CVE-2026-110101: Improper Neutralization of Input During Web Page Generation

Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME restrictions. Attackers can upload HTML payloads via POST /api/data/id/file, served as text/html from public/uploads, executin...

CVE-2024-34326

The ProPhoenix Law RMS v2022.2403.3.101 software contains a reflected cross-site scripting (XSS) vulnerability. The flaw exists in the errorHandler.aspx endpoint, specifically triggered via the PageTitle , Alert , or MsgType parameters. Exploitation details and specific remediation instructions a...

CVE-2024-34321

ProPhoenix Law RMS version v2022.2403.3.101 is affected by a reflected cross-site scripting (XSS) vulnerability. The flaw exists in the Notes.aspx endpoint, specifically triggered via the PageTitle/Notes parameter. This type of vulnerability typically allows an attacker to execute malicious scrip...

CVE-2026-104587

The blob42 gosuki application (through commit 6e2bf34 ) is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is the use of text/template instead of html/template, which leads to a failure in performing context-aware auto-escaping on the URL and DisplayURL fields with...

EUVD-2024-55796

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting XSS vulnerability via the PageTitle/Notes parameter in the Notes.aspx endpoint...

CVE-2026-106633: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...

CVE-2026-110074: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-108488: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.0...

CVE-2026-109691: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BdThemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite allows Stored XSS.This issue affects Prime Slider – Addons For Elementor: from n/a through 4.7.1...

PT-2026-113313

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-110076: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

PT-2026-113371

Symantec Endpoint Detection and Response SEDR Console, prior to 4.13, may be susceptible to a Cross-Site Scripting XSS vulnerability, which is a type of issue whereby an attacker may attempt to inject malicious script that executes in the context of another user’s session, potentially resulting i...

CVE-2026-104250: Improper Neutralization of Input During Web Page Generation

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. Prior to 0.24.1, partitionhtmlhtmlparserversion="v2" and the VLM partitioner can preserve untrusted document tags, attributes, text, a...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : lxml vulnerabilities (USN-8897-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8897-1 advisory. Guillem Lefait discovered that lxml incorrectly handled certain URL attributes. A...

Application Development Environment Angular XSS

The vulnerability of the application development environment and the Angular single-page application platform is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

VulnCheck KEV: CVE-2024-9417

The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to limited file uploads due to a misconfigured file type validation in the 'handleUpload' function in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to upload files that are...

VulnCheck KEV: CVE-2024-5544

The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the order parameter in all versions up to, and including, 3.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

VulnCheck KEV: CVE-2024-2347

The Astra theme for WordPress is vulnerable to Stored Cross-Site Scripting via a user's display name in all versions up to, and including, 4.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above,...

VulnCheck KEV: CVE-2024-2087

The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form name values in all versions up to, and including, 2.4.43 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

VulnCheck KEV: CVE-2024-13377

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘alt’ parameter in all versions up to, and including, 2.9.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...