Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS...
CVE-2026-14911
Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a rem
#cwe-79
共收录 5345 条相关情报。
← 返回所有主题Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read DOM information, modify router setti...
CVE-2026-14911
Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a rem
The Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/media/{filepath}` wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the co...
CVE-2026-96594
The Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/media/{filepath}` wrote files of up to 1 KiB that are stored di
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to g...
CVE-2026-105111
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCE
Gitea's container registry served blob downloads with a `Content-Type` taken from the media type declared in pushed image manifests, without a `Content-Disposition` or restricti...
CVE-2026-103667
Gitea's container registry served blob downloads with a `Content-Type` taken from the media type declared in pushed imag
A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting (XSS). ...
CVE-2026-101158
A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload
A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that executes when an authentica...
CVE-2026-101157
A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to
A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The content may execute...
CVE-2026-101156
A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store mali
The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quot...
CVE-2026-106512
The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by dire
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the application's redirect route. Specifically, t...
CVE-2026-106033
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the Ansible Platform UI due to unvalidated input handling
NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal s...
CVE-2026-104073
NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged u
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 3.3.0, several @quasar/app-vite SSR and SSG rendering paths interpolated ssrContex...
CVE-2026-106107
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 3.3.0, several @quasar/ap
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError() in uti...
CVE-2026-106106
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead() serializer in ui/src/plugins/meta/Meta.js used getA...
CVE-2026-106102
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getH
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a collection that allows downloadable...
CVE-2026-105862
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions befo
A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the file formwork/src/Sanitizer/...
CVE-2026-105950
A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.261.029, POST /api/group_documents/upload st...
CVE-2026-105798
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Akıllı Ticaret Software Technologies Ltd. Co. E-Commerce Pack allows Reflec...
CVE-2026-12380
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Akıllı Ticaret Sof
Cross-site Scripting (XSS) in the Forums feature of OpenText Content Management Content Server could allow a bad actor to inject malicious code into a Forums web page.
CVE-2025-15591
Cross-site Scripting (XSS) in the Forums feature of OpenText Content Management Content Server could allow a bad actor t
Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack <= 6.2.13 versions.
CVE-2026-94675
Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack <= 6.2.13 versions.