CVE-2024-58391 Frappe before 15.4.0 XSS via Printview Parameters

Frappe before 14.58.0 and 15.x before 15.4.0 contains a cross-site scripting vulnerability in printview because printview parameters are not escaped before being rendered. Remote attackers can craft a malicious printview URL that, when visited by a victim, injects HTML and executes script in the...

CVE-2023-54409

The Frappe application is vulnerable to Cross-Site Scripting (XSS) in versions before 13.46.1 and 14.x before 14.20.0 . The root cause is weak sanitization of user input within the html2text function. An authenticated attacker can provide crafted HTML that, when insufficiently sanitized, allows f...

CVE-2023-54409 Frappe before 13.46.1 XSS via html2text Weak Sanitization

Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability because the html2text function weakly sanitizes user input. Authenticated attackers can supply crafted HTML that is insufficiently sanitized by html2text, executing scripts in the browsers of users who vie...

CVE-2023-54409 Frappe before 13.46.1 XSS via html2text Weak Sanitization

Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability because the html2text function weakly sanitizes user input. Authenticated attackers can supply crafted HTML that is insufficiently sanitized by html2text, executing scripts in the browsers of users who vie...

CVE-2023-54408

Frappe versions before 13.52.0 and 14.x before 14.31.0 are vulnerable to an HTML injection vulnerability. The root cause is weak escaping of user-supplied content rendered within pages. An attacker can submit crafted HTML that bypasses insufficient escaping mechanisms, causing it to execute in th...

CVE-2023-54408 Frappe before 14.31.0 HTML Injection via Weak Escaping

Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnerability caused by weak escaping of user-supplied content rendered in pages. Attackers can submit crafted HTML that bypasses the insufficient escaping and is rendered in the browsers of users who view it, enabling...

CVE-2023-54408 Frappe before 14.31.0 HTML Injection via Weak Escaping

Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnerability caused by weak escaping of user-supplied content rendered in pages. Attackers can submit crafted HTML that bypasses the insufficient escaping and is rendered in the browsers of users who view it, enabling...

CVE-2026-108932

A vulnerability was determined in Netcore NR268 1.7.121109. This impacts the function eval of the file filterhostsdump.cgi of the component DHCP Hostname Handler. This manipulation of the argument Hostname causes cross site scripting. Remote exploitation of the attack is possible. The exploit has...

CVE-2026-108934

A security flaw has been discovered in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unknown functionality of the file /goform/formUrlb of the component HTTP Blocking Page. Performing a manipulation results in cross site scripting. The attack is possible to be carried out remotely...

DEBIAN-CVE-2026-104140

QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 OGC API Features HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer...

CVE-2026-104140

QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 OGC API Features HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer...

CVE-2026-108933

A vulnerability was identified in Edimax BR-6208AC 1.32. Affected is an unknown function of the file /goform/formFilter. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about...

UBUNTU-CVE-2026-104140

QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 OGC API Features HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer...

CVE-2026-104140

QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 OGC API Features HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer...

CVE-2026-108935 Edimax BR-6208AC Port Forwarding formPortFw cross site scripting

A weakness has been identified in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the file /goform/formPortFw of the component Port Forwarding Page. Executing a manipulation can lead to cross site scripting. The attack may be performed from remote. The exploit has...

CVE-2026-108934

A security flaw exists in Edimax BR-6208AC version 1.32 within the HTTP Blocking Page component. The vulnerability resides in an unknown functionality of the file /goform/formUrlb , where improper input handling allows for cross-site scripting (XSS) . This flaw can be exploited remotely , and a p...

CVE-2026-108934 Edimax BR-6208AC HTTP Blocking formUrlb cross site scripting

A security flaw has been discovered in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unknown functionality of the file /goform/formUrlb of the component HTTP Blocking Page. Performing a manipulation results in cross site scripting. The attack is possible to be carried out remotely...

CVE-2026-104140

QGIS Server is vulnerable to a Stored Cross-Site Scripting (XSS) flaw in the WFS3 (OGC API Features) HTML responses. The root cause is the lack of HTML escaping for feature attribute values processed via QgsServerOgcApiHandler::htmlDump and the if_nullptr_null_str callback. An attacker can inject...

CVE-2026-104140 QGIS: Stored XSS in WFS3 getFeatures HTML page via unescaped feature attribute values

QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 OGC API Features HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer...

CVE-2026-104140 QGIS: Stored XSS in WFS3 getFeatures HTML page via unescaped feature attribute values

QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 OGC API Features HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer...