Winter: Stored XSS through Backend List widget image columns
### Impact `Backend\Widgets\Lists::evalImageTypeValue()` interpolated the resolved image URL into a single-quoted `src`
#cwe-79
共收录 5770 条相关情报。
← 返回所有主题django CMS: Stored XSS in edit-mode plugin exception rendering
CVE-2026-75526
## Summary When plugin rendering fails in edit mode, django CMS renders a `cms-rendering-exception` block so editors ca
Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MG_ENABLE_DIRLIST ...
CVE-2026-73259
Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-enco
Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting...
CVE-2026-73254
Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML pa
Mongoose: Stored XSS via unescaped filenames in directory listing
CVE-2026-73254
Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML pa
lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be ...
CVE-2026-49825
lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.def
lxml: javascript: URL bypass in Cleaner via xlink:href
CVE-2026-49825
lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.def
ATutor is vulnerable to Reflected XSS via popup parameter in preview.php. An authenticated attacker can inject a double quote into the popup parameter, break out of the attribut...
CVE-2026-64972
ATutor is vulnerable to Reflected XSS via popup parameter in preview.php. An authenticated attacker can inject a double
ATutor is vulnerable to Reflected XSS in restore functionality. An attacker can provide a specially crafted URL that, when opened, results in arbitrary JavaScript execution in t...
CVE-2026-64971
ATutor is vulnerable to Reflected XSS in restore functionality. An attacker can provide a specially crafted URL that, wh
ATutor is vulnerable to Stored Cross Site Scripting in registration functionality. An attacker can register a new account and enter a JavaScript payload in the phone field duri...
CVE-2026-64970
ATutor is vulnerable to Stored Cross Site Scripting in registration functionality. An attacker can register a new accou
n8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored cross-site scripting vulnerability in the Form node's completion page. The completion page applied its sandboxing Conte...
CVE-2026-77072
n8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored cross-site scripting vulnerability in the Form node's completi
Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions.
CVE-2026-73402
Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions.
Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions.
CVE-2026-68564
Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions.
Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions.
CVE-2026-66673
Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions.
Unauthenticated Cross Site Scripting (XSS) in Form Maker by 10Web <= 1.15.46 versions.
CVE-2026-66616
Unauthenticated Cross Site Scripting (XSS) in Form Maker by 10Web <= 1.15.46 versions.
Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast Publisher <= 4.5.4 versions.
CVE-2026-66615
Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast Publisher <= 4.5.4 versions.
Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.2 versions.
CVE-2026-66614
Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.2 versions.
Unauthenticated Cross Site Scripting (XSS) in Aora <= 1.3.19 versions.
CVE-2026-66612
Unauthenticated Cross Site Scripting (XSS) in Aora <= 1.3.19 versions.
Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce <= 4.1.10 versions.
CVE-2026-66611
Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce <= 4.1.10 versions.
Unauthenticated Cross Site Scripting (XSS) in Advance Product Search <= 1.4.8 versions.
CVE-2026-66607
Unauthenticated Cross Site Scripting (XSS) in Advance Product Search <= 1.4.8 versions.