CVE-2026-109344: Improper Neutralization of Input During Web Page Generation

DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because INPLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. Attackers can supply markup with on handlers inside a wrapper removed by such hooks, leaving...

CVE-2026-18541: Improper Neutralization of Input During Web Page Generation

IBM Planning Analytics 2.0, and 2.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2026-109662: Improper Neutralization of Input During Web Page Generation

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability in a public portal form that accepts unauthenticated submissions and stores content later rendered with insufficient neutralisation. Unauthenticated attackers can submit crafted markup that...

CVE-2026-109671: Improper Neutralization of Input During Web Page Generation

Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages. Low-privilege attackers can store malicious script in the field that executes in the browser of any administrator...

CVE-2026-109670: Improper Neutralization of Input During Web Page Generation

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered without escaping. Attackers with write access to item master data can store malicious script in a record name that executes in the browser of any...

CVE-2026-109597: Improper Neutralization of Input During Web Page Generation

Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents or .Fragments.ToHTML output to inject...

CVE-2026-108935: Improper Neutralization of Input During Web Page Generation

A weakness has been identified in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the file /goform/formPortFw of the component Port Forwarding Page. Executing a manipulation can lead to cross site scripting. The attack may be performed from remote. The exploit has...

CVE-2024-58391: Improper Neutralization of Input During Web Page Generation

Frappe before 14.58.0 and 15.x before 15.4.0 contains a cross-site scripting vulnerability in printview because printview parameters are not escaped before being rendered. Remote attackers can craft a malicious printview URL that, when visited by a victim, injects HTML and executes script in the...

CVE-2026-108933: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in Edimax BR-6208AC 1.32. Affected is an unknown function of the file /goform/formFilter. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about...

CVE-2026-108931: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in Netcore NR268 1.7.121109. This affects the function eval of the file dhcpdynamicipshow.cgi of the component DHCP Handler. The manipulation of the argument Hostname results in cross site scripting. The attack may be launched remotely. The exploit has been made public a...

CVE-2023-54409: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability because the html2text function weakly sanitizes user input. Authenticated attackers can supply crafted HTML that is insufficiently sanitized by html2text, executing scripts in the browsers of users who vie...

CVE-2026-108934: Improper Neutralization of Input During Web Page Generation

A security flaw has been discovered in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unknown functionality of the file /goform/formUrlb of the component HTTP Blocking Page. Performing a manipulation results in cross site scripting. The attack is possible to be carried out remotely...

CVE-2026-108932: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in Netcore NR268 1.7.121109. This impacts the function eval of the file filterhostsdump.cgi of the component DHCP Hostname Handler. This manipulation of the argument Hostname causes cross site scripting. Remote exploitation of the attack is possible. The exploit has...

CVE-2026-105408: Improper Neutralization of Input During Web Page Generation

A Stored Cross-site Scripting XSS vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session...

CVE-2026-108898: Improper Neutralization of Input During Web Page Generation

A vulnerability was detected in Netis WF2409E 3.3.42541. This affects an unknown function of the component Wireless Settings. The manipulation of the argument SSID results in cross site scripting. The attack may be performed from remote. The exploit is now public and may be used. The vendor was...

CVE-2025-15703: Improper Neutralization of Input During Web Page Generation

The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability Administrator by default to store a...

PT-2026-110982

Name of the Vulnerable Software and Affected Versions Edimax BR-6208AC version 1.32 Description A security flaw exists in the HTTP Blocking Page component. A remote attacker can perform a manipulation of the /goform/formUrlb endpoint to execute cross site scripting, which is a technique used to...

CVE-2026-105409: Improper Neutralization of Input During Web Page Generation

A Stored Cross-site Scripting XSS vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session...

CVE-2026-109322: Improper Neutralization of Input During Web Page Generation

Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that executes in other...

PT-2026-110471

Name of the Vulnerable Software and Affected Versions y project RuoYi versions prior to 4.8.4 Description A remote cross site scripting issue exists in the Dictionary Data Drawer Preview component. The problem occurs within the renderDrawer function located in the /system/dict/data/add file. An...