#cwe-79

共收录 5426 条相关情报。

漏洞预警2026-09-12 发布MEDIUM

QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce au...

CVE-2026-89268

QloApps 是一套开源的酒店/物业管理与在线预订系统。CVE-2026-89268 影响 QloApps 1.7.0 及更早版本：其后端（back-office）列表页面的筛选功能会把 HTTP POST 请求中的筛选参数直接渲染进 H

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

安全公告2026-09-12 发布INFO

A web interface reflects a portion of the request URL into a script context and a hyperlink...

CVE-2026-90443

A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate e

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-79 #severity:medium

漏洞预警2026-09-11 发布INFO

A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does not require authentication to reach. Th...

CVE-2026-90443

A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate e

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

安全公告2026-09-11 发布INFO

Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page...

CVE-2026-81918

Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A us

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-79 #severity:medium

安全公告2026-09-11 发布INFO

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags...

CVE-2026-81917

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-79 #severity:medium

漏洞预警2026-09-11 发布INFO

Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A user with edit_page_contents permissions could store a payl...

CVE-2026-81918

Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A us

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-11 发布INFO

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit...

CVE-2026-81917

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-11 发布INFO

Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting (XSS) vulnerability i...

CVE-2026-54165

Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click st

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-11 发布INFO

Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The custom_slot save_template endpoint authorizes the request only against the targ...

CVE-2026-81911

Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The custom_slot save_templ

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-11 发布INFO

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over ...

CVE-2026-77490

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based)

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

安全公告2026-09-11 发布INFO

Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot save_template via Unescaped Summary Description

CVE-2026-81911

Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The custom_slot save_templ

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

漏洞预警2026-09-11 发布INFO

Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.1 versions.

CVE-2026-62138

Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.1 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-11 发布INFO

Contributor Cross Site Scripting (XSS) in Simple Payment <= 2.5.4 versions.

CVE-2026-62111

Contributor Cross Site Scripting (XSS) in Simple Payment <= 2.5.4 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-11 发布INFO

Contributor Cross Site Scripting (XSS) in Bold Page Builder <= 5.9.9 versions.

CVE-2026-62110

Contributor Cross Site Scripting (XSS) in Bold Page Builder <= 5.9.9 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-11 发布INFO

Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script payloads into survey a...

CVE-2026-82535

Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated at

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-11 发布INFO

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in IdeaSoft Software Industry and Trade Inc. Smart E-Commerce allows Reflected...

CVE-2026-7298

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in IdeaSoft Software

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-11 发布INFO

Concrete CMS RSS Displayer block below version 9.5.3 rendered remote feed item titles without HTML escaping, resulting in stored cross-site scripting. An attacker able to contr...

CVE-2026-68528

Concrete CMS RSS Displayer block below version 9.5.3 rendered remote feed item titles without HTML escaping, resulting

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-11 发布INFO

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names are not encoded be...

CVE-2026-89256

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in t

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-11 发布INFO

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to HTML-encode PGP publ...

CVE-2026-89255

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in t

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-11 发布INFO

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the CustomizeUser plugin where the field_name parameter is...

CVE-2026-89254

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in t

历史摘要 · 未重新核验 · NVD

#cve #cwe-79