1137592 matches found
WordPress NotificationX Cross-Site Script Vulnerability
WordPress NotificationX versions 3.3.3 and earlier have a cross-site scripting vulnerability. This vulnerability stems from stored-xss attacks via the ‘name’ parameter. Due to insufficient input sanitization and output escaping, unauthenticated attackers can inject arbitrary web scripts, which wi...
WordPress Opti-Behavior Cross-Site Script Vulnerability
WordPress Opti-Behavior 1.9.2.1 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient cleaning of the 'countryname' Location parameter input and inadequate escaping of output data. Unauthenticated attackers can inject arbitrary web scripts,...
SiteOrigin CSS Cross-Site Scripting Vulnerabilities
SiteOrigin CSS 1.6.7 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from improper input cleaning and output escaping. It involves a DOM-based cross-site scripting attack via the 'url commentauthorurl' parameter. Unauthenticated attackers can inject...
WordPress PowerPack Addons for Elementor: Cross-site Script Vulnerabilities
WordPress PowerPack Addons for Elementor 3.1.0 and earlier versions contain a cross-site scripting vulnerability. This vulnerability arises from improper input during web page generation, and could lead to storage-based cross-site scripting attacks...
WordPress SQL Chart Builder has a cross-site scripting vulnerability
WordPress SQL Chart Builder 3.0.6 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input sanitization and output escaping, allowing authenticated attackers with privileges of subscriber or higher to inject arbitrary web scripts. This...
WordPress TranslatePress cross-site scripting vulnerability
WordPress TranslatePress 3.3.7 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient cleaning of input for the comment parameter and inadequate escaping of output, resulting in stored cross-site scripting. This could allow unauthenticated...
Astra Linux – Vulnerability in Golang 1.15, Golang 1.19
Actions that insert URLs into the content attribute of HTML meta tags do not escape those URLs. This can lead to XSS attacks if the meta tag also contains an http-equiv attribute with the value “refresh”. A new GODEBUG setting, htmlmetacontenturlescape, has been added, which can be used to disabl...
Astra Linux – vulnerability in Zabbix
Reflected XSS attacks occur when a malicious script is reflected from a web application into the victim’s browser. The script can be triggered via action form fields, which are then submitted as requests to a website containing a vulnerability that allows execution of the malicious script...
Astra Linux – Vulnerability in Zabbix
A authenticated user can create a hosts group using the configuration with XSS payload, which will be available to other users. When XSS is stored by an authenticated malicious actor, and other users attempt to search for groups during the creation of new hosts, the XSS payload will activate,...
Astra Linux – Vulnerability in Zabbix
Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected from a web application to the victim’s browser. The script is activated through a link, which sends a request to a website with a vulnerability that allows the execution of malicious scripts...
Astra Linux – Vulnerability in jsoup
jsoup is a Java HTML parser designed for HTML editing, cleaning, scraping, and XSS Cross-Site Scripting protection. However, jsoup may incorrectly sanitize HTML containing javascript: URLs, which could allow XSS attacks when a user clicks on those links. If the non-default...
CVE-2026-97667
Sonatype Nexus Repository 3 is vulnerable to Stored Cross-Site Scripting (XSS) in its Browse UI. An account with edit permissions on a hosted R repository can inject script content into the metadata of an uploaded R package. When another user views the package details in the Browse UI, the script...
EUVD-2026-102154
Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the...
CVE-2026-97667 Nexus Repository 3 - Stored Cross-Site Scripting in Browse UI
Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the...
CVE-2026-97667 Nexus Repository 3 - Stored Cross-Site Scripting in Browse UI
Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the...
CVE-2026-111096
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible...
EUVD-2026-102148
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible...
CVE-2026-111096
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible...