In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads
CVE-2026-86491
In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads
#cwe-79
共收录 5426 条相关情报。
← 返回所有主题In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS
CVE-2026-86484
In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS
In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible
CVE-2026-86483
In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible
Affected versions of MISP insufficiently validate URLs used by dashboard widgets, particularly the Button widget. The widget's URL is stored configuration controlled by a user...
CVE-2026-86440
Affected versions of MISP insufficiently validate URLs used by dashboard widgets, particularly the Button widget. The
league/commonmark (thephpleague/commonmark) versions >= 2.7.0 and < 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute name wi...
CVE-2026-86431
league/commonmark (thephpleague/commonmark) versions >= 2.7.0 and < 2.9.1 contain a cross-site scripting vulnerability i
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biograp...
CVE-2026-6431
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is v
commonmark before 2.9.1 XSS via AttributesExtension form feed bypass
CVE-2026-86431
league/commonmark (thephpleague/commonmark) versions >= 2.7.0 and < 2.9.1 contain a cross-site scripting vulnerability i
MISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLs
CVE-2026-86440
Affected versions of MISP insufficiently validate URLs used by dashboard widgets, particularly the Button widget. The
A vulnerability has been found in code-projects Hospital Information System 1.0. Affected is an unknown function of the file /HIS/src/patients/editPatient.php of the component P...
CVE-2026-86301
A vulnerability has been found in code-projects Hospital Information System 1.0. Affected is an unknown function of the
Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the appl...
CVE-2026-78325
Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allow
The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. This is d...
CVE-2026-2390
The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processi
XSS in Standard Notes on Android via Malicious Google Keep and Evernote HTML Import
CVE-2026-78325
Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allow
A vulnerability has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this issue is some unknown functionality of the file save-settings.php of the com...
CVE-2026-86294
A vulnerability has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this issue is some unkno
A vulnerability was found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The affected element is an unknown function of the file manage_subject...
CVE-2026-86278
A vulnerability was found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The affected
Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that...
CVE-2026-86197
Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and ad
AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing...
CVE-2026-86188
AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to
Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav\Common\Assets without proper output ...
CVE-2026-86197
Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and ad
AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers vi...
CVE-2026-86188
AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to
Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox
CVE-2026-86197
Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and ad
AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting
CVE-2026-86188
AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to