CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled...

CVE-2026-71502

CTI-Transmute 是一个存在存储型跨站脚本（XSS）漏洞的应用。该漏洞源于服务端渲染用户可控数据时，对 Vue 模板表达式分隔符（默认配置为 [[ ... ]]）的中和不足。具体来说，未认证攻击者可以创建公开的转换（convers

历史摘要 · 未重新核验 · NVD

The Easy Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ...

CVE-2026-18988

The Easy Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordionTitleTag' block a

历史摘要 · 未重新核验 · GitHub Advisory

The Easy Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordionTitleTag' block attribute in versions up to, and including, 3.1.8. This is...

CVE-2026-18988

The Easy Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordionTitleTag' block a

历史摘要 · 未重新核验 · NVD

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to version 1.81.1 of the open source edition and 1.84.0 of the enterprise editio...

CVE-2026-48026

lakeFS 是一款将对象存储转换为类 Git 仓库的开源工具。其 Web UI 在渲染来自仓库对象的 Markdown 文件时，未对生成的 HTML 进行消毒处理，导致存储型跨站脚本（Stored XSS）漏洞。具体而言，在开源版 1.8

历史摘要 · 未重新核验 · NVD

Domoticz versions prior to 2026.3 contains a stored cross-site scripting vulnerability in the...

CVE-2026-11425

Domoticz versions prior to 2026.3 contains a stored cross-site scripting vulnerability in the mobile dashboard that allo

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability was identified in SourceCodester Photo Share Website 1.0. This affects an unknown...

CVE-2026-19230

A vulnerability was identified in SourceCodester Photo Share Website 1.0. This affects an unknown part of the file /soci

历史摘要 · 未重新核验 · GitHub Advisory

Domoticz versions prior to 2026.3 contains a stored cross-site scripting vulnerability in the mobile dashboard that allows authenticated attackers to inject arbitrary HTML and J...

CVE-2026-11425

Domoticz versions prior to 2026.3 contains a stored cross-site scripting vulnerability in the mobile dashboard that allo

历史摘要 · 未重新核验 · NVD

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the hidden scan command concatenates attacker-controlle...

CVE-2026-62293

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11

历史摘要 · 未重新核验 · NVD

A vulnerability was identified in SourceCodester Photo Share Website 1.0. This affects an unknown part of the file /social/ajax.php?action=save_upload of the component Comment I...

CVE-2026-19230

A vulnerability was identified in SourceCodester Photo Share Website 1.0. This affects an unknown part of the file /soci

历史摘要 · 未重新核验 · NVD

Nexus Repository 3 was found to be vulnerable to stored cross-site scripting (XSS). A user with...

CVE-2026-17596

Nexus Repository 3 was found to be vulnerable to stored cross-site scripting (XSS). A user with the nexus:blobstores:cre

历史摘要 · 未重新核验 · GitHub Advisory

A flaw has been found in SourceCodester Photo Share Website 1.0. The affected element is an...

CVE-2026-19209

A flaw has been found in SourceCodester Photo Share Website 1.0. The affected element is an unknown function of the file

历史摘要 · 未重新核验 · GitHub Advisory

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is poss...

CVE-2026-64638

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malici

历史摘要 · 未重新核验 · NVD

Nexus Repository 3 was found to be vulnerable to stored cross-site scripting (XSS). A user with the nexus:blobstores:create or nexus:blobstores:update permission could set a blo...

CVE-2026-17596

Nexus Repository 3 was found to be vulnerable to stored cross-site scripting (XSS). A user with the nexus:blobstores:cre

历史摘要 · 未重新核验 · NVD

The Code Embed WordPress plugin prior to version 2.6.1 is vulnerable to stored Cross-Site Scripting (XSS) through the external URL embed feature in post content. The vulnerable ...

CVE-2026-48093

The Code Embed WordPress plugin prior to version 2.6.1 is vulnerable to stored Cross-Site Scripting (XSS) through the ex

历史摘要 · 未重新核验 · NVD

A flaw has been found in SourceCodester Photo Share Website 1.0. The affected element is an unknown function of the file /social/index.php?page=home. This manipulation of the ar...

CVE-2026-19209

A flaw has been found in SourceCodester Photo Share Website 1.0. The affected element is an unknown function of the file

历史摘要 · 未重新核验 · NVD

A security vulnerability has been detected in PHPGurukul Company Visitor Management System 1.0....

CVE-2026-19207

A security vulnerability has been detected in PHPGurukul Company Visitor Management System 1.0. This issue affects some

历史摘要 · 未重新核验 · GitHub Advisory

DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS

### Summary During `IN_PLACE` sanitization, a hook that removes an element can leave that element's detached descendant

历史摘要 · 未重新核验 · GitHub Advisory

A security vulnerability has been detected in PHPGurukul Company Visitor Management System 1.0. This issue affects some unknown processing of the file /manage-newvisitors.php. T...

CVE-2026-19207

A security vulnerability has been detected in PHPGurukul Company Visitor Management System 1.0. This issue affects some

历史摘要 · 未重新核验 · NVD

Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0 - An unauthenticated attacker can store malicious JavaScript in a J...

CVE-2026-66494

Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0 - An unaut

历史摘要 · 未重新核验 · NVD

The ShareOpenly WordPress plugin prior to version 1.2.1 contains a Cross-Site Scripting vulnerability caused by the absence of WordPress's `esc_url()` escaping function on the `...

CVE-2026-48094

The ShareOpenly WordPress plugin prior to version 1.2.1 contains a Cross-Site Scripting vulnerability caused by the abse

历史摘要 · 未重新核验 · NVD