#cwe-79

共收录 5426 条相关情报。

漏洞预警2026-09-05 发布INFO

The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'consent_message' JSON Attribute in .qlwapp data-box in all vers...

CVE-2026-18404

The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'consen

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-05 发布INFO

The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event attribute values in all versions up to, a...

CVE-2025-14945

The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scri

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-05 发布MEDIUM

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still apply |raw('html') to field.label / field.hint in attribute and label-body cont...

CVE-2026-52772

YesWiki是一个基于PHP的开源wiki系统，用于团队协同编辑与知识管理。在4.6.6版本之前，其Bazar表单字段模板在处理字段标签（field.label）和字段提示（field.hint）时，错误地继续使用`|raw('html'

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-116

漏洞预警2026-09-04 发布INFO

Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An attacker can creat...

CVE-2026-73848

Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded w

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-04 发布INFO

Emlog is an open source website building system. In versions 2.6.29 and prior, article content is processed by Parsedown without enabling safe mode, which means raw HTML includi...

CVE-2026-53758

Emlog is an open source website building system. In versions 2.6.29 and prior, article content is processed by Parsedown

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-04 发布INFO

In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended to the URL.

CVE-2022-35499

In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via inject

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-04 发布INFO

IBM Langflow OSS 1.0.0 through 1.11.2 suffer from a stored cross-site scripting vulnerability in the Playground chat interface.

CVE-2026-8447

IBM Langflow OSS 1.0.0 through 1.11.2 suffer from a stored cross-site scripting vulnerability in the Playground chat int

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-04 发布INFO

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems I...

CVE-2026-19727

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Yordam Information

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-04 发布INFO

It’s possible to run a stored XSS in Stormshield’s web administration panel. To exploit this vulnerability, a SNS administrator with appropriate permissions must inject some...

CVE-2026-14466

It’s possible to run a stored XSS in Stormshield’s web administration panel. To exploit this vulnerability, a SNS adm

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-04 发布INFO

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems I...

CVE-2026-77818

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Yordam Information

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-04 发布INFO

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Stored XSS. This ...

CVE-2026-19057

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Gastromenum Gastro

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-04 发布INFO

OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon that allows remote attackers to execute scri...

CVE-2026-85613

OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-04 发布INFO

Grav Admin before 2.0.20 fails to sanitize output from marked.parse() before injecting it into the DOM via Svelte's {@html} directive in MarkdownEditor and MarkdownModal compone...

CVE-2026-85601

Grav Admin before 2.0.20 fails to sanitize output from marked.parse() before injecting it into the DOM via Svelte's {@ht

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-04 发布INFO

Grav Admin (getgrav/grav-plugin-admin2) versions <= 2.0.19 contain a stored cross-site scripting vulnerability in the tHtml() function (src/lib/stores/i18n.svelte.ts), which sub...

CVE-2026-85600

Grav Admin (getgrav/grav-plugin-admin2) versions , ", or ', allowing an attacker to register a username containing an HT

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-04 发布INFO

Grav Shortcode Core before 6.2.5 contains stored cross-site scripting vulnerabilities in the [lorem] tag parameter and [details] summary parameter that are written to rendered p...

CVE-2026-85599

Grav Shortcode Core before 6.2.5 contains stored cross-site scripting vulnerabilities in the [lorem] tag parameter and [

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-04 发布INFO

Grav versions 2.0.0 through 2.0.17 fail to apply save-time XSS detection to modular pages, allowing authenticated page editors to store Twig-assembled XSS payloads. Attackers wi...

CVE-2026-85598

Grav versions 2.0.0 through 2.0.17 fail to apply save-time XSS detection to modular pages, allowing authenticated page e

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-04 发布INFO

phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks() that calls html_entity_decode() on sanitized FAQ conte...

CVE-2026-85593

phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-04 发布INFO

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php that allows unauthenticated attackers to inject arbitrary JavaScript by ...

CVE-2026-85577

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php that allows una

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-04 发布INFO

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Menulux Software Inc. Menulux Portal allows Stored XSS. This issue affects...

CVE-2026-18957

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Menulux Software I

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

安全公告2026-09-04 发布INFO

Grav Admin before 2.0.20 Cross-Site Scripting via marked.js

CVE-2026-85601

Grav Admin before 2.0.20 fails to sanitize output from marked.parse() before injecting it into the DOM via Svelte's {@ht

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79