PHP Timeclock 1.04 contains multiple cross-site scripting vulnerabilities that allow unauthenticated attackers to inject arbitrary JavaScript by manipulating URL paths and POST ...

CVE-2021-47967

PHP Timeclock 1.04 contains multiple cross-site scripting vulnerabilities that allow unauthenticated attackers to inject

历史摘要 · 未重新核验 · NVD

Anote 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to execute arbitrary code by injecting malicious payloads into markdown files stored wit...

CVE-2021-47963

Anote 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to execute arbitrary code by in

历史摘要 · 未重新核验 · NVD

Savsoft Quiz 5.0 contains a persistent cross-site scripting vulnerability in the user account settings page that allows authenticated attackers to inject malicious HTML and Java...

CVE-2021-47962

Savsoft Quiz 5.0 contains a persistent cross-site scripting vulnerability in the user account settings page that allows

历史摘要 · 未重新核验 · NVD

AVideo: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute

CVE-2026-45580

## Summary **Type:** Stored cross-site scripting. The Live plugin's "YouTube-style" view renders the live transmission'

历史摘要 · 未重新核验 · GitHub Advisory

Cockpit CMS through version 2.14.0, patched in commit 72a83fc, contains a stored cross-site...

CVE-2026-23695

Cockpit CMS through version 2.14.0, patched in commit 72a83fc, contains a stored cross-site scripting vulnerability in t

历史摘要 · 未重新核验 · GitHub Advisory

Cockpit CMS through version 2.14.0, patched in commit 72a83fc, contains a stored cross-site scripting vulnerability in the Set field type's Display template option, where the te...

CVE-2026-23695

Cockpit CMS through version 2.14.0, patched in commit 72a83fc, contains a stored cross-site scripting vulnerability in t

历史摘要 · 未重新核验 · NVD

Weblate: Stored HTML injection in editor search preview

CVE-2026-45106

### Impact Weblate's live search preview renders unit `source` and `context` as HTML without escaping. Any contributor w

历史摘要 · 未重新核验 · GitHub Advisory

NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class

CVE-2026-41147

### Impact NukeViet CMS `, which are stored server-side and executed in the browser of any user who views the content.

历史摘要 · 未重新核验 · GitHub Advisory

The The7 theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ...

CVE-2026-6646

The The7 theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dt_default_button' shortcode in all v

历史摘要 · 未重新核验 · GitHub Advisory

The Advanced Custom Fields: Font Awesome plugin for WordPress is vulnerable to Stored Cross-Site...

CVE-2026-6415

The Advanced Custom Fields: Font Awesome plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions u

历史摘要 · 未重新核验 · GitHub Advisory

The Advanced Custom Fields: Font Awesome plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.0.2. This is due to insufficient inp...

CVE-2026-6415

The Advanced Custom Fields: Font Awesome plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions u

历史摘要 · 未重新核验 · NVD

The The7 theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dt_default_button' shortcode in all versions up to, and including, 14.3.2. This is due to insu...

CVE-2026-6646

The The7 theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dt_default_button' shortcode in all v

历史摘要 · 未重新核验 · NVD

Cross-site scripting vulnerability exists in Musetheque V4 Information Disclosure for IPKNOWLEDGE V4L1 rev2203.0 and earlier. If a file containing malicious contents is uploaded...

CVE-2026-24662

Cross-site scripting vulnerability exists in Musetheque V4 Information Disclosure for IPKNOWLEDGE V4L1 rev2203.0 and ear

历史摘要 · 未重新核验 · NVD

The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the public catalogue UI served at GET / (file internal/api/h...

CVE-2026-44429

The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the

历史摘要 · 未重新核验 · NVD

PrestaShop is an open source e-commerce web application. Prior to 8.2.6 and 9.1.1, there is a stored Cross-Site Scripting (XSS) vulnerability in the PrestaShop back-office Custo...

CVE-2026-44212

PrestaShop is an open source e-commerce web application. Prior to 8.2.6 and 9.1.1, there is a stored Cross-Site Scriptin

历史摘要 · 未重新核验 · NVD

Svelte: SSR XSS via Insecure Promise Serialization in hydratable

Contents of `hydratable` promises were not properly stringified, potentially leading to an XSS exploit. You are vulnerab

历史摘要 · 未重新核验 · GitHub Advisory

Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State

CVE-2026-42573

Svelte was vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks.

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order

CVE-2026-45665

### Summary A Stored Cross-Site Scripting (XSS) vulnerability exists in the Banner component due to an improper sanitiza

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI vulnerable to stored XSS via OAuth picture claim stored as SVG data URI in profile_image_url

# Summary When a user signs in via OAuth, Open WebUI fetches the `picture` claim URL, infers a MIME type from the URL e

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan's Bazaar (community marketplace) renders the name and version fields of a package's plugin....

CVE-2026-45375

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan's Bazaar (community marketplace) r

历史摘要 · 未重新核验 · NVD