1137610 matches found
WordPress SQL Chart Builder has a cross-site scripting vulnerability
WordPress SQL Chart Builder 3.0.6 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input sanitization and output escaping, allowing authenticated attackers with privileges of subscriber or higher to inject arbitrary web scripts. This...
WordPress TranslatePress cross-site scripting vulnerability
WordPress TranslatePress 3.3.7 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient cleaning of input for the comment parameter and inadequate escaping of output, resulting in stored cross-site scripting. This could allow unauthenticated...
WordPress Tutor LMS Cross-site Scripting Vulnerability
WordPress Tutor LMS versions 4.0.8 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input validation of the redirecturl parameter in the Topbar component’s return handler, making it susceptible to DOM-based cross-site scripting attacks...
InstantASP InstantForum.NET security vulnerabilities
The InstantASP InstantForum.NET 4.1.4 version has a security vulnerability. This vulnerability stems from a susceptibility to reflection-based cross-site scripting attacks. Inputs that are not properly cleaned in the query string parameters are directly reflected into the HTML response without...
Astra Linux – Vulnerability in Golang 1.15, Golang 1.19
Actions that insert URLs into the content attribute of HTML meta tags do not escape those URLs. This can lead to XSS attacks if the meta tag also contains an http-equiv attribute with the value “refresh”. A new GODEBUG setting, htmlmetacontenturlescape, has been added, which can be used to disabl...
Astra Linux – vulnerability in Zabbix
Reflected XSS attacks occur when a malicious script is reflected from a web application into the victim’s browser. The script can be triggered via action form fields, which are then submitted as requests to a website containing a vulnerability that allows execution of the malicious script...
Astra Linux – Vulnerability in Zabbix
A authenticated user can create a hosts group using the configuration with XSS payload, which will be available to other users. When XSS is stored by an authenticated malicious actor, and other users attempt to search for groups during the creation of new hosts, the XSS payload will activate,...
Astra Linux – Vulnerability in Zabbix
Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected from a web application to the victim’s browser. The script is activated through a link, which sends a request to a website with a vulnerability that allows the execution of malicious scripts...
Astra Linux – Vulnerability in jsoup
jsoup is a Java HTML parser designed for HTML editing, cleaning, scraping, and XSS Cross-Site Scripting protection. However, jsoup may incorrectly sanitize HTML containing javascript: URLs, which could allow XSS attacks when a user clicks on those links. If the non-default...
CVE-2026-97667
Sonatype Nexus Repository 3 is vulnerable to Stored Cross-Site Scripting (XSS) in its Browse UI. An account with edit permissions on a hosted R repository can inject script content into the metadata of an uploaded R package. When another user views the package details in the Browse UI, the script...
EUVD-2026-102154
Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the...
CVE-2026-97667 Nexus Repository 3 - Stored Cross-Site Scripting in Browse UI
Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the...
CVE-2026-97667 Nexus Repository 3 - Stored Cross-Site Scripting in Browse UI
Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the...
CVE-2026-111096
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible...
EUVD-2026-102148
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible...
CVE-2026-111096
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible...
CVE-2026-111095
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible...
CVE-2026-111095
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible...
CVE-2026-111095
JetBrains TeamCity versions before 2026.2 , 2026.1.4 , and 2025.11.8 are vulnerable to a stored Cross-Site Scripting (XSS) flaw. The vulnerability exists within the classic project overview component, where improper neutralization of input during web page generation allows for script execution. T...