Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...
CVE-2026-114694
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Ma
#cwe-79
共收录 5328 条相关情报。
← 返回所有主题Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...
CVE-2026-112869
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Hearle We’re
The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link...
CVE-2026-112207
The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site be
The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour...
CVE-2026-114429
The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before st
The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map...
CVE-2026-113493
The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes befo
The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a...
CVE-2026-105199
The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in one of its A
Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body
CVE-2026-115897
### Impact `serialize-javascript` escapes its output so it is safe to embed inside a `` element. Before 7.1.3 that guar
odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values
### Summary ODF style values are interpolated into `style="..."` attributes without HTML-escaping in odf-kit's ODS to-H
SvelteKit : XSS via untrusted cache-control header in prerendered page
CVE-2026-114061
### Impact Applications that prerender pages and use `setHeaders` to set a `cache-control` header from an untrusted sou
Improper sanitization in the registration module allows reflected Cross-Site Scripting.
CVE-2026-87901
Improper sanitization in the registration module allows reflected Cross-Site Scripting.
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints au...
CVE-2026-55486
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.0
A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthenticated attacker to execute JavaScript through the zrememb...
CVE-2026-93638
A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthent
A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled c...
CVE-2026-93633
A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, global shortcode expansion runs over the complete rendered page, including HT...
CVE-2026-115457
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, global shortcode exp
A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through the packages paramet...
CVE-2026-10632
A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an a
conda-forge is a GitHub organization containing repositories of conda recipes. In commits 85748ad2368a and prior, two React components render externally-sourced strings directly...
CVE-2026-55422
conda-forge is a GitHub organization containing repositories of conda recipes. In commits 85748ad2368a and prior, two Re
PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the appro...
CVE-2026-56840
PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.HTTPApproval render
CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supplied data. A remote unauthenticated attacker can craft a malicious ...
CVE-2025-58403
CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supplied data.
The "ASMobile" web interface, which is part of the VertiGIS software package "GIS Portal", allows authenticated users to define a business reference. JavaScript code can be inse...
CVE-2026-4952
The "ASMobile" web interface, which is part of the VertiGIS software package "GIS Portal", allows authenticated users to
The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to search for employees across all defined companies (user groups). The sear...
CVE-2026-4951
The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to search for emplo