MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection
CVE-2026-85230
A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widge
#cwe-79
共收录 5426 条相关情报。
← 返回所有主题Reflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes Parameters
CVE-2026-85227
MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query builder. The t
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold allows Reflected XSS. This issue affects Enfold: from n/a th...
CVE-2026-84815
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold allo
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href attribute after isSaf...
CVE-2026-85159
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cance
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comment with zero escap...
CVE-2026-85158
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes
A vulnerability was identified in langgenius dify 1.13.0. Affected by this vulnerability is the function router.replace of the file web/app/(shareLayout)/webapp-signin/component...
CVE-2026-85022
A vulnerability was identified in langgenius dify 1.13.0. Affected by this vulnerability is the function router.replace
A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of the file web/app/(shareLayout)/components/splash.tsx of the component Splash...
CVE-2026-85021
A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of the file web/app/(s
Joomla Extension - j2commerce.com - Reflected XSS via `filter_tag`, `pricefrom` and `priceto` in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - Four task handlers accepted a ...
CVE-2026-78000
Joomla Extension - j2commerce.com - Reflected XSS via `filter_tag`, `pricefrom` and `priceto` in J2Store 1.0.0-3.3.21, 4
A stored Cross-Site Scripting (XSS) vulnerability in the notification template functionality of the endpoint /ocsreports/?function=notification. A user with administrator privil...
CVE-2026-76178
A stored Cross-Site Scripting (XSS) vulnerability in the notification template functionality of the endpoint /ocsreports
The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `skype_url` shortcode attribute of the Social Media Follow module in all versions up to, and in...
CVE-2026-3852
The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `skype_url` shortcode attribute of the
The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘postBodyCss’ pa...
CVE-2026-2573
The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerabl
langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting
CVE-2026-85022
A vulnerability was identified in langgenius dify 1.13.0. Affected by this vulnerability is the function router.replace
langgenius dify Splash Layout splash.tsx router.replace cross site scripting
CVE-2026-85021
A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of the file web/app/(s
DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)
CVE-2026-68921
## Summary `@dicebear/core` builds avatar SVGs from caller-supplied options. The numeric `rotate` option is interpolate
SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scripting...
CVE-2026-75134
SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scripting vulnerability that allows authenti
SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scripting vulnerability that allows authenticated contributors to inject malicious JavaScript by expl...
CVE-2026-75134
SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scripting vulnerability that allows authenti
Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names,...
CVE-2026-84677
Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names, descriptions, and versio
Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin...
CVE-2026-84673
Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin's appearance configura
Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard...
CVE-2026-84665
Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log...
CVE-2026-84648
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source