The NMR Strava activities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `strava_nmr_connect` shortcode in all versions up to, and including,...

CVE-2026-5341

The NMR Strava activities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `strava_nmr

历史摘要 · 未重新核验 · NVD

The Auto Affiliate Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.8.8 This is due to insufficient input sanitization...

CVE-2026-7330

The Auto Affiliate Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and includ

历史摘要 · 未重新核验 · NVD

SOPlanning 1.52.00 is vulnerable to Cross Site Scripting (XSS) via the groupe_id parameter to process/groupe_save.php.

CVE-2024-33724

SOPlanning 1.52.00 is vulnerable to Cross Site Scripting (XSS) via the groupe_id parameter to process/groupe_save.php.

历史摘要 · 未重新核验 · NVD

A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp.

CVE-2023-42345

A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp.

来源摘录 · NVD

A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type.

CVE-2023-42343

A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type.

来源摘录 · NVD

In Thruk Monitoring through 2.46.3, the login field of the login form is vulnerable to reflected XSS. This vulnerability can be exploited by unauthenticated remote attackers to ...

CVE-2022-23961

In Thruk Monitoring through 2.46.3, the login field of the login form is vulnerable to reflected XSS. This vulnerability

来源摘录 · NVD

A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects an unknown part of the file /index.php?page=users. Executing a manipulation of the ...

CVE-2026-8136

A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects an unknown part of the fil

历史摘要 · 未重新核验 · NVD

wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without escaping, allowin...

CVE-2026-42150

wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc emb

历史摘要 · 未重新核验 · NVD

A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. This...

CVE-2026-8117

A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. This issue affects some unkno

历史摘要 · 未重新核验 · GitHub Advisory

A reflected HTML injection vulnerability was identified in the GitHub Enterprise Server...

CVE-2026-8106

A reflected HTML injection vulnerability was identified in the GitHub Enterprise Server Management Console login page th

历史摘要 · 未重新核验 · GitHub Advisory

Improper neutralization of input during web page generation ('cross-site scripting') in Azure...

CVE-2026-32207

Improper neutralization of input during web page generation ('cross-site scripting') in Azure Machine Learning allows an

历史摘要 · 未重新核验 · GitHub Advisory

A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. This issue affects some unknown processing of the file /admin/index.php. Such manipula...

CVE-2026-8117

A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. This issue affects some unkno

历史摘要 · 未重新核验 · NVD

netbox-data-flows has stored XSS in ObjectAlias names rendered inside DataFlow tables

### Summary An authenticated user who can create or edit `ObjectAlias` objects can store arbitrary HTML/JavaScript in an

历史摘要 · 未重新核验 · GitHub Advisory

A reflected HTML injection vulnerability was identified in the GitHub Enterprise Server Management Console login page that could allow credential theft. The redirect_to query pa...

CVE-2026-8106

A reflected HTML injection vulnerability was identified in the GitHub Enterprise Server Management Console login page th

历史摘要 · 未重新核验 · NVD

Vvveb before 1.0.8.2 contains an unauthenticated reflected cross-site scripting vulnerability in the visual editor preview renderer that allows attackers to execute arbitrary Ja...

CVE-2026-41929

Vvveb before 1.0.8.2 contains an unauthenticated reflected cross-site scripting vulnerability in the visual editor previ

历史摘要 · 未重新核验 · NVD

Improper neutralization of input during web page generation ('cross-site scripting') in Azure Machine Learning allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-32207

Improper neutralization of input during web page generation ('cross-site scripting') in Azure Machine Learning allows an

历史摘要 · 未重新核验 · NVD

Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the...

CVE-2026-44742

Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as e

历史摘要 · 未重新核验 · GitHub Advisory

Ech0's RSS feed renders unescaped tag names and raw-HTML markdown, stored XSS against subscribers

## Summary The public RSS/Atom feed at `/rss` renders two attacker-controlled surfaces without HTML escaping. Tag names

历史摘要 · 未重新核验 · GitHub Advisory

i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 4.0.8 substitute {{key}} interpolation...

CVE-2026-41692

i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes.

历史摘要 · 未重新核验 · NVD

FacturaScripts vulnerable to stored XSS via product reference in sales/purchases

CVE-2026-42877

## Summary A stored Cross-Site Scripting (XSS) vulnerability exists in the product search modal of sales and purchases

历史摘要 · 未重新核验 · GitHub Advisory