EUVD-2026-97264

An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page. This issue affects OTRS: 7.0.X 8.0.X 2023.X 2024.X 2025.X 2026.X before 2026.7.X...

CVE-2026-108802

A weakness has been identified in yproject RuoYi up to 4.8.3. This affects the function renderDrawer of the file /system/dict/data/add of the component Dictionary Data Drawer Preview. Executing a manipulation of the argument cssClass can lead to cross site scripting. The attack may be performed...

CVE-2025-15703

The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability Administrator by default to store a...

CVE-2025-15703 WP Job Openings < 4.0.0 - Admin+ Stored XSS

The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability Administrator by default to store a...

CVE-2025-15703

The HireZoot WordPress plugin versions prior to 4.0.0 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to properly sanitise and escape one of the job specification settings before it is reflected on an admin-area settings page. This allows users with management cap...

EUVD-2025-211060

The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability Administrator by default to store a...

EUVD-2026-97234

A weakness has been identified in yproject RuoYi up to 4.8.3. This affects the function renderDrawer of the file /system/dict/data/add of the component Dictionary Data Drawer Preview. Executing a manipulation of the argument cssClass can lead to cross site scripting. The attack may be performed...

0l4bs

0l4bs Laboratorios de Cross-site scripting para entusiastas de la seguridad de aplicaciones web Lista de Desafíos : Desafío 1 | URL Desafío 2 | Form Desafío 3 | User-Agent Desafío 4 | Referrer Desafío 5 | Cookie Desafío 6 | LocalStorage Desafío 7 | Login Page Desafío 8 | File Upload Desafío 9 |...

EulerOS 2.0 SP11 : golang (EulerOS-SA-2026-4232)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.CVE-2026-42499 If a trusted template...

TencentOS Server 3: xmlrpc-c (TSSA-2026:1119)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1119 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

CVE-2026-108933: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in Edimax BR-6208AC 1.32. Affected is an unknown function of the file /goform/formFilter. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about...

PT-2026-110982

Name of the Vulnerable Software and Affected Versions Edimax BR-6208AC version 1.32 Description A security flaw exists in the HTTP Blocking Page component. A remote attacker can perform a manipulation of the /goform/formUrlb endpoint to execute cross site scripting, which is a technique used to...

CVE-2026-48212: Improper Neutralization of Input During Web Page Generation

An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page. This issue affects OTRS: 7.0.X 8.0.X 2023.X 2024.X 2025.X 2026.X before 2026.7.X...

PT-2026-111090

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics versions 2.0 through 2.1 Description An authenticated user can embed arbitrary JavaScript code into the Web UI. This stored cross-site scripting issue allows for the alteration of intended functionality, which could...

CVE-2025-15703: Improper Neutralization of Input During Web Page Generation

The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability Administrator by default to store a...

CVE-2026-109612: Improper Neutralization of Input During Web Page Generation

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored record names into markup without escaping. Authenticated users able to create records can store crafted record names that execute script in the...

PT-2026-110545

Name of the Vulnerable Software and Affected Versions Cairo-dock Glx-Dock versions prior to 3.4.1 Description Remote cross site scripting is possible due to improper processing of the p argument within the Query Parameter Handler component in the ww page.php file. Cross site scripting is a...

PT-2026-110613

Name of the Vulnerable Software and Affected Versions Thelia version 2.6.0 Description Reflected Cross-Site Scripting XSS occurs because Smarty templates address.html and address-update.html do not properly escape double quotes in the next parameter. This allows an attacker to execute arbitrary...

CVE-2026-109604: Improper Neutralization of Input During Web Page Generation

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into markup without escaping. An authenticated user able to create such records can give them malicious names, executing script in the...

EulerOS 2.0 SP13 : xmlrpc-c (EulerOS-SA-2026-4206)

According to the versions of the xmlrpc-c packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting XSS vulnerability in the error page...