CVE-2026-108931 Netcore NR268 DHCP dhcp_dynamicip_show.cgi eval cross site scripting

A vulnerability was found in Netcore NR268 1.7.121109. This affects the function eval of the file dhcpdynamicipshow.cgi of the component DHCP Handler. The manipulation of the argument Hostname results in cross site scripting. The attack may be launched remotely. The exploit has been made public a...

CVE-2026-109565 Rapyd Admin 9.4.0 before 9.20.0 Stored XSS via select-list Component

Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log Author filter,...

CVE-2026-109565

Rapyd Admin versions 9.4.0 through 9.19.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The root cause is the unescaped rendering of self-registered display names within the Activity log Author filter . Unauthenticated attackers can register with a malicious HTML or JavaScr...

EUVD-2026-97888

Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log Author filter,...

CVE-2026-109565 Rapyd Admin 9.4.0 before 9.20.0 Stored XSS via select-list Component

Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log Author filter,...

EUVD-2026-97880

EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles. Attackers can set malicious names via MCP createnotebook, renamenotebook or creatememo tools, running script on drag wi...

EUVD-2026-97881

EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can write templates containing HTML event handlers through an API or MCP token t...

CVE-2026-109558

Versions 1.6.0 through 1.112.0 of EdgeEver are vulnerable to a stored cross-site scripting (XSS) vulnerability in the TemplatesPane.tsx component. The root cause is the rendering of template contentMarkdown as raw HTML using dangerouslySetInnerHTML without proper sanitization. An attacker can uti...

CVE-2026-109558 EdgeEver 1.6.0 through 1.112.0 Stored XSS via TemplatesPane Template Preview

EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can write templates containing HTML event handlers through an API or MCP token t...

CVE-2026-109557

Versions of EdgeEver through 1.112.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability located in the setMemoDragPreview function. An attacker can inject malicious scripts by setting compromised notebook names or memo titles using the MCP create_notebook , rename_notebook , or c...

CVE-2026-109557 EdgeEver through 1.112.0 Stored XSS via setMemoDragPreview Drag Preview

EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles. Attackers can set malicious names via MCP createnotebook, renamenotebook or creatememo tools, running script on drag wi...

CVE-2026-109558 EdgeEver 1.6.0 through 1.112.0 Stored XSS via TemplatesPane Template Preview

EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can write templates containing HTML event handlers through an API or MCP token t...

CVE-2026-109557 EdgeEver through 1.112.0 Stored XSS via setMemoDragPreview Drag Preview

EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles. Attackers can set malicious names via MCP createnotebook, renamenotebook or creatememo tools, running script on drag wi...

CVE-2025-27896

IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within ...

CVE-2025-27897

IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within ...

CVE-2025-27895

IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within ...

CVE-2026-108920

A security vulnerability has been detected in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file Admin/userrecord.php of the component Admin Record Tables. Such manipulation of the argument name/email leads to cross site scripting. The attack can be launch...

CVE-2026-108919

A weakness has been identified in SourceCodester Drug Recommendation System 1.0. The impacted element is an unknown function of the file Auth/addstudent.php of the component Student Registration. This manipulation of the argument txtname/txtpassword/txtemail/txtphone/txtpreviousschool causes cros...

EUVD-2025-211065

IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within ...

CVE-2025-27896 IBM Db2 Recovery Expert for Linux, Unix and Windows Cross-Site Scripting

IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within ...