React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets
CVE-2026-33245
When using React Router v7's unstable RSC APIs, there exists a potential client-side XSS issue in the RSC redirect handl
#cwe-79
共收录 5879 条相关情报。
← 返回所有主题React Router has stored XSS via unescaped Location header in prerendered redirect HTML
CVE-2026-33244
When using React Router v7 [Framework Mode](https://reactrouter.com/start/modes#framework) with [Pre-rendering](https://
backpack/crud is vulnerable to Cross-Site Scripting (XSS)
CVE-2022-31114
### Impact It’s a “*moderate*” vulnerability… but being an admin panel, take this seriously. It’s difficult… but an att
An authenticated user can persist arbitrary HTML/JavaScript in the email_id or mobile_no fields of a Customer record and trigger unescaped rendering in the Point of Sale (POS) i...
CVE-2026-42840
An authenticated user can persist arbitrary HTML/JavaScript in the email_id or mobile_no fields of a Customer record and
An authenticated ERPNext user with Item record edit permissions can persist arbitrary HTML/JavaScript in the item_name, description, or image fields of an Item and trigger unesc...
CVE-2026-42839
An authenticated ERPNext user with Item record edit permissions can persist arbitrary HTML/JavaScript in the item_name,
A vulnerability in the web-based user interface of Cisco Webex Meetings could have allowed an...
CVE-2026-20233
A vulnerability in the web-based user interface of Cisco Webex Meetings could have allowed an unauthenticated, remote at
A Cross Site Scripting vulnerability exists in the Kimi AI v1.0 web interface's 'Preview' feature...
CVE-2026-39107
A Cross Site Scripting vulnerability exists in the Kimi AI v1.0 web interface's 'Preview' feature. The application fails
A Cross Site Scripting vulnerability exists in the Kimi AI v1.0 web interface's 'Preview' feature. The application fails to properly sanitize or encode HTML/JavaScript payloads ...
CVE-2026-39107
A Cross Site Scripting vulnerability exists in the Kimi AI v1.0 web interface's 'Preview' feature. The application fails
A vulnerability in the web-based user interface of Cisco Webex Meetings could have allowed an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. Ci...
CVE-2026-20233
A vulnerability in the web-based user interface of Cisco Webex Meetings could have allowed an unauthenticated, remote at
GLPI is a free asset and IT management software package. Starting in version 10.0.4 and prior to version 10.0.25, a technician can store an XSS payload in the asset locked tab. ...
CVE-2026-42321
GLPI is a free asset and IT management software package. Starting in version 10.0.4 and prior to version 10.0.25, a tech
RockRMS v16.13 and before v.17.7.0 is vulnerable to Cross Site Scripting (XSS) via Social Media links in user profile.
CVE-2026-36748
RockRMS v16.13 and before v.17.7.0 is vulnerable to Cross Site Scripting (XSS) via Social Media links in user profile.
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Versions...
CVE-2022-31114
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages tha
ProjectsAndPrograms school-management-system is vulnerable to Stored Cross‑Site Scripting (XSS) in multiple attributes of students and teachers objects. An authorized attacker (...
CVE-2026-47324
ProjectsAndPrograms school-management-system is vulnerable to Stored Cross‑Site Scripting (XSS) in multiple attributes o
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.
CVE-2025-14773
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in ABB T-MAC Plus. T
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fox-themes Prague allows Reflected XSS. This issue affects Prague: from n/...
CVE-2025-15654
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fox-themes Prague
The Passeum Ticketing plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all...
CVE-2026-7421
The Passeum Ticketing plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and inclu
The Passeum Ticketing plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.0. This is due to the `get_shop_url()` method ret...
CVE-2026-7421
CVE-2026-7421 影响 Passeum Ticketing WordPress 插件的所有版本（至 1.0 版本），该插件存在存储型跨站脚本（Stored XSS）漏洞。漏洞根源在于 `get_shop_url()` 方法直接返回
GLPI is a free asset and IT management software package. In versions 11.0.0 through 11.0.6, a technician can store an XSS payload in a ITIL costs. This issue has been fixed in v...
CVE-2026-40108
GLPI（开源资产和IT管理软件）在11.0.0至11.0.6版本中存在一个存储型跨站脚本（XSS）漏洞。具备技术人员权限的用户可以在ITIL成本（ITIL costs）功能中存储恶意JavaScript负载。当其他用户（如管理员或审计员）
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Versions prior to 7.260227.0 are vulnerable to XSS in the rendering of email...
CVE-2026-35212
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Versions prior to 7
authentik is an open-source identity provider. Prior to versions 2025.12.5 and 2026.2.3, due to the implementation of stages in the SFE (Simple Flow Executor) in order to make t...
CVE-2026-42849
authentik is an open-source identity provider. Prior to versions 2025.12.5 and 2026.2.3, due to the implementation of st