Monthly
Cross-site scripting in Softtr E-Commerce Pack (all versions before 5.03.01.49) allows unauthenticated remote attackers to inject malicious script-related HTML tags into rendered web pages, requiring victim interaction to trigger execution. The flaw is rooted in CWE-80 (Improper Neutralization of Script-Related HTML Tags), enabling integrity abuse such as session hijacking, credential phishing, or checkout-flow manipulation within affected storefronts. No public exploit code or active exploitation has been identified at time of analysis.
Cross-site scripting in justhtml versions before 1.13.0 allows attackers who control `<pre>` element content to break out of fixed-length Markdown code fences and inject raw HTML into the serialized output. When an application passes attacker-supplied HTML through `JustHTML(..., sanitize=True).to_markdown()` and a downstream CommonMark or GFM renderer processes the result with raw-HTML enabled, the injected script executes in the victim's browser. A proof-of-concept with full reproduction steps is publicly available in the GHSA advisory; no public exploit identified at time of analysis beyond that PoC.
Stored cross-site scripting in CVAT versions 2.68.0 through 2.69.x allows an authenticated user with annotation guide editing permissions to inject persistent malicious JavaScript into audio-task guide content, which executes in any other user's browser when they open the guide. The payload can silently issue arbitrary CVAT API requests - including data exports, task modifications, or privilege escalation actions - using the victim's active session credentials. No public exploit code has been identified at time of analysis; the vendor-confirmed fix is available in version 2.70.0.
Stored cross-site scripting in the Cisco Industrial Ethernet 1000 Series Switch web-based management interface allows an authenticated remote attacker to inject persistent malicious scripts into interface pages, which then execute in the browser context of other authenticated users. Affected firmware spans versions 1.1 through 1.9.5 across the IE 1000 product line, as confirmed by EUVD-2026-62562 and the Cisco security advisory. No public exploit code or active exploitation has been identified at time of analysis, and Cisco has published advisory cisco-sa-ie1k-NgXUFF52 with remediation guidance.
HTML injection in MailerUp's public subscription form (all versions before 1.1.3) allows unauthenticated remote attackers to embed arbitrary HTML into the double opt-in verification email the application sends, using the form owner's configured sending identity and an attacker-specified recipient address. The root cause is unescaped interpolation of the subscriber-supplied first_name field directly into the HTML email body, confirmed by the patch commit which adds Django's escape() call. No active exploitation is confirmed in CISA KEV, but the Secur0 CNA advisory fully documents the injection point and patch version 1.1.3 is available.
Cross-site scripting in Webkul Bagisto up to version 2.4.4 allows remote unauthenticated attackers to inject script-related HTML tags via the first_name or last_name parameters submitted to the /customer/register endpoint, with impact routed through the Customer-Registration Notification Email component. The CVSS 4.0 score of 2.1 reflects constrained real-world impact - user interaction is required and integrity impact is low - but a publicly available proof-of-concept on GitHub documents and lowers the bar for this attack. The vendor acknowledged the findings, confirming some issues have been addressed internally, though no specific patched release version has been publicly identified.
Cross-site scripting in the Alaev SEO Tools Chrome Extension (versions up to 1.0.10) exposes users to script injection via the popup UI's addDiv function, which fails to sanitize externally sourced page SEO field data before inserting it into the DOM. A working proof-of-concept exploit is publicly available on GitHub, demonstrating injection through crafted page metadata. The vendor did not respond to responsible disclosure, and no patch has been released, leaving all users of affected versions without an official fix.
Cross-site scripting in Apache Allura's Markdown rendering (versions 1.10.0 up to but not including 1.19.1) allows an attacker to inject script-related HTML into content that other users view, executing arbitrary JavaScript in their browsers. Because Allura is a collaborative forge where users routinely post Markdown in tickets, wiki pages, and comments, the payload is most likely stored and delivered to victims who open the affected page. No public exploit identified at time of analysis, and there is no CISA KEV listing or POC signal; the Apache PMC has released version 1.19.1 as the fix.
Cross-site scripting (XSS) in Apache Allura's code-display feature allows an attacker who can place crafted content into a rendered code view to execute arbitrary JavaScript in the browser of any user who views that code, in all versions before 1.19.1. Because Allura is forge/project-hosting software, a successful attack can hijack the sessions of project members or administrators. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Stored and DOM cross-site scripting in the Jodit WYSIWYG editor (npm, all versions before 4.13.6) allows attacker-supplied JavaScript to survive the clean-html sanitizer by exploiting a case-sensitivity flaw in the deny/allow tag filter. SVG- and MathML-namespaced elements return lowercase nodeName values, while the denyTags hash is keyed by uppercase strings, so a `<script>` nested inside `<svg>` reports 'script' instead of 'SCRIPT' and passes the filter unblocked. A publicly disclosed proof-of-concept exists; the vulnerability is not listed in CISA KEV.
Cross-site scripting in Softtr E-Commerce Pack (all versions before 5.03.01.49) allows unauthenticated remote attackers to inject malicious script-related HTML tags into rendered web pages, requiring victim interaction to trigger execution. The flaw is rooted in CWE-80 (Improper Neutralization of Script-Related HTML Tags), enabling integrity abuse such as session hijacking, credential phishing, or checkout-flow manipulation within affected storefronts. No public exploit code or active exploitation has been identified at time of analysis.
Cross-site scripting in justhtml versions before 1.13.0 allows attackers who control `<pre>` element content to break out of fixed-length Markdown code fences and inject raw HTML into the serialized output. When an application passes attacker-supplied HTML through `JustHTML(..., sanitize=True).to_markdown()` and a downstream CommonMark or GFM renderer processes the result with raw-HTML enabled, the injected script executes in the victim's browser. A proof-of-concept with full reproduction steps is publicly available in the GHSA advisory; no public exploit identified at time of analysis beyond that PoC.
Stored cross-site scripting in CVAT versions 2.68.0 through 2.69.x allows an authenticated user with annotation guide editing permissions to inject persistent malicious JavaScript into audio-task guide content, which executes in any other user's browser when they open the guide. The payload can silently issue arbitrary CVAT API requests - including data exports, task modifications, or privilege escalation actions - using the victim's active session credentials. No public exploit code has been identified at time of analysis; the vendor-confirmed fix is available in version 2.70.0.
Stored cross-site scripting in the Cisco Industrial Ethernet 1000 Series Switch web-based management interface allows an authenticated remote attacker to inject persistent malicious scripts into interface pages, which then execute in the browser context of other authenticated users. Affected firmware spans versions 1.1 through 1.9.5 across the IE 1000 product line, as confirmed by EUVD-2026-62562 and the Cisco security advisory. No public exploit code or active exploitation has been identified at time of analysis, and Cisco has published advisory cisco-sa-ie1k-NgXUFF52 with remediation guidance.
HTML injection in MailerUp's public subscription form (all versions before 1.1.3) allows unauthenticated remote attackers to embed arbitrary HTML into the double opt-in verification email the application sends, using the form owner's configured sending identity and an attacker-specified recipient address. The root cause is unescaped interpolation of the subscriber-supplied first_name field directly into the HTML email body, confirmed by the patch commit which adds Django's escape() call. No active exploitation is confirmed in CISA KEV, but the Secur0 CNA advisory fully documents the injection point and patch version 1.1.3 is available.
Cross-site scripting in Webkul Bagisto up to version 2.4.4 allows remote unauthenticated attackers to inject script-related HTML tags via the first_name or last_name parameters submitted to the /customer/register endpoint, with impact routed through the Customer-Registration Notification Email component. The CVSS 4.0 score of 2.1 reflects constrained real-world impact - user interaction is required and integrity impact is low - but a publicly available proof-of-concept on GitHub documents and lowers the bar for this attack. The vendor acknowledged the findings, confirming some issues have been addressed internally, though no specific patched release version has been publicly identified.
Cross-site scripting in the Alaev SEO Tools Chrome Extension (versions up to 1.0.10) exposes users to script injection via the popup UI's addDiv function, which fails to sanitize externally sourced page SEO field data before inserting it into the DOM. A working proof-of-concept exploit is publicly available on GitHub, demonstrating injection through crafted page metadata. The vendor did not respond to responsible disclosure, and no patch has been released, leaving all users of affected versions without an official fix.
Cross-site scripting in Apache Allura's Markdown rendering (versions 1.10.0 up to but not including 1.19.1) allows an attacker to inject script-related HTML into content that other users view, executing arbitrary JavaScript in their browsers. Because Allura is a collaborative forge where users routinely post Markdown in tickets, wiki pages, and comments, the payload is most likely stored and delivered to victims who open the affected page. No public exploit identified at time of analysis, and there is no CISA KEV listing or POC signal; the Apache PMC has released version 1.19.1 as the fix.
Cross-site scripting (XSS) in Apache Allura's code-display feature allows an attacker who can place crafted content into a rendered code view to execute arbitrary JavaScript in the browser of any user who views that code, in all versions before 1.19.1. Because Allura is forge/project-hosting software, a successful attack can hijack the sessions of project members or administrators. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Stored and DOM cross-site scripting in the Jodit WYSIWYG editor (npm, all versions before 4.13.6) allows attacker-supplied JavaScript to survive the clean-html sanitizer by exploiting a case-sensitivity flaw in the deny/allow tag filter. SVG- and MathML-namespaced elements return lowercase nodeName values, while the denyTags hash is keyed by uppercase strings, so a `<script>` nested inside `<svg>` reports 'script' instead of 'SCRIPT' and passes the filter unblocked. A publicly disclosed proof-of-concept exists; the vulnerability is not listed in CISA KEV.