calculated signal files before rendering the information on the Trace page. An attacker could social engineer an...

PT-2026-111382

Name of the Vulnerable Software and Affected Versions Schneider Electric Modicon PLC affected versions not specified Description Devices fail to properly sanitize calculated signal data within imported CSV trace files before displaying it on the Trace page. An attacker could trick an authorized...

CVE-2026-108495: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force SureForms sureforms allows Stored XSS.This issue affects SureForms: from n/a through 2.12.7...

XSS vulnerability in Shopware 6 enables Admin Token Theft and RCE

Overview Shopware 6.7 contains a stored cross-site scripting XSS vulnerability in its media upload functionality that can lead to administrator credential compromise and remote code execution. Description Shopware is an open-source e-commerce platform used to build and manage online stores. It...

VulnCheck KEV: CVE-2024-2087

The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form name values in all versions up to, and including, 2.4.43 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

VulnCheck KEV: CVE-2024-2347

The Astra theme for WordPress is vulnerable to Stored Cross-Site Scripting via a user's display name in all versions up to, and including, 4.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above,...

PT-2026-111300

Name of the Vulnerable Software and Affected Versions Firefox for iOS versions prior to 157.1 Description Firefox for iOS directly interpolated the page HTML language attribute into translation JavaScript. This allows attacker-controlled markup to execute code within the privileged content world ...

CVE-2026-110224: Improper Neutralization of Input During Web Page Generation

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in AdminSearchConfController::processSave that echoes rejected alias and search values unescaped in validation errors. Attackers can induce an authenticated back-office user to submit a crafted request, executing...

CVE-2026-96535: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL. This occurs due to a lack of sanitisation and validation of SVG content when setting an SVG image containing embedded JavaScript code as the avatar. The fil...

CVE-2026-109697: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.4...

PT-2026-111802

Name of the Vulnerable Software and Affected Versions Adobe Commerce affected versions not specified Description A stored Cross-Site Scripting XSS issue allows attackers to inject malicious scripts into vulnerable form fields. When a victim visits the page containing the affected field, the...

CVE-2026-110103: Improper Neutralization of Input During Web Page Generation

bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the multipart Content-Type in POST /api/upload. Attackers can upload script-bearing documents served inline from /res and send their URLs to...

CVE-2026-110101: Improper Neutralization of Input During Web Page Generation

Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME restrictions. Attackers can upload HTML payloads via POST /api/data/id/file, served as text/html from public/uploads, executin...

CVE-2024-34326

The ProPhoenix Law RMS v2022.2403.3.101 software contains a reflected cross-site scripting (XSS) vulnerability. The flaw exists in the errorHandler.aspx endpoint, specifically triggered via the PageTitle , Alert , or MsgType parameters. Exploitation details and specific remediation instructions a...

CVE-2024-34321

ProPhoenix Law RMS version v2022.2403.3.101 is affected by a reflected cross-site scripting (XSS) vulnerability. The flaw exists in the Notes.aspx endpoint, specifically triggered via the PageTitle/Notes parameter. This type of vulnerability typically allows an attacker to execute malicious scrip...