CVE-2024-6783

CVE-2024-6783 - Vue CVE A vulnerability has been discovered in Vue, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as Object.prototype.staticClass or Object.prototype.staticStyle to execute arbitrary JavaScript...

CVE-2025-60503

CVE-2025-60503 — Cross-Site Scripting XSS Memorizzato in UltimatePOS UltimateFosters v4.8 Data di pubblicazione: 2025-10-30 ID CVE: CVE-2025-60503 RISERVATO Ricercatore: Vivien Lebas Fornitore: UltimateFosters Prodotto: UltimatePOS Versione affetta: 4.8 Tipo di vulnerabilità: Cross-Site Scripting...

CVE-2022-1175

CVE-2022-1175 Gitlab Stored XSS, kann in einem Issue eines Projekts platziert werden, entweder in einem eigenen oder in einem fremden. Ermöglicht Angriffe wie das Erstellen und Stehlen eines Personal Access Tokens PAT von jedem, der ein Issue besucht. PATs können dann vollen Gitlab-API-Zugriff al...

CVE-2026-6286

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via customer name fields in versions up to and including 2.2. This is due to an authentication bypass where the AddBookingCommand explicitly skips nonce verification...

CVE-2026-4246

The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's' parameter of the Advanced Search REST endpoint in all versions up to, and including, 4.10.1 due to insufficient input sanitization and output escaping. The REST endpoint at...

CVE-2026-47423-dompurify-xss-detector

DOMPurify . Invece di fare affidamento su commenti del sorgente facilmente rimovibili o variabili di versione, questo strumento esegue il fingerprinting logico su bundle JavaScript di produzione minimizzati per identificare layout di tag consentiti non corretti. Riepilogo della vulnerabilità Nell...

CVE-2024-48197

CVE-2024-48197 XSS riflesso in AudioCodes MP-202b Descrizione La vulnerabilità Cross Site Scripting in Audiocodes MP-202b v.4.4.3 consente a un attaccante remoto di elevare i privilegi tramite la pagina di login dell'interfaccia web. Informazioni aggiuntive N/D Tipo di vulnerabilità Cross Site...

CVE-2026-78071 Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar...

CVE-2026-78071

DP Calendar is a Joomla extension by digital-peak.com. Versions 7.0.0 through 10.11.2 are affected by an authenticated, privileged stored XSS . The root cause is that the location title is rendered in a data attribute without proper escaping. Exploitation requires an authenticated user with the c...

CVE-2026-78071 Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar...

EUVD-2026-67653

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar...

EUVD-2026-67652

Joomla Extension - mrvinoth.com - Reflected XSS in All Video Share 1.0.0-4.5.0 - Various user supplied inputs lacked escaping, leading to reflected XSS vectors...

CVE-2026-78073 Joomla Extension - j2commerce.com - Reflected XSS attribute in All Video Share 1.0.0-4.5.0

Joomla Extension - mrvinoth.com - Reflected XSS in All Video Share 1.0.0-4.5.0 - Various user supplied inputs lacked escaping, leading to reflected XSS vectors...

CVE-2026-78073

All Video Share (Joomla extension by mrvinoth.com, versions 1.0.0–4.5.0 ) is vulnerable to reflected XSS caused by various user-supplied inputs lacking proper escaping. The vulnerability allows an attacker to inject malicious scripts that execute in a victim's browser upon clicking a crafted link...

CVE-2026-78073 Joomla Extension - j2commerce.com - Reflected XSS attribute in All Video Share 1.0.0-4.5.0

Joomla Extension - mrvinoth.com - Reflected XSS in All Video Share 1.0.0-4.5.0 - Various user supplied inputs lacked escaping, leading to reflected XSS vectors...

CVE-2022-32988

CVE-2022-32988 Prodotti interessati Non abbiamo ancora testato modelli Asus diversi da quelli elencati. Tuttavia sospettiamo che possa funzionare anche su altri modelli con la stessa versione del firmware. root@kitploit: DSL-N14UB1 V.1.1.2.3805 Panoramica Nel router Asus DSL-N14U-B1 1.1.2.3805 è...

EUVD-2026-67649

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'giveform' shortcode in all versions up to, and including, 4.14.4. This is due to insufficient input sanitization and output escaping on the continuebuttontitle and...

CVE-2026-5510

GiveWP – Donation Plugin and Fundraising Platform for WordPress is vulnerable to Stored Cross-Site Scripting via the give_form shortcode in all versions up to and including 4.14.4 . The root cause is insufficient output escaping on the continue_button_title and display_style shortcode attributes,...

CVE-2026-5510 GiveWP <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'giveform' shortcode in all versions up to, and including, 4.14.4. This is due to insufficient input sanitization and output escaping on the continuebuttontitle and...

EUVD-2026-67648

The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wmbackupspath' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on user-supplied attributes combine...