Unauthenticated Cross Site Scripting (XSS) in Quill Forms <= 5.7.1 versions.
CVE-2026-28568
Unauthenticated Cross Site Scripting (XSS) in Quill Forms <= 5.7.1 versions.
#cwe-79
共收录 5770 条相关情报。
← 返回所有主题DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can su...
CVE-2026-75838
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hoo
Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php). All XSS detection patterns u...
CVE-2026-75834
Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss() function (system/sr
Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment ...
CVE-2026-75831
Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through t
Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quotes in unquoted attribute values bypass event-handler detec...
CVE-2026-75828
Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quote
Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in form templates. Atta...
CVE-2026-75107
Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, secti
Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exact extension 'svg', allowing .svgz and .xhtml files to byp...
CVE-2026-74908
Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exac
SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAd...
CVE-2026-74902
SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to esca
SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with...
CVE-2026-75626
SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and me
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fileorbis Informatics Services Trade Inc. FileOrbis allows Stored XSS. Thi...
CVE-2026-19447
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fileorbis Informat
The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7....
CVE-2026-75091
The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-
A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This...
CVE-2026-75078
A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown par
A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected...
CVE-2026-75077
A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some u
A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /BSCE2.php. Such manipul...
CVE-2026-75077
A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some u
Pandora contains a stored cross-site scripting (XSS) vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted dir...
CVE-2026-75531
Pandora contains a stored cross-site scripting (XSS) vulnerability in the rendering of URL observables. A URL extracted
Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality. The /task-download/<task_id>/.../pdf endpoint verifies that the submitted f...
CVE-2026-75529
Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality. The /task-download
Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpoint /airag/chat/upload
CVE-2026-67925
Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpo
ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() can pass disallowed executable markup through packages/sanitize-html/index.js ...
CVE-2026-63670
ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() can pass disallowed e
Etherpad has stored XSS in HTML export via unescaped attribute-pool values
CVE-2026-55090
Fix: PR #7905 (ether/etherpad). `getHTMLFromAtext` in `src/node/utils/ExportHtml.ts` interpolates values from the `expo
In JetBrains PyCharm before 2026.2.1 code execution via Quick Documentation was possible
CVE-2026-75059
In JetBrains PyCharm before 2026.2.1 code execution via Quick Documentation was possible