共收录 5879 条相关情报。
← 返回所有主题CVE-2025-46719
### Summary A vulnerability in the way certain html tags in chat messages are rendered allows attackers to inject JavaS
CVE-2025-46571
### Summary Low privileged users can upload HTML files which contain JavaScript code via the `/api/v1/files/` backend en
CVE-2026-12948
A stored cross-site scripting (XSS) vulnerability in the web management interface of the Digi PortServer TS, Digi One SP
CVE-2026-12948
A stored cross-site scripting (XSS) vulnerability in the web management interface of the Digi PortServer TS, Digi One SP
CVE-2026-8309
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Armiya Information
CVE-2026-8306
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Armiya Information
CVE-2026-11328
The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title
CVE-2026-11328
The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title
CVE-2026-59710
showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/ta
CVE-2026-53641
FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a stored cros
CVE-2026-59710
showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/ta
CVE-2026-55630
## Summary In Kiwi TCMS the fields `TestCase.extra_link` and `TestPlan.extra_link` were meant to represent URLs to exte
CVE-2026-55793
# Stored XSS via Structure entry title in table view ## Summary An Author-level control panel user can store a JavaScr
CVE-2026-59711
showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitr
CVE-2026-55790
## Summary An attacker with only a GitHub account can plant a JavaScript payload in a `craftcms/cms` issue title. When
CVE-2026-59711
showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitr
CVE-2026-55437
### Summary The `AgentLogLine` dashboard component instantiated `ansi-to-html` without `escapeXML: true` and inserted t
CVE-2026-58402
Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo's default code-block renderer wrote the Markdown code-f
CVE-2026-50133
Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to
CVE-2026-12154
The Reviews Widgets for Google, Yelp & TripAdvisor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via