#cwe-79

共收录 5879 条相关情报。

漏洞预警2026-07-20 发布INFO

The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated stored XSS vulnerability. Authenticated builder user could inject scripts, fires for any visitor or ...

CVE-2026-60028

The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated stored XSS vulnerability. Authenticated bui

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-20 发布INFO

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3, contain a stored Cross-Site Scripting (XSS) vulnerability, whe...

CVE-2026-44228

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3, conta

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-20 发布INFO

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting (XSS) vulnerability. A...

CVE-2026-44227

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contai

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-20 发布INFO

Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form that allows any unauthenticated attacker to execute ar...

CVE-2026-39878

Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration fo

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-20 发布INFO

Mettle SendPortal 3.0.1 and earlier contains a stored cross-site scripting (XSS) vulnerability in the template management functionality. The application fails to properly saniti...

CVE-2026-26483

Mettle SendPortal 3.0.1 and earlier contains a stored cross-site scripting (XSS) vulnerability in the template managemen

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

安全公告2026-07-20 发布INFO

RT: Stored Cross-Site Scripting via insufficient template escaping

CVE-2026-44228

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3, conta

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

安全公告2026-07-20 发布INFO

RT: Reflected Cross-Site Scripting via URL parameters

CVE-2026-44227

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contai

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

安全公告2026-07-20 发布INFO

Chamilo stored XSS via user registration leads to admin account takeover

CVE-2026-39878

Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration fo

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

漏洞预警2026-07-20 发布INFO

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bifra Engineering Consulting Ltd. Q-smart NexT Poll allows Stored XSS. Thi...

CVE-2026-6793

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bifra Engineering

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-20 发布INFO

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, the `/api/upload` endpoint allows unauthenticated file uploads including SVG files. Uploaded SVGs are stored...

CVE-2026-45797

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, the `/api/upload` endpoint allows unauthenticated f

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-434

漏洞预警2026-07-20 发布INFO

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (XSS) vulnerability in the form builder allows a low-privileged team member to...

CVE-2026-35198

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (XSS) vulnerability i

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

安全公告2026-07-20 发布INFO

HeyForm vulnerable to stored XSS via form field titles

CVE-2026-35198

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (XSS) vulnerability i

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

安全公告2026-07-20 发布INFO

HeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Upload

CVE-2026-45797

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, the `/api/upload` endpoint allows unauthenticated f

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-434 #cwe-79

漏洞预警2026-07-20 发布INFO

Stored Cross-site Scripting (CWE-79) in the client-side report rendering functions (renderPreview, renderEditor, renderAuditData in js/app.js) in maalfer Pentestify before 1.1.0...

CVE-2026-59238

Stored Cross-site Scripting (CWE-79) in the client-side report rendering functions (renderPreview, renderEditor, renderA

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-20 发布INFO

Frogman provides headless FreePBX control. Prior to version 1.6.6, Frogman's chat-console markdown formatter (`assets/js/chat.js`'s `formatMarkdown`) inserted regex capture grou...

CVE-2026-46516

Frogman provides headless FreePBX control. Prior to version 1.6.6, Frogman's chat-console markdown formatter (`assets/js

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-20 发布INFO

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the `Pages` backend module registers the `html_purify` validation rule on language-...

CVE-2026-45270

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the `Pages` backend module

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

安全公告2026-07-20 发布INFO

Frogman vulnerable to stored XSS in chat console formatter (escalation vector in multi-admin deployments)

CVE-2026-46516

Frogman provides headless FreePBX control. Prior to version 1.6.6, Frogman's chat-console markdown formatter (`assets/js

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

安全公告2026-07-20 发布INFO

CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule

CVE-2026-45270

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the `Pages` backend module

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

漏洞预警2026-07-20 发布INFO

The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This conditi...

CVE-2026-2445

The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encod

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-20 发布INFO

The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX parameters before reflecting it in the r...

CVE-2026-9833

The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape

历史摘要 · 未重新核验 · NVD

#cve #cwe-79