Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self...
CVE-2026-104479
Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users
#cwe-79
共收录 5376 条相关情报。
← 返回所有主题IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows...
CVE-2026-104475
IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inj
Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users to inject scripts into item listing descriptions when fro...
CVE-2026-104479
Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users
Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed int...
CVE-2026-104477
Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fa
IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers...
CVE-2026-104475
IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inj
@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions
CVE-2026-10032
### Summary The `openUrl` function in `@a2ui/web_core` passes an agent-controlled URL directly to `window.open()` witho
An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create...
CVE-2026-102626
An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a JavaScri
An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a JavaScript-breaking value in the date_min attribute of a Date/Tim...
CVE-2026-102626
An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a JavaScri
MISP contains a cross-site scripting (XSS) vulnerability in the remote event preview page. When a linked (remote) MISP server is configured, the event preview renders tag identi...
CVE-2026-104907
MISP contains a cross-site scripting (XSS) vulnerability in the remote event preview page. When a linked (remote) MISP s
MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered di...
CVE-2026-104906
MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer. When displaying a remote TAXII obje
MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked (remote) MISP ser...
CVE-2026-104901
MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature. When a user views the ID Translat
MISP contains a stored cross-site scripting (XSS) vulnerability in the index table rendering of the remote event preview. The count field template escaped the associated link UR...
CVE-2026-104900
MISP contains a stored cross-site scripting (XSS) vulnerability in the index table rendering of the remote event preview
ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents. Prior to 1.42.3, prosemirror-view paste handling accepts attacker-prov...
CVE-2026-104847
ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents. Prior to 1.42
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Loglama.net TurkHotspot allows Reflected XSS. This issue affects TurkHotsp...
CVE-2026-5782
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Loglama.net TurkHo
The JetAppointment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'friendlyTime' parameter in all versions up to, and including, 2.5.2.1 due to insuff...
CVE-2026-93875
The JetAppointment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'friendlyTime' parameter in
A vulnerability was found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the file script/academic/core/new_announcement.php of the compo...
CVE-2026-104612
A vulnerability was found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the fi
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Stored XSS.This issue affe...
CVE-2026-102798
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group The
YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as inc...
CVE-2026-104473
YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inj
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in the Bazar valeur action that allows page editors to make the server fetch arbitrary URLs. Attackers ...
CVE-2026-104470
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in the Bazar valeur action that allows page ed
YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to inject event handlers ...
CVE-2026-104466
YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who