n8n before 1.123.64 DOM-Based XSS via Unsandboxed iframe
CVE-2026-65597
n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the
#cwe-79
共收录 5879 条相关情报。
← 返回所有主题n8n before 1.123.64 Stored DOM XSS via cachedResultUrl
CVE-2026-65592
n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator
The Joomla extension JoomShopping is vulnerable to an reflected XSS vulnerability in the product frontend controller.
CVE-2026-63264
The Joomla extension JoomShopping is vulnerable to an reflected XSS vulnerability in the product frontend controller.
The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all...
CVE-2026-15787
The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu
The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that ar...
CVE-2026-12968
The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthent
A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected...
CVE-2026-16485
A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some u
A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This affects...
CVE-2026-16486
A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the f
A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSIS.php. Performing a manipulation of the argument ...
CVE-2026-16486
A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the f
A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /class.php. Such manipul...
CVE-2026-16485
A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some u
Rails HTML Sanitizers: Possible XSS vulnerability with certain configurations
## Summary There is a possible cross-site scripting vulnerability in rails-html-sanitizer when the sanitizer is configu
Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons
## Summary `Loofah::HTML5::Scrub.allowed_uri?` does not correctly reject `javascript:` or `vbscript:` URIs when the sch
Loofah: SVG `href` attribute bypasses local-reference restriction
## Summary Loofah's HTML5 sanitizer restricted only the `xlink:href` attribute on certain SVG elements to local, same-d
Cross Site Scripting vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the UploadController.java file
CVE-2026-52475
Cross Site Scripting vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `buildRow()` method in `fogpage.class....
CVE-2026-47689
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `selectForm()` helper in `fogpage.clas...
CVE-2026-47687
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the unauthenticated inventory service endp...
CVE-2026-47685
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.
Cross Site Scripting vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to execute arbitrary code via the mcp parameter
CVE-2026-50758
Cross Site Scripting vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to execute arbitrary c
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2 OpenAPI HTML endpoint reflected values from the `scope` q...
CVE-2026-55081
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2
DHIS2 Reflected XSS in OpenAPI HTML scope parameter
CVE-2026-55081
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2
Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's async_get_media_image() method that allows attackers controlling a ...
CVE-2026-64823
Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's async_get_