CVE-2026-92986

SiYuan before 3.8.4 is affected by a Cross-Site Scripting (XSS) vulnerability in the backlink dock tree , where document titles are rendered as HTML without escaping markup characters. An attacker can set a malicious title via the rename API or crafted notebooks, executing scripts in the Electron...

CVE-2026-92985

SiYuan versions before 3.8.4 are affected by a Cross-Site Scripting (XSS) vulnerability in bookmark labels imported from ".sy" notebook files. The root cause is a failure to escape HTML in bookmark attributes when rendering them in the dock tree . Because SiYuan runs on Electron , injected script...

EUVD-2026-81622

SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock tree. Attackers can craft malicious .sy notebook files with unescaped HTML in bookmark attributes that execute scripts in the Electron renderer with access to childprocess for...

WordPress RT Mega Menu plugin <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pointer_menu_item' Block Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'pointermenuitem' Block Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg versions = 1.5.2...

DEBIAN-CVE-2026-92973

ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that fails to validate or escape URL targets. Attackers controlling ANSI text input can inject javascript: schemes or terminate href attributes to execute arbitrary scripts in the...

CVE-2026-92973

ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that fails to validate or escape URL targets. Attackers controlling ANSI text input can inject javascript: schemes or terminate href attributes to execute arbitrary scripts in the...

CVE-2026-90887

Unauthenticated Cross Site Scripting XSS in WP Inventory Manager = 2.5.4 versions...

CVE-2026-90986

Unauthenticated Cross Site Scripting XSS in Visitor Traffic Real Time Statistics Pro = 11.21 versions...

CVE-2026-78294

Contributor Cross Site Scripting XSS in Geo Mashup = 1.13.21 versions...

CVE-2026-66617

Contributor Cross Site Scripting XSS in PublishPress Series = 3.1.3 versions...

CVE-2026-66576

Contributor Cross Site Scripting XSS in JetBlocks For Elementor = 1.5.2 versions...

CVE-2026-66577

Contributor Cross Site Scripting XSS in JetSearch = 3.6.3 versions...

CVE-2026-66578

Contributor Cross Site Scripting XSS in PropertyHive = 2.2.6 versions...

CVE-2026-66572

Contributor Cross Site Scripting XSS in JetBlog = 2.4.10 versions...

CVE-2026-66573

Contributor Cross Site Scripting XSS in JetTabs = 2.3.3.1 versions...

XSStrike

XSStrike 高度なXSS検出スイート...

CVE-2022-29598

CVE-2022-29598 : RSS v500 におけるリフレクト型クロスサイトスクリプティング XSS Mitre URL: https://vulners.com/cve/CVE-2022-29598 NIST URL: https://nvd.nist.gov/vuln/detail/CVE-2022-29598 Solutions Atlantic 社製の RRS v500 アプリケーションは、リフレクト型クロスサイトスクリプティング XSS の脆弱性の影響を受けます。XSS...

CVE-2022-36433

CVE-2022-36433 Amasty Blog Pro for Magento 2 中博客文章创建功能的跨站脚本（XSS） 描述 Amasty Blog Pro 2.10.3 插件（适用于 Magento 2）的博客文章创建功能允许在 shortcontent 和 fullcontent 字段中注入 JavaScript 代码，导致管理面板用户通过 posts/preview 或 posts/save 受到 XSS 攻击。 以下是上述参数的易受攻击端点（注入点）： POST /admin/amastyblog/posts/preview/key/somekey/?isAjax=tr...

Azure Portal Spoofing Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in Azure Portal allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-92973

ansi2html (a Python library by pycontribs ) versions 1.7.0a0 through 1.9.3 contain a cross-site scripting (XSS) vulnerability in OSC 8 hyperlink handling . The root cause is the failure to validate or escape URL targets, allowing attackers who control ANSI text input to inject javascript: schemes...