#cwe-79

共收录 5345 条相关情报。

漏洞预警2026-10-12 发布INFO

Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by storing javascript: ...

CVE-2026-109291

Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to ex

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-12 发布INFO

Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading cr...

CVE-2026-109290

Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that all

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-12 发布INFO

Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validati...

CVE-2026-109288

Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which rend

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-12 发布INFO

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when writing C...

CVE-2026-109266

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which d

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-12 发布INFO

A vulnerability was identified in Netcore NR268 1.7.121109. Affected by this vulnerability is the function eval of the file /router/l7_call_board_user_set.cgi of the component W...

CVE-2026-108908

A vulnerability was identified in Netcore NR268 1.7.121109. Affected by this vulnerability is the function eval of the f

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-94

漏洞预警2026-10-12 发布INFO

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows St...

CVE-2026-108478

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element P

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-12 发布INFO

Pimcore through 2026.3.1 contains a stored cross-site scripting vulnerability that allows authenticated backend users to inject scripts by storing unescaped URLs in ExternalImag...

CVE-2026-109392

Pimcore through 2026.3.1 contains a stored cross-site scripting vulnerability that allows authenticated backend users to

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

安全公告2026-10-12 发布INFO

LibreNMS before 26.9.0 Stored XSS via Tools Oxidized Node List

CVE-2026-109355

LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in get_oxidized_nodes_list() that renders Ox

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

安全公告2026-10-12 发布INFO

LibreNMS before 26.9.0 Stored XSS via wireless sensor description

CVE-2026-109352

LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.p

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

安全公告2026-10-12 发布INFO

DOMPurify before 3.4.16 XSS via IN_PLACE Returned Rawtext Root

CVE-2026-109345

DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization becau

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

安全公告2026-10-12 发布INFO

DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize Hooks

CVE-2026-109344

DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE mode fails to neutral

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

安全公告2026-10-12 发布INFO

Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via Registration Name

CVE-2026-109328

Admidio 5.0.0 before 5.0.15 contains an unauthenticated stored cross-site scripting vulnerability in RegistrationPresent

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

安全公告2026-10-12 发布INFO

Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.php

CVE-2026-109327

Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerability in system/

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

安全公告2026-10-12 发布INFO

Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views

CVE-2026-109322

Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and A

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

安全公告2026-10-12 发布INFO

Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification

CVE-2026-109307

Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnerability in the control panel login and 2F

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

安全公告2026-10-12 发布INFO

Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds

CVE-2026-109300

Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, whic

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

安全公告2026-10-12 发布INFO

Open WebUI 0.6.33 before 0.11.4 Stored XSS via Citation embed_url

CVE-2026-109291

Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to ex

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

安全公告2026-10-12 发布INFO

Open WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX Preview

CVE-2026-109290

Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that all

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

安全公告2026-10-12 发布INFO

Open WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown Links

CVE-2026-109288

Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which rend

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

安全公告2026-10-12 发布INFO

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Code Injection via CIP Encoder

CVE-2026-109266

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which d

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79