PT-2026-113304

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

PT-2026-111300

Name of the Vulnerable Software and Affected Versions Firefox for iOS versions prior to 157.1 Description Firefox for iOS directly interpolated the page HTML language attribute into translation JavaScript. This allows attacker-controlled markup to execute code within the privileged content world ...

PT-2026-111802

Name of the Vulnerable Software and Affected Versions Adobe Commerce affected versions not specified Description A stored Cross-Site Scripting XSS issue allows attackers to inject malicious scripts into vulnerable form fields. When a victim visits the page containing the affected field, the...

CVE-2024-34326

The ProPhoenix Law RMS v2022.2403.3.101 software contains a reflected cross-site scripting (XSS) vulnerability. The flaw exists in the errorHandler.aspx endpoint, specifically triggered via the PageTitle , Alert , or MsgType parameters. Exploitation details and specific remediation instructions a...

PT-2026-113313

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

PT-2026-113371

Symantec Endpoint Detection and Response SEDR Console, prior to 4.13, may be susceptible to a Cross-Site Scripting XSS vulnerability, which is a type of issue whereby an attacker may attempt to inject malicious script that executes in the context of another user’s session, potentially resulting i...

PT-2026-113309

Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...

Microsoft SharePoint: CVE-2026-88208: Microsoft Office SharePoint Spoofing Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

XSS vulnerability in Shopware 6 enables Admin Token Theft and RCE

Overview Shopware 6.7 contains a stored cross-site scripting XSS vulnerability in its media upload functionality that can lead to administrator credential compromise and remote code execution. Description Shopware is an open-source e-commerce platform used to build and manage online stores. It...

CVE-2026-104587

The blob42 gosuki application (through commit 6e2bf34 ) is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is the use of text/template instead of html/template, which leads to a failure in performing context-aware auto-escaping on the URL and DisplayURL fields with...

VulnCheck KEV: CVE-2024-9417

The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to limited file uploads due to a misconfigured file type validation in the 'handleUpload' function in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to upload files that are...

CVE-2026-104587

blob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scripting XSS vulnerability. The application uses text/template instead of html/template, failing to perform context-aware auto-escaping on the URL and DisplayURL fields of bookmarks in internal/webui/templates/bookmarks.html. An...

PT-2026-113311

Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...

CVE-2026-63352: Improper Neutralization of Input During Web Page Generation

Affected devices do not properly sanitize calculated signal data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace...

CVE-2026-110224: Improper Neutralization of Input During Web Page Generation

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in AdminSearchConfController::processSave that echoes rejected alias and search values unescaped in validation errors. Attackers can induce an authenticated back-office user to submit a crafted request, executing...

CVE-2026-110219: Improper Neutralization of Input During Web Page Generation

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject scripts through the price parameter of the back-office Additional Facilities form. Attackers can induce an authenticated back-office user to submit a crafted request whose unescape...

CVE-2026-102864: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

CVE-2026-63357: Improper Neutralization of Input During Web Page Generation

Affected devices do not properly sanitize calculated signal data contained in imported calculated signal files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially craft...

CVE-2026-63356: Improper Neutralization of Input During Web Page Generation

Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a...

CVE-2026-63355: Improper Neutralization of Input During Web Page Generation

Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially...