共收录 5770 条相关情报。
← 返回所有主题CVE-2026-40507
OpenEMR before 8.3.0 contains a reflected cross-site scripting vulnerability in the patient portal template import handl
CVE-2026-18756
HumHub Community Edition 1.18.4 contains a reflected cross-site scripting vulnerability in the Space membership-request
CVE-2026-18526
HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting (XSS) vulnerability in the oEmbed c
CVE-2026-75917
SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file-tree picker's hover-tooltip generation (a
CVE-2026-75916
SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '((' block-reference autocomplete hint popup.
CVE-2026-73354
Unauthenticated Cross Site Scripting (XSS) in SimplyRETS Real Estate IDX <= 3.2.8 versions.
CVE-2026-73184
Unauthenticated Cross Site Scripting (XSS) in Global Gallery <= 11.1.2 versions.
CVE-2026-73182
Unauthenticated Cross Site Scripting (XSS) in BBQ Pro <= 3.9 versions.
CVE-2026-66596
Unauthenticated Cross Site Scripting (XSS) in Newsletter <= 9.3.3 versions.
CVE-2026-61986
Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.5 versions.
CVE-2026-18372
CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arb
CVE-2026-18371
HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user inte
CVE-2026-75981
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthentica
CVE-2026-15780
The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored C
CVE-2026-15446
The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load A
CVE-2026-19056
The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it i
CVE-2026-19055
The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecti
CVE-2026-18202
The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising t
CVE-2026-16617
The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before o
CVE-2026-16570
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string para