#cwe-79

共收录 5426 条相关情报。

漏洞预警2026-09-15 发布INFO

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in L7 content management pages that use eval() sinks, affecting the call board text and p...

CVE-2026-92257

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in L7 content management pages t

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-15 发布INFO

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in the DHCP dynamic IP display and ARP bind list display components handling hostname fie...

CVE-2026-76873

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in the DHCP dynamic IP display a

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-15 发布INFO

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in DHCP static IP and IP ACL management pages, including dhcp_add_staticip_cgi, dhcp_stat...

CVE-2026-76872

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in DHCP static IP and IP ACL man

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-15 发布INFO

Netcore NR255-V firmware version 1.5.130703 contains a stored cross-site scripting vulnerability in routing and NAT configuration CGI components including routing_tab_add_cgi, r...

CVE-2026-76867

Netcore NR255-V firmware version 1.5.130703 contains a stored cross-site scripting vulnerability in routing and NAT conf

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-15 发布INFO

NR255-V version 1.5.130703 fails to sanitize QoS rule names before they are parsed via eval() in qos_xianz_add_cgi, qos_xianz_show_cgi, qos_filter_add_cgi, and qos_filter_show_c...

CVE-2026-76864

NR255-V version 1.5.130703 fails to sanitize QoS rule names before they are parsed via eval() in qos_xianz_add_cgi, qos_

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-15 发布INFO

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in ddns_wan_list_show.cgi caused by unsafe eval() handling of DDNS data. Attackers can in...

CVE-2026-76858

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in ddns_wan_list_show.cgi caused

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

安全公告2026-09-15 发布INFO

QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error...

CVE-2026-92234

QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Res

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-79 #severity:medium

漏洞预警2026-09-15 发布INFO

QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page. Authenticated ba...

CVE-2026-92234

QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Res

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-15 发布INFO

Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files containing pot...

CVE-2026-81927

Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processin

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-15 发布INFO

Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The panel's check endpoint...

CVE-2026-81926

Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's dupli

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

安全公告2026-09-15 发布INFO

QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors

CVE-2026-92234

QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Res

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

安全公告2026-09-15 发布INFO

Concrete CMS before 9.5.3 is vulnerable to Stored XSS via SVG upload in "Reject" sanitization mode

CVE-2026-81927

Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processin

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

漏洞预警2026-09-15 发布INFO

Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in reflected cross-site scripting. An attacke...

CVE-2026-81925

Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-15 发布INFO

A vulnerability in the web-based management interface of the EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to execute arbitrary script code in a v...

CVE-2026-76704

A vulnerability in the web-based management interface of the EdgeConnect SD-WAN Orchestrator could allow an authenticate

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

安全公告2026-09-15 发布INFO

Concrete CMS 9.4.0 through 9.5.2 is vulnerable to Cross-site scripting in the location panel duplicate-path confirmation dialog

CVE-2026-81926

Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's dupli

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

漏洞预警2026-09-15 发布INFO

Concrete CMS before 9.5.3 rendered Express entry labels as raw HTML when displaying associated entries, resulting in stored cross-site scripting. An unauthenticated attacker cou...

CVE-2026-68534

Concrete CMS before 9.5.3 rendered Express entry labels as raw HTML when displaying associated entries, resulting in sto

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-15 发布INFO

Concrete CMS 9.0.0 to 9.5.2 stored group folder names without sanitization and printed them unescaped on the Members > Groups dashboard page, resulting in stored cross-site scri...

CVE-2026-81899

Concrete CMS 9.0.0 to 9.5.2 stored group folder names without sanitization and printed them unescaped on the Members > G

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-15 发布INFO

In Concrete CMS below version 9.5.3, the Address attribute's country-less text formatter skipped HTML-escaping, enabling stored XSS in Express association views. A user able to ...

CVE-2026-81898

In Concrete CMS below version 9.5.3, the Address attribute's country-less text formatter skipped HTML-escaping, enabling

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-15 发布INFO

BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting (XSS) in the component Trufflebox UI (trufflebox-ui) in GenericNumerixTable.jsx.

CVE-2026-39038

BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting (XSS) in the component Trufflebox UI (tru

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-15 发布INFO

In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape dropdown child page names before writing them into the page, so a user who could create or rename ...

CVE-2026-18113

In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape dropdown child page names before writing

历史摘要 · 未重新核验 · NVD

#cve #cwe-79