PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The HTML writer skips htmlspecialchars escaping when a cell's formatted value differs from the or...

CVE-2026-40296

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The HTML writer skips htmlspecialchars e

历史摘要 · 未重新核验 · NVD

In Jupyter Notebook versions 7.0.0 through 7.5.5, JupyterLab versions 4.5.6 and earlier, and the corresponding @jupyter-notebook/help-extension and @jupyterlab/help-extension pa...

CVE-2026-40171

In Jupyter Notebook versions 7.0.0 through 7.5.5, JupyterLab versions 4.5.6 and earlier, and the corresponding @jupyter-

历史摘要 · 未重新核验 · NVD

Inappropriate implementation in MHTML in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to inject arbitrary scripts or H...

CVE-2026-8012

Inappropriate implementation in MHTML in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromi

历史摘要 · 未重新核验 · NVD

Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display

### Impact In the Prometheus server's legacy web UI (enabled via the command-line flag `--enable-feature=old-ui`), the

历史摘要 · 未重新核验 · GitHub Advisory

ip-address has XSS in Address6 HTML-emitting methods

CVE-2026-42338

### Summary `Address6.group()` and `Address6.link()` do not HTML-escape attacker-controlled content before embedding it

历史摘要 · 未重新核验 · GitHub Advisory

Grav is Vulnerable to Stored XSS via Tag Injection

CVE-2026-42611

### Summary A low-privileged (with the ability to create a page) user can cause XSS with the injection of `svg` element.

历史摘要 · 未重新核验 · GitHub Advisory

Grav Vulnerable to Publisher-Level Stored XSS via Unquoted Event Attributes

CVE-2026-42612

### Summary A stored Cross-Site Scripting (XSS) vulnerability in `getgrav/grav` allows publisher-level accounts to execu

历史摘要 · 未重新核验 · GitHub Advisory

Grav Vulnerable to XSS via Taxonomy Field Values in Admin Panel

CVE-2026-42842

### Summary A Stored Cross-Site Scripting (XSS) vulnerability exists in the Grav CMS Form plugin's select field templat

历史摘要 · 未重新核验 · GitHub Advisory

Grav CMS vulnerable to stored XSS via Markdown media attribute() action

CVE-2026-42841

### Summary An authenticated user with page editing permissions can inject an executable JavaScript event-handler attri

历史摘要 · 未重新核验 · GitHub Advisory

YAFNET has Stored XSS in Forum Thread Posts/Replies that Allows Arbitrary JavaScript Execution for All Thread Viewers

CVE-2026-43939

**Description:** Stored Cross-Site Scripting (XSS) occurs when user-supplied input is persisted by the application and l

历史摘要 · 未重新核验 · GitHub Advisory

YAFNET has Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` Header

CVE-2026-43938

**Description:** Stored (second-order) Cross-Site Scripting (XSS) occurs when attacker-controlled input is persisted thr

历史摘要 · 未重新核验 · GitHub Advisory

PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.3 and earlier, 2.0.0 through 2.1.15, 2.2.0 through 2.4.4, 3.3.0 through 3.10.4, and 4.0.0...

CVE-2026-35453

PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.3 and earlier, 2.0.0 through 2.1

历史摘要 · 未重新核验 · NVD

Fiber vulnerable to XSS in AutoFormat Content Negotiation

CVE-2026-42554

## Summary **Description** A Cross-Site Scripting (CWE-79) vulnerability in Go Fiber allows a remote attacker to injec

历史摘要 · 未重新核验 · GitHub Advisory

ISPConfig 3.3.0 is vulnerable to Cross Site Scripting (XSS) via the system status webpage.

CVE-2025-52206

ISPConfig 3.3.0 is vulnerable to Cross Site Scripting (XSS) via the system status webpage.

历史摘要 · 未重新核验 · NVD

Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the email notification templates insert user-controlled device, ...

CVE-2026-27694

Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the ema

历史摘要 · 未重新核验 · NVD

AmazCart CMS 3.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloads through the sea...

CVE-2023-54349

AmazCart CMS 3.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject

来源摘录 · NVD

The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Instagram Feed widget's 'instagram_follow_text' setting in all versions ...

CVE-2026-5159

The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Instagram Feed

历史摘要 · 未重新核验 · NVD

The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in the wpr_update_form_action_meta AJAX action in all ver...

CVE-2026-4803

The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter

历史摘要 · 未重新核验 · NVD

The WP Carousel Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted fancybox `data-caption` attributes in all versions up to, and including, 2.7.1...

CVE-2026-4665

The WP Carousel Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted fancybox `data-captio

历史摘要 · 未重新核验 · NVD

The Zingaya Click-to-Call plugin for WordPress is vulnerable to Reflected Cross-Site Scripting...

CVE-2026-6696

The Zingaya Click-to-Call plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'email', 'first_n

历史摘要 · 未重新核验 · GitHub Advisory