共收录 5426 条相关情报。
← 返回所有主题CVE-2026-15820
The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Photo Module 'attribu
CVE-2026-15796
The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'bg_video_service_url
CVE-2026-87870
The Ninja Forms - Scheduled Exports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Param
CVE-2026-87926
A flaw has been found in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This issue
CVE-2026-87923
A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. A
CVE-2026-87995
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 until 0.11.1, src/lib/
CVE-2026-75307
zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting (XSS) via SVG file upload through the /equipmentFile/upload endpo
CVE-2026-87995
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 until 0.11.1, src/lib/
CVE-2026-71803
money-pos 1.0 contains a stored Cross-Site Scripting (XSS) vulnerability. When processing returns, the backend fails to
CVE-2026-54694
SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a s
CVE-2026-54694
SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a s
CVE-2026-18147
A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerabi
CVE-2026-13359
The Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress plugin for WordPress is vulnerable to Sto
CVE-2026-13709
The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'iq
CVE-2026-87632
Cross-site scripting in SanitizerAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web ori
CVE-2026-84370
## Summary SVGO's opt-in `removeScripts` plugin failed to remove some executable links. Namespace-prefixed SVG anchors
CVE-2026-84369
## Summary SVGO's opt-in `removeScripts` plugin did not inspect executable HTML content inside SVG `` elements. Applica
CVE-2026-69417
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allo
CVE-2026-69402
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allo
CVE-2026-69356
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows