PT-2026-110964

Name of the Vulnerable Software and Affected Versions Netcore NR268 version 1.7.121109 Description Cross site scripting occurs in the DHCP Handler component when the eval function in the dhcp dynamicip show.cgi file improperly handles the Hostname argument. This allows a remote attacker to execut...

PT-2026-110532

Name of the Vulnerable Software and Affected Versions Tuleap Enterprise Edition versions 17.0 through 17.5 Description A Stored Cross-site Scripting XSS issue exists, which could allow an attacker to execute arbitrary script code within the browser session of a user. Stored XSS occurs when a...

CVE-2026-108478: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.8...

PT-2026-110518

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.3...

PT-2026-110516

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Igor Funa Ad Inserter ad-inserter allows Stored XSS.This issue affects Ad Inserter: from n/a through 2.8.18...

CVE-2026-109345: Improper Neutralization of Input During Web Page Generation

DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because INPLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img...

CVE-2026-109328: Improper Neutralization of Input During Web Page Generation

Admidio 5.0.0 before 5.0.15 contains an unauthenticated stored cross-site scripting vulnerability in RegistrationPresenter.php, which inserts the raw FIRSTNAME registration value into an unencoded data-message attribute. Attackers can register with a double-quoted event handler that executes...

CVE-2026-107865: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetMenu jet-menu allows Stored XSS.This issue affects JetMenu: from n/a through 3.0.5...

CVE-2026-107866: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.3...

CVE-2026-107862: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7...

CVE-2026-108168: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in DLX Plugins Custom Query Blocks post-type-archive-mapping allows Stored XSS.This issue affects Custom Query Blocks: from n/a through 5.6.0...

CVE-2026-108908: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in Netcore NR268 1.7.121109. Affected by this vulnerability is the function eval of the file /router/l7callboarduserset.cgi of the component Web UI. Such manipulation of the argument title/note/URL/content leads to cross site scripting. The attack can be launched...

CVE-2026-108815: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in idcCMS 1.70. Affected is an unknown function of the file admin/memberdeal.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used...

CVE-2026-108834: Improper Neutralization of Input During Web Page Generation

A vulnerability was detected in Cairo-dock Glx-Dock up to 3.4.0. This issue affects some unknown processing of the file wwpage.php of the component Query Parameter Handler. Performing a manipulation of the argument p results in cross site scripting. The attack is possible to be carried out...

PT-2026-110707

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.11.1 through 0.11.3 Description Authenticated users can execute scripts by uploading crafted DOCX attachments. The issue resides in DocxPreview.svelte and occurs when attackers embed an OOXML altChunk HTML part or a...

CVE-2026-109290: Improper Neutralization of Input During Web Page Generation

Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading crafted DOCX attachments. Attackers can embed an OOXML altChunk HTML part or script-scheme hyperlink to steal a previewing...

CVE-2026-103524: Improper Neutralization of Input During Web Page Generation

Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface. User-supplied input is stored without sufficient output encoding or sanitization and is later rendered in the administrator interface and/or the web store's product pages, allowing arbitrary...

PT-2026-110604

Name of the Vulnerable Software and Affected Versions Thelia version 2.6.0 Description Multiple stored Cross-Site Scripting XSS issues exist within the administrative interface. User-supplied input is stored without sufficient output encoding or sanitization and is subsequently rendered in the...

PT-2026-110705

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.11.4 Description A stored cross-site scripting issue exists in the MarkdownInlineTokens.svelte component. The software renders markdown link URLs into anchor hrefs without validating the URL scheme. This allows...

PT-2026-110545

Name of the Vulnerable Software and Affected Versions Cairo-dock Glx-Dock versions prior to 3.4.1 Description Remote cross site scripting is possible due to improper processing of the p argument within the Query Parameter Handler component in the ww page.php file. Cross site scripting is a...