XSS
Monthly
Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 before CP 1644 has XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 53.3%.
A persistent XSS vulnerability exists in the User-Agent header of the login process of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to steal session IDs of logged in users when the. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 68.2%.
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DIR-645 Router (Rev. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 92.2%.
Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 63.9%.
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 allow remote attackers to inject arbitrary web script or. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 allows. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 76.5%.
Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 16.3%.
The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back in the page, allowing unauthenticated attackers to run arbitrary web scripts in a visitor's browser if they can trick the visitor into following a crafted link (reflected XSS).
The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of several directly accessible scripts, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone they can induce to submit a crafted request.
Stored cross-site scripting in the Photo Gallery by 10Web - Mobile-Friendly Image Gallery WordPress plugin (all versions up to and including 1.8.44) lets an authenticated attacker holding Author-level capabilities or higher inject arbitrary JavaScript through the plugin's shortcode attributes, which is then persisted and executed in the browser of any user who subsequently loads the injected page. The practical impact is limited - the payload only fires when a victim, ideally a higher-privileged administrator or editor, views the poisoned content, and the attacker must already hold a legitimate Author account - and no public exploit code has been identified at time of analysis, with no CISA KEV entry indicating active exploitation. The issue is rated moderate (CVSS 6.4) rather than critical, reflecting the authenticated prerequisite and the requirement that a victim visit the affected page.
Stored cross-site scripting in Craft CMS (5.7.0 through 5.10.12) allows an authenticated content editor to plant malicious JavaScript that executes in the Control Panel session of a higher-privileged user who views the affected element index. The flaw lives in the Generated Fields feature, which disables Twig autoescaping and caches field values without encoding, so injected markup is served raw; exploitation requires an editor-level account (PR:L), the optional Generated Fields feature to be in use, and the victim to open the index (UI:P), and the resulting impact is confined to the victim's browser session with no server-side confidentiality, integrity, or availability loss. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the practical risk is moderate rather than critical because of the account, feature, and interaction prerequisites.
Stored cross-site scripting in AVideo through 29.0 (revision e01e41ecc) allows unauthenticated remote attackers to inject arbitrary HTML/JavaScript into the videos_statistics table via the view-counter endpoint, which is then executed in the session of a video owner or administrator who visits the statistics page. The vulnerability arises because unrecognized User-Agent strings are stored verbatim in the app column without invoking the sanitizing setter, and the DataTables 1.12.1 renderer on view/videoViewsInfo.php uses innerHTML. No vendor patch is available, no public exploit code was identified at time of analysis, and exploitation is limited by the need for a privileged user to view the stats page and a 45-character payload truncation.
Stored and reflected cross-site scripting in djust (pip package djust) before 1.0.7 allows a javascript: URL supplied through user-controllable data to survive into the href/action attributes of built-in component template tags, executing script in a victim's authenticated browser session when the link is clicked. Only applications that bind untrusted URLs to components such as breadcrumb, dj_nav link/dropdown/brand, citation URL, cookie-consent privacy link, error-page action or form action are affected; default djust output is not exposed. The issue is developer-usage-conditional, the assessed vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N (user interaction required, low-privileged/authenticated injecting party), no public exploit identified at time of analysis, and the vendor fix is available in djust 1.0.7.
HTML markup injection in changedetection.io through 0.60.6 allows an attacker who controls the <title> of a page being monitored to inject arbitrary markup into the notification messages that changedetection.io generates. When a user's notification template uses the watch_title token and HTML-format notifications are enabled for a channel such as email or Telegram, that markup is delivered as live content rather than escaped text, enabling content spoofing and phishing inside notifications. Exploitation is unauthenticated (PR:N per the assessed vector) but heavily gated by preconditions - the victim must monitor an attacker-influenced page, use the watch_title token, enable HTML notifications, and actually view the rendered notification - and publicly available exploit code exists, though there is no confirmed active exploitation (CISA KEV).
Reflected cross-site scripting in the web-based management interface of Cisco Identity Services Engine (ISE) lets a remote, unauthenticated attacker execute arbitrary script code in the browser session of an ISE interface user who is persuaded to click a crafted link (CVSS 3.1 base 6.1, CWE-79). Successful exploitation is confined to the victim's browser context - the attacker can read browser-based information or act as the interface user, but there is no server-side code execution and no availability impact (C:L/I:L/A:N). Exploitation requires user interaction (UI:R) against a legitimate interface user, so exposure drops sharply if the admin interface is not reachable from untrusted networks; at time of analysis there is no CISA KEV entry and no public exploit code identified, although the affected version list is broad, covering ISE 3.1.0 through 3.5 releases.
Stored cross-site scripting in ChangeWeDer CRM allows an authenticated low-privilege user to plant JavaScript in the customerName argument submitted through the customer record Save Endpoint (src/main/resources/public/js/customerServe/customer.serve.js), which then executes in the browser of a CRM operator who later opens the same customer record. The project follows a rolling-release model, so no affected or fixed version numbers are published, and the maintainers were notified through an upstream GitHub issue but have not responded. Publicly available exploit code exists; there is no CISA KEV listing, and EPSS data is not available. The assessed CVSS:3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, matching a low-to-moderate severity finding rather than a top-priority emergency.
Stored cross-site scripting in Adobe Experience Manager lets a low-privileged authenticated attacker (CVSS vector PR:L) persist malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who later views the affected page (UI:R), driving the score to 5.4 with a changed scope (S:C) because the impact lands on the victim's session rather than the vulnerable component itself. The affected line-up is AEM as a Cloud Service, AEM 6.5 LTS, and AEM 6.5, and exploitation is not self-contained: the attacker needs an account able to write into the form field and must wait for a separate, ideally higher-privileged, victim to browse that page. No public exploit code and no confirmed active exploitation were identified at time of analysis, and this is assessed as a genuinely moderate, not high-priority, issue.
Concrete CMS 9.2.0 through 9.5.3 fails to enforce an authorization check on its REST API user-creation endpoint (POST /ccm/api/1.0/users), so any request bearing a valid OAuth token that carries the users:add scope - including a client_credentials token with no associated user context - can create active, validated accounts while bypassing email verification and administrator approval. The endpoint's add() method in concrete/src/Api/Controller/Users.php performs no permission verification, making this a classic missing-authorization weakness (CWE-862) that an authenticated API consumer can abuse to gain a foothold. Under default registration settings the newly minted accounts are allowed to edit page content, which provides an escalation path to stored cross-site scripting and further compromise of the CMS. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the reporter-independent assessment rates the impact as limited to low integrity loss on the CMS itself.
Cross-site scripting (XSS) in the Category Update function (/admin/update_category.php) of SourceCodester Online Food Ordering System 1.0 allows an authenticated administrator to inject script payloads that execute in the browser when the manipulated category page is rendered, requiring user interaction. Publicly available exploit code exists, but the high-privilege prerequisite (admin access) and limited integrity-only impact make this a low-severity admin self-XSS scenario; no active exploitation (CISA KEV) is indicated.
Cross-site scripting in PbootCMS versions 3.2.0 through 3.2.22 lets an authenticated backend user supply a malicious value in the content Title argument, which the decode_string function in apps/admin/controller/content/ContentController.php fails to neutralize before the Template Rendering component outputs it; the injected script then executes in the browser of any user who loads the rendered page. Publicly available exploit code exists, but exploitation is constrained by two prerequisites - a valid backend account and victim interaction with the tainted page - and the assessed impact is limited to manipulation of page content in the viewer's browser, with no confidentiality or availability impact. This is a low-priority issue despite being remotely reachable.
Cross-site scripting in udecode Plate's core HTML deserialization APIs allows attacker-controlled script to execute in a consuming application's origin when untrusted or cross-user HTML is deserialized and then loaded by another user; affected builds are all versions prior to 53.3.11 plus the discontinued 54.0.0-beta.0 and 54.0.0-beta.1 prereleases. The pre-fix code parsed supplied HTML strings in the active document, so certain attributes triggered browser behavior before the markup was converted into editor nodes; the assessed vector (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) reflects network-delivered input needing no authentication (PR:N) but requiring victim interaction (UI:R) and a scope change, and exploitation is only realistic where the consuming application itself wires attacker-influenced HTML into these APIs. There is no public exploit identified at time of analysis and no KEV listing, but the vendor has shipped a fix in 53.3.11.
Stored cross-site scripting (XSS) in the Jenkins Gitee Plugin (versions up to and including 1301.v8957053c7902) allows an authenticated attacker who can trigger builds via the plugin's push webhook and control the sender name field to inject malicious JavaScript into build causes, which executes when a Jenkins user views the affected build's causes page. The vulnerability requires the plugin's webhook endpoint to be reachable and a user to subsequently view the build page (UI:R). No public exploit code has been identified at time of analysis, and the vendor's CVSS score of 6.8 uses a boilerplate vector; independent assessment rates it as CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Stored cross-site scripting in the Modbus transaction management interface of Advantech EKI-1242EIMS and EKI-1242IEIMS industrial gateways (firmware V1.06.01) lets an attacker who already holds high-privileged authenticated access to the gateway web UI persist malicious script that later executes in the browser of any administrator who opens the affected management page. Because the payload is stored and served from the device itself, the more serious consequences land in the victim administrator's browser session (scope change to High per the CVSS:4.0 vector, and C:H/I:H/S:H in the 3.1 assessment) while impact on the gateway itself is limited to Low confidentiality and integrity, with no availability impact. Exploitation requires two compounding preconditions - pre-existing admin credentials (PR:H) and a victim administrator's subsequent page view (UI:P) - so there is no unauthenticated or zero-interaction path; no public exploit code or confirmed active exploitation was identified at time of analysis.
A stored/cross-context cross-site scripting flaw (CWE-79) in GitLab CE/EE's Content Editor allows an unauthenticated attacker to run arbitrary JavaScript in a targeted user's session, because pasted HTML is not sanitized properly. All GitLab Community and Enterprise Edition versions from 19.0 up to (but not including) 19.1.8, 19.2.6, and 19.3.2 are affected. Publicly available exploit information exists via a HackerOne report, but the issue is not listed in CISA KEV and its low EPSS-relevant profile (CVSS 4.7, AC:H, UI:R) places it in the moderate rather than emergency tier.
The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting.
The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the browser of a high privileged user, such as an administrator, viewing that screen.
Reflected cross-site scripting in the Better Messages WordPress plugin (Chat Rooms, Group Chat, Private Messages & AI Chat Bots) affects all versions up to and including 2.15.22, where the 'icn' parameter is neither sanitized on input nor escaped on output. An attacker who can craft a link with a malicious 'icn' value and persuade a logged-in or anonymous visitor to click it can execute arbitrary JavaScript in that victim's browser context on the affected site. No public exploit code or active exploitation has been reported, but the flaw is trivially automatable and the fix is already published in the 2.15.23 tag.
Stored cross-site scripting in the Bold Page Builder plugin for WordPress, affecting all versions up to and including 5.9.6, lets authenticated users with Contributor-level access plant persistent JavaScript that executes in the browser of anyone who views the injected page. The plugin's bt_bb_save_pre filter is bypassable via null-byte injection, and the bt_bb_raw_content shortcode handler outputs base64-decoded content without adequate sanitization, so payloads survive the intended checks. No public exploit code or CISA KEV entry was identified at time of analysis; the supplied Trac changeset indicates an upstream fix has been committed, but no patched release version is confirmed in the available data.
Stored cross-site scripting in the Advanced Popups WordPress plugin (all versions up to and including 1.2.3) lets an authenticated attacker holding author-level rights or above inject arbitrary JavaScript through the popup 'Notification Button Link' field, which is then rendered unsanitized to every visitor of the affected page. Because the payload is persisted in the site's database, any visitor — including administrators — who opens the injected page will execute the script in their own browser session. No public exploit code and no CISA KEV entry were reported at the time of analysis, and the maintainers shipped a fix in version 1.2.4.
Cross-site scripting in the a2a-chat-canvas markdown rendering component of a2ui (a2ui-project) up to version 0.10.7 allows a low-privileged authenticated user to plant script that executes in another user's browser when the chat canvas renders the crafted content. The defect lives in samples/community/client/angular/projects/a2a-chat-canvas/src/lib/services/sanitizer-markdown-renderer-service.ts, where markdown is converted to HTML without fully neutralizing dangerous markup, yielding an integrity/behavior impact (VI:L) rather than data disclosure (VC:N). There is confirmed CISA KEV status: no active exploitation has been reported, no public exploit code exists, and tracking is currently handled through a public GitHub issue rather than a formal vendor security bulletin.
kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. The OnlinePreviewController passes the user-controlled page and kkagent request parameters to FreeMarker templates without sanitization, and the templates insert these values into raw JavaScript contexts.
Netcore NR255-V firmware 1.5.130703 stores attacker-supplied script in L7 content management fields - specifically the call board text and policy group handling components - and later renders that content through eval() sinks, so the payload executes in the browser of any user who views the affected page. Exploitation requires an authenticated management session (CVSS PR:L) plus a victim who opens the poisoned page (UI:P), which keeps the practical severity moderate (CVSS 5.1, low confidentiality and integrity impact). There is no public exploit identified at time of analysis and no CISA KEV listing; the issue is documented through a VulnCheck advisory and a GitHub proof-of-concept-style technical write-up rather than a vendor security bulletin.
Stored cross-site scripting in Netcore NR255-V firmware 1.5.130703 allows an attacker positioned on the same LAN to inject script through DHCP client hostname fields and ARP bind entries; the router persists the payload and network_config.js and network_security.js render it unescaped in the web management interface. When an administrator opens the DHCP dynamic IP list or ARP bind list page, the injected script runs in their authenticated session, potentially exposing session tokens or enabling management actions as the admin. The issue is rated CVSS 5.1 (AV:A, PR:N, UI:P) and no public exploit was identified at time of analysis.
Stored cross-site scripting in the Netcore NR255-V router (firmware 1.5.130703) lets a user with access to the web management interface persist malicious JavaScript into DHCP static IP reservations and IP ACL entries via the dhcp_add_staticip_cgi, dhcp_staticip_show_cgi, ip_acl_set_cgi and ip_acl_show_cgi handlers. The injected script is stored on the device and executes in the browser of any other user — typically a higher-privileged administrator — who opens the affected DHCP or ACL pages, enabling session theft or unauthorised configuration changes performed as that victim. The issue carries only a moderate CVSS 4.0 base score of 5.1 (AV:N/AC:L/AT:N/PR:L/UI:P), no CISA KEV listing and no confirmed public exploit code, so it is a real but comparatively narrow risk concentrated on this specific legacy SOHO router model.
Stored cross-site scripting in the web management interface of the Netcore NR255-V router (firmware 1.5.130703) allows an attacker who already holds a valid management session to plant persistent JavaScript on routing and NAT configuration pages; the payload then executes in the browser of any user who later opens those pages, including higher-privileged administrators. The flaw sits in four CGI handlers (routing_tab_add_cgi, routing_table_list_show_cgi, route_policy_add_cgi, route_policy_parame_show_cgi) that fail to sanitise or encode route/NAT parameters before rendering them. CVSS 4.0 is a moderate 5.1 (AV:N/AC:L/AT:N/PR:L/UI:P), reflecting the need for an authenticated foothold plus a victim viewing the page; at time of analysis there is no CISA KEV listing and no public exploit code identified.
Stored cross-site scripting in the Netcore NR255-V router (firmware 1.5.130703) lets an authenticated administrator persist malicious JavaScript inside a QoS rule name, which the qos_xianz_add_cgi, qos_xianz_show_cgi, qos_filter_add_cgi and qos_filter_show_cgi handlers later pass to eval() without sanitisation. The injected script runs in the browser of any administrator who subsequently opens the affected QoS pages, allowing session theft, credential capture, or silent reconfiguration of the device through the victim's authenticated session. No public exploit code or active exploitation has been confirmed from the available intelligence.
Stored cross-site scripting in Netcore NR255-V firmware 1.5.130703 lets an authenticated administrator plant malicious JavaScript through the router's DDNS configuration, which then executes persistently every time the DDNS WAN list page (ddns_wan_list_show.cgi) is opened. The flaw stems from unsafe eval() handling of DDNS-supplied data in that CGI endpoint, so the injected payload is saved with the device configuration and survives page reloads and reboots. Confidentiality and integrity impact are rated low and no public exploit code has been identified at time of analysis, though the VulnCheck advisory and a public reference write-up are available.
Reflected cross-site scripting in QloApps up to and including 1.7.0 lets an attacker inject JavaScript into the back-office Hotel Reservation System feature-management page by supplying a crafted child_features parameter that is echoed back unescaped inside a validation error message. Only authenticated back-office users are targeted, and they must follow an attacker-supplied link before the payload fires in their administrative session, which is why the CVSS 4.0 base score is a moderate 5.1 rather than critical. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but an upstream fix exists in commit 54a3b30 / PR #1796.
Stored cross-site scripting in Concrete CMS 9.5.2 and earlier allows an authenticated user with file-upload rights to embed a javascript: URI in an SVG's xlink:href attribute that survives storage and executes in the browser of any user who opens the uploaded file directly. The flaw only manifests when the non-default 'Reject files containing potentially harmful elements' mode is selected (concrete.file_manager.images.svg_sanitization.action = reject), because in that mode the CMS discarded the output of the enshrined/svg-sanitize pass and relied solely on a narrow built-in blocklist covering <script> and on* handlers. No public exploit code or CISA KEV listing was identified, and the vendor-assigned CVSS v4.0 base score is a low 1.8, reflecting the need for upload privileges, a non-default configuration, and victim interaction.
Concrete CMS versions 9.4.0 through 9.5.2 fail to escape page paths before rendering them inside the location panel's duplicate-path confirmation dialog: the panel's check endpoint reflects the submitted path unmodified in its JSON response, and client-side JavaScript injects that value as raw HTML, so a crafted path executes script in an authenticated editor's browser session. An attacker must already hold page-authoring privileges and must engineer a path collision so the confirmation dialog appears, and the victim must then open that panel; no public exploit code or CISA KEV entry is associated with this CVE at time of analysis.
Let me synthesize. CVE-2026-18426: Concrete CMS 9.0.0 through 9.5.2, missing block-level edit permission check on Express Form block control-management actions, relying solely on CSRF token validation. Token bound to user and action, not block/page/form. So authenticated user with edit access to one Express Form could reuse token to add/modify/delete controls on forms they aren't authorized to edit, including injecting control whose value later rendered as HTML → stored XSS. CVSS 4.0 2.0, AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N. CWE-862 missing authorization. Tags: XSS, Authentication Bypass, CSRF. Hmm — "Authentication Bypass" tag is arguably mislabeled since it's a missing authorization check (CWE-862), not authentication bypass. Actually that's a good candidate for data_quality_flags mislabeled_tag. The tag "Authentication Bypass" is wrong — this is an authorization flaw (CWE-862), not authentication bypass. Confidence: medium/high. I'd say medium-high. Let's use "high" given CWE-862 is explicitly missing authorization and PR:H required (authenticated user). Actually the tag list includes both XSS and CSRF — both apply somewhat (stored XSS outcome, CSRF token bypass). "Authentication Bypass" is the questionable one. I'll flag it with confidence "medium" or "high". I'll use "high" — the description explicitly says "did not enforce a block-level edit-permission check", which is authorization, and CVSS PR:H means authenticated. So "Authentication Bypass" is mislabeled. Suggest "Missing Authorization" — hmm, suggested field is "the correct/canonical slug if you know it". Perhaps suggested: "missing-authorization" or "authorization-bypass". I'll say "authorization-bypass". Missing tags? Maybe "concrete-cms" / "concrete5" vendor tag absent. Tags list: XSS, Authentication Bypass, CSRF. Missing tag candidates: "Concrete CMS" (vendor/product) — suggested "concrete-cms", high confidence from description. Also "CWE-862" / "Missing Authorization" technique tag. I'll add "
Reflected cross-site scripting in Concrete CMS versions 5.0.0 through 9.5.2 lets an attacker run arbitrary JavaScript in a victim's browser by abusing the conversation messages feature's handling of a user-supplied custom date format. Because the conversation view endpoint carries no CSRF token, the payload can be delivered through an auto-submitting cross-origin POST from an attacker-controlled page, and the independently assessed vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) treats the attack as unauthenticated, requiring only that the victim load a malicious page. Impact is limited to the victim's browser session - reflected rather than stored XSS, with partial confidentiality and integrity loss and no availability impact - and the vendor's own CVSS v4.0 score of 2.1 (AT:P/PR:L/UI:P) reflects that exploitability depends on attacker-provided content and victim interaction; no public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fully remediated in 9.5.3.
Authenticated administrators of the HPE (Aruba) EdgeConnect SD-WAN Orchestrator web management interface can be tricked into running attacker-supplied script in their own browser session, exposing data handled by the management plane. The flaw is a cross-site scripting (CWE-79) issue rated CVSS 5.5 with a scope change (S:C), meaning the injected code runs in the victim's browser context rather than inside the orchestrator process itself. There is no public exploit identified at time of analysis and the issue does not appear on CISA KEV, but exploitation requires an already-authenticated account, so the practical risk depends heavily on how many privileged accounts exist and how well the UI is network-restricted.
Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance <= V6.0104 allows a remote attacker to execute arbitrary code via the size parameter in ptzpreset.pml component and the showmovies.pml component
Stored cross-site scripting in Concrete CMS 5.0.0 through 9.5.2 lets an unauthenticated attacker inject raw HTML through a publicly accessible Express Form; the payload is rendered unsanitized as an Express entry label whenever associated entries are displayed, executing in an administrator's dashboard session and in the browsers of visitors to pages containing an Express Entry List block with association columns. The Concrete CMS security team rates this CVSS v4.0 2.3 (AV:N/AC:L/AT:P/PR:N/UI:P), reflecting that exploitation depends on specific Express configuration and passive victim interaction rather than open, unconditional exposure. No public exploit code or CISA KEV listing was identified at time of analysis, and fixed code is available in Concrete CMS 9.5.3.
Stored cross-site scripting in IBM Cloud Pak for Business Automation allows an authenticated user to plant JavaScript inside Web UI content that is later rendered to other users. When a victim loads the affected page, the injected script runs inside the application's trusted origin, enabling session-token or credential theft and UI manipulation (CVSS 3.1 6.4, CWE-79). IBM has published a fix; no public exploit code and no CISA KEV listing were identified at time of analysis.
Stored cross-site scripting in IBM Cloud Pak for Business Automation allows an authenticated user to persist arbitrary JavaScript inside Web UI content, which then executes in the browser of any other user who views the affected page. Successful exploitation can disclose session credentials or other sensitive data belonging to the victim's trusted session, and can alter the intended behavior of the Web UI for that user. IBM has published an advisory and states that a fix is available from the vendor; no public exploit code or CISA KEV listing was identified at time of analysis.
IBM Cloud Pak for Business Automation is affected by HTML injection (CWE-80) in one or more web UI components, allowing an attacker who already holds low-privileged authenticated access to inject markup that executes in a victim's browser within the hosting site's security context. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting a network-reachable, low-complexity flaw that still requires authentication and victim interaction, with scope change because the injected script runs against the site's origin. No EPSS score, CISA KEV entry, or public exploit code was provided in the intelligence feed, so active exploitation is unconfirmed; IBM has published a fix advisory.
Stored/reflected cross-site scripting in code-projects Record Management System 1.0 allows an attacker to inject JavaScript through the 'desc' parameter processed by main/reg.php, which then executes in the browser of any user viewing the affected page. The flaw is remotely reachable without authentication, though it does require a victim to interact with the poisoned page or field. Publicly available exploit code exists (a GitHub write-up demonstrating the payload), but the issue is not listed in CISA KEV and no EPSS signal was supplied, so exploitation in the wild has not been confirmed. The CVSS 4.0 base score of 5.3 is moderate; the practical impact is limited to session theft, credential phishing, or defacement within the deployed instance rather than server compromise.
A reflected cross-site scripting (XSS) flaw in the Italian government school WordPress theme "Design Scuole Italia" lets an unauthenticated attacker run arbitrary JavaScript in a victim's browser by luring them to a crafted URL whose archive parameter is echoed unsanitized by filters-scheda-didattica.php. All versions from 1.0 through 2.18.2 are reported affected by ENISA/EUVD. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but any site running the theme is exposed to session theft, credential phishing and drive-by redirects against visitors and logged-in administrators alike.
A DOM-based cross-site scripting flaw in the Crawl4AI Playground UI (versions before 0.9.3) lets attacker-controlled crawled content — for example a malicious page title — be re-parsed as HTML inside the forceHighlightElement() routine, which writes textContent back into innerHTML. Because the Playground stores the operator's API token in sessionStorage, a successful payload can read that token and hand an attacker full control of the underlying Crawl4AI server. Exploitation requires the operator to load attacker-controlled page content in the Playground and trigger the highlight action; no public exploit code or CISA KEV entry is confirmed in the supplied intelligence, and the vendor has released a fix in 0.9.3.
Let me synthesize. CVE-2026-91942: crawl4ai before 0.9.3, DOM-based XSS in Docker Playground UI, innerHTML assignment of untrusted crawl results. Malicious PDFs with event-handler markup execute JS in Playground origin, steal API tokens from sessionStorage. CVSS 4.0 vector given: AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N — score 5.1. UI:A means user interaction active (user must open the PDF in the playground). Subsequent system impacts limited (SC:L/SI:L). PR:N unauthenticated. Wait — description says "steal API tokens from sessionStorage for authenticated API abuse" — the attacker themselves may be unauthenticated but the victim is an authenticated user. PR:N with UI:A. Let me construct fields. product_name: "Crawl4AI" (2 words? one token). Fine. prevalence: crawl4ai is a popular open-source LLM-friendly web crawler — medium? It's fairly widely used in AI/RAG pipelines. It's a Python library with ~40k GitHub stars. Deployment footprint: medium. Docker Playground UI is a specific deployment mode though — that reduces. I'd say "medium" with basis "popular open-source LLM crawler; Playground UI subset narrower". Hmm, but the specific vulnerable component (Docker Playground UI) is niche. But prevalence is about the product. crawl4ai is popular open-source library. Medium seems fair. assessed_cvss_vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N — scope changed because it impacts the Playground origin / API tokens (sessionStorage tokens, the script executes in the Playground origin). Actually the CVSS 4.0 vector shows SC:L/SI:L which implies subsequent system impacts → in 3.1 that maps to S:C with C:L/I:L. Hmm, but is scope change right? The vulnerable component is the Playground UI; the impacted component is... the API tokens / authenticated API. The XSS executes in the Playground origin — same origin. Stealing sessionStorage tokens then abusing the API — the API is arguably a different security authority. Given the CVSS 4.0 has subsequent-sys
Stored cross-site scripting in the Bridge creative multipurpose WordPress theme affects every version through 30.8.9.1, allowing authenticated users with contributor-level access or higher to inject arbitrary JavaScript into pages by abusing the 'circle_line' shortcode attribute, which is stored unsanitized and rendered unescaped. The injected script executes in the browser of any user — including administrators previewing a submitted post — who views the affected page. No public exploit code is identified and the flaw is not listed in CISA KEV, but the low privilege bar (a contributor account) and the scope-changing CVSS vector (S:C) make it a realistic privilege-escalation vector on multi-author sites.
Reflected cross-site scripting in Steedos Platform (all versions through 3.0.15-beta.47) lets an attacker inject JavaScript into the anonymous /api/page/render endpoint by abusing the schemaApi or data query parameters, which are written unescaped into inline script elements. Because the endpoint requires no authentication, a crafted link is enough: when a logged-in Steedos user opens it, the attacker's script runs in the victim's browser context and can read and exfiltrate the X-Auth-Token session credential, enabling full account takeover of that session. No public exploit code or active exploitation has been observed at time of analysis, though the vulnerable source files and route are publicly linked in the advisory references.
Stored Cross-Site Scripting in the Job Postings WordPress plugin (versions ≤ 2.8.1) allows authenticated attackers with contributor-level access to inject persistent JavaScript payloads via the 'position_button' parameter, which subsequently execute in the browsers of any user who views the affected page. The vulnerability stems from insufficient sanitization of input and missing output escaping in class-job-add-edit.php, enabling session hijacking, credential theft, or malicious redirects against visiting users including administrators. No public exploit has been identified at time of analysis and no KEV listing is present, making this a medium-priority finding gated entirely on attacker access to a contributor account.
Stored Cross-Site Scripting in the Eventin WordPress plugin (all versions up to and including 4.1.23) allows contributor-level authenticated attackers to inject persistent arbitrary JavaScript via the `etn_shedule_objective` field within the schedule_slot REST API parameter. The injected payload executes in the browsers of any user who subsequently views an affected event schedule page, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stored XSS in bizwell xClick groupware allows authenticated low-privileged users to inject malicious scripts that execute in the browsers of other users who view the affected content. The flaw stems from improper input validation (CWE-20) across xClick releases R2, R3, and R3.1. No public exploit code or active exploitation has been identified at time of analysis, and real-world impact is limited by the product's regional deployment footprint.
Cross-site scripting (CWE-79) in PHPGurukul Hostel Management System 3.0 lets an attacker inject script through the admin-side /admin/manage-students.php page, which is then rendered without adequate output encoding. Publicly available exploit code exists, so a working payload is already circulating against a target set that is mostly small institutional or academic deployments. The CVSS 4.0 score of 1.9 is low because the vector requires high privileges (PR:H) and user interaction (UI:P), with only a limited integrity impact and no confidentiality or availability loss recorded.
Cross-site scripting in Governikus AusweisApp through version 2.5.4 lets a remote attacker plant script through the ResultMessage argument handled by the StartPAOSResponse component, so that attacker-influenced content is rendered instead of plain result text. The flaw is network-reachable with no privileges required, but the user must be engaged in an eID flow before the malicious response is processed. No public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and the vendor has released version 2.5.5 as the fix.
Stored XSS in the PublishPress Authors WordPress plugin (all versions through 4.15.0) allows authenticated users holding Author-level access or above to inject persistent malicious scripts via the `profile_fields_user_email_value_prefix` parameter in author box configuration. The injected payload executes in the browser of any site user who clicks the affected author box link, enabling session hijacking, credential theft, or admin account takeover through the browser context of higher-privileged victims. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Stored Cross-Site Scripting in the ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress (versions up to and including 4.9.5) allows authenticated attackers with Author-level access or higher to persistently inject arbitrary JavaScript via the `shopengine_product_title_header_size` parameter. The injected payload executes in any site visitor's browser upon loading an affected page, enabling session hijacking, credential theft, or malicious redirects. No public exploit code has been identified at time of analysis, and it is not listed in the CISA KEV catalog.
Stored cross-site scripting in PHPGurukul Daily Expense Tracker System 1.1 allows an authenticated attacker to inject malicious JavaScript via the FullName parameter handled by /dets/includes/sidebar.php. Because sidebar content is rendered for other users viewing the application, the payload executes in victims' browsers, enabling session hijacking or credential theft against other authenticated users or administrators. A public proof-of-concept is available via GitHub, though no active exploitation has been confirmed in CISA KEV.
Cross-site scripting in the Trufflebox UI (trufflebox-ui) of BharatMLStack up to and including v1.3.0 allows injected script to run in a logged-in operator's browser when the affected GenericNumerixTable.jsx table view renders unsanitized data. Impact is confined to the victim's browser session - limited confidentiality and integrity (C:L/I:L) with no server-side code execution or availability impact (A:N) - and exploitation requires user interaction, meaning an operator must load the poisoned table view. Authentication requirements are not fully settled: the published vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, but the independent assessment rates it PR:L, since a stored/table-data injection path would first require authenticated write access to plant the payload. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and EPSS is 0.15% (4th percentile), indicating low real-world urgency.
Stored cross-site scripting in the file upload feature of 1024-lab SmartAdmin v3.30.0 lets an authenticated remote attacker persist malicious script that executes in the browser of any user who later views the uploaded file or its entry in the file listing. The vendor-assigned vector requires a low-privileged account (PR:L) plus victim interaction (UI:R) and rates the issue 6.5 (Medium), with no CISA KEV listing, no EPSS score, and no confirmed public exploit code in the supplied intelligence. Impact is limited to low confidentiality, integrity, and availability effects within the victim's browser session, but the scope change (S:C) means the injected script can act on resources beyond the vulnerable component.
BharatMLStack up to and including 1.3.0 is vulnerable to Cross Site Scripting (XSS) via the component Trufflebox UI (trufflebox-ui) in ExpressionViewModal.jsx.
Bacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in the client address field.
Bacularis 4.7.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in director tags.
Stored cross-site scripting in itranswarp's Markdown rendering pipeline allows authenticated users to inject arbitrary JavaScript into page content that executes in other visitors' browsers. The flaw exists in the `Markdown.toHtml()` method of `Markdown.java`, which fails to sanitize malicious HTML or script constructs embedded in Markdown input before writing rendered output to the page. All 2.x releases through 2.19 are affected, the project is officially end-of-life with no maintainer response to the vulnerability report, and exploit code has been publicly published.
Cross-site scripting in Takahe through 0.11.0 allows any remote ActivityPub actor to inject executable `javascript:` scheme URLs into federated post content or profile summaries. The sanitizer in `core/html.py` does not block this URL scheme when processing inbound federated HTML, so a crafted link persists in the instance's rendered content. When a local user clicks such a link, the JavaScript executes in the Takahe instance's origin, enabling session hijacking or account impersonation without requiring any privileges on the target server. No public exploit or active exploitation has been identified at time of analysis.
Authenticated HTML injection in IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 lets a logged-in user plant unescaped markup in the management interface, so the product renders attacker-controlled content as trusted UI. The result is UI spoofing and phishing: a crafted page can impersonate legitimate Sterling Secure Proxy screens to harvest credentials or trick operators into unsafe actions, with limited confidentiality and integrity impact (CVSS 5.4). No public exploit code has been identified and the flaw is not listed in CISA KEV; the vendor has published a fix, though an exact fixed version is not named in the provided data.
Stored cross-site scripting in IBM Cognos Analytics 12.0.4 through 12.0.4 FP2 and 12.1.0 through 12.1.3 FP1 allows any authenticated non-privileged user to embed JavaScript in their own given name or surname profile fields. The payload is later rendered without encoding in the administrative user-account management panel, so the script executes in an administrator's browser session when that account's permissions are reviewed, potentially exposing the administrator's session cookies. The issue is rated CVSS 5.4 (medium) and a vendor patch is available; no public exploit code or CISA KEV entry was present in the provided intelligence, so active exploitation is not confirmed.
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting.
Cross-site scripting (CWE-79) in IBM Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and IBM Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001, including the corresponding container editions, allows a remote unauthenticated attacker to run script in the browser of a logged-in user who follows a crafted link, potentially hijacking an authenticated session or performing actions as that user. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), which reflects the need for victim interaction and the limited but scope-changing confidentiality and integrity impact typical of reflected XSS. There is no public exploit code identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and the EPSS probability is only 0.20% (10th percentile), so this is a patching-hygiene issue rather than an emergency response item.
HTTP request smuggling in IBM WebSphere Application Server 8.5 and 9.0 (including the Liberty variant) enables unauthenticated remote attackers to manipulate shared HTTP caches, circumvent web application firewall rules, and inject malicious scripts into responses served to other users. The root cause is improper parsing of the HTTP Transfer-Encoding request header (CWE-444), a class of vulnerability that exploits disagreement between a front-end proxy and the back-end application server over where one HTTP request ends and the next begins. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available.
HTTP request smuggling in IBM WebSphere Application Server 8.5, 9.0, and Liberty allows remote unauthenticated attackers to poison web caches, bypass web application firewall protections, and conduct cross-site scripting attacks by sending specially crafted Transfer-Encoding headers. The root cause is CWE-444, inconsistent interpretation of HTTP request boundaries between WebSphere and a frontend proxy component. No public exploit or confirmed active exploitation has been identified at time of analysis; a vendor patch is available from IBM.
Reflected cross-site scripting in IBM WebSphere Application Server 8.5 and 9.0 allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a specially crafted link to the vulnerable server. Successful exploitation can lead to session token theft, credential harvesting, or unauthorized actions performed under the victim's browser context. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.
Stored cross-site scripting in the share renderer of Trilium Notes v0.103.0 and earlier lets anyone with note-authoring privileges embed arbitrary JavaScript in a webView note via the unescaped #webViewSrc attribute, which then executes in the browser of every user who opens the shared note — including administrators. The flaw requires an authenticated author to create or modify the note and a victim to open the shared link (CVSS 5.4, PR:L/UI:R/S:C), so it is a privilege-escalation and session-hijack vector rather than an unauthenticated remote compromise. CISA SSVC rates exploitation as none and automatable as no, and no public exploit code or KEV listing is present in the supplied intelligence.
Insufficient HTML sanitization in the WSO2 API Manager Publisher Portal and Developer Portal lets untrusted input be rendered without encoding, so malicious JavaScript injected into API documentation executes in the browser of anyone who opens the affected document. Attackers need an authenticated portal account with permission to author or edit API documentation, then can act on behalf of any user viewing that documentation depending on that user's session privileges. No public exploit code or active exploitation has been identified, and the vendor has released patched update levels for all affected release trains.
Reflected cross-site scripting in itsourcecode Loan Management System 1.0 allows a remote, unauthenticated attacker to inject arbitrary script through the 'page' argument processed by navbar.php, because the value is echoed back into the HTML response without output encoding. Publicly available exploit code exists (a GitHub issue referenced from the CVE record), and the CVSS 4.0 base score is only 2.1 because exploitation requires the victim to interact and the demonstrated impact is limited to integrity (VI:L) with no confidentiality or availability loss and no scope change. It is not reported as actively exploited and no CISA KEV entry is present.
DOM-based cross-site scripting in TripleLift's video-bundle.js ad rendering script allows unauthenticated remote attackers to execute arbitrary JavaScript within a publisher's domain by sending crafted postMessage events without origin validation. The attack requires social engineering a victim into visiting an attacker-controlled page, which then fires malicious postMessage payloads at any publisher page running the TripleLift video ad script. Successful exploitation enables session hijacking and unauthorized DOM manipulation in the victim's browser context on the publisher domain. A publicly available proof-of-concept exists; no KEV listing at time of analysis.
Stored XSS in MISP ≤2.5.45 allows an authenticated user who can upload SVG files to plant malicious JavaScript that executes on the MISP origin when any other authenticated user navigates directly to the SVG URL (organisation logos or event-report pictures). Because the vulnerability lives in the serve path rather than the upload path, SVG payloads deposited while uploads were enabled remain exploitable even after SVG upload support is later disabled. No public exploit or CISA KEV listing identified; CVSS 4.0 scores this 5.1 and SSVC rates technical impact as partial with no known exploitation.
Stored cross-site scripting in LaraDashboard 0.9.0-1.2.2 allows any authenticated user holding only the `media.create` permission to upload SVG files containing embedded JavaScript. When any user - including administrators - opens the stored SVG served inline from the application origin, the script executes in the dashboard's browser context, enabling session cookie theft and full administrative account takeover. SSVC confirms a proof-of-concept exists; no active exploitation has been identified in CISA KEV at time of analysis.
Cross-site scripting in Apache Syncope's Console and Enduser login pages allows unsanitized HTML and JavaScript to be rendered via a maliciously crafted notification message link. Versions 4.0.4 through 4.0.7 and 4.1.0-M0 through 4.1.2 are affected. An attacker who can deliver a crafted HTTP link to a Syncope user can execute arbitrary JavaScript in that user's browser upon visiting the login page, enabling session hijacking, credential theft, or UI redress attacks.
Stored cross-site scripting in SourceCodester Inventory Management System 1.0 allows an authenticated remote attacker to inject malicious scripts via the Product_Name parameter handled by /api/products_handler.php in the Product Management Module. When other authenticated users subsequently view affected product listings, the injected payload executes in their browsers, enabling session hijacking, credential theft, or UI redressing. A public proof-of-concept exploit is available on GitHub, lowering the bar for exploitation by non-expert attackers.
Cross-site scripting in SourceCodester Inventory Management System 1.0 allows authenticated remote attackers to inject and execute arbitrary client-side scripts via the `/api/vendors_handler.php` Vendor Management endpoint. A public proof-of-concept exploit has been published on GitHub (gist by fhewm98), confirming the issue is reproducible. Exploitation requires low-privilege authentication and victim interaction, limiting blast radius, but successful attacks can hijack sessions, redirect users, or perform unauthorized actions on behalf of the victim.
Reflected or stored cross-site scripting in SourceCodester Inventory Management System 1.0 allows an authenticated remote attacker to inject malicious JavaScript via the Customer_Name parameter in the Customer Management Module's /api/customers_handler.php endpoint. When a second user (such as an administrator) loads the affected customer record, the payload executes in their browser, enabling session hijacking or unauthorized actions on their behalf. A public proof-of-concept exploit is available on GitHub; no active exploitation (KEV) has been confirmed.
Cross-site scripting in the Image Management component of Contec SolarView Compact (models sv-cpt-mc310 and sv-cpt-mc310f) enables authenticated attackers to inject malicious script that can trigger arbitrary OS command execution on the underlying device. Reported by JPCERT/CC (JVNVU97753461) with a Contec vendor advisory, the vulnerability chains CWE-79 XSS with a command injection pathway, making it more dangerous than its CVSS 4.0 score of 5.1 suggests. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 before CP 1644 has XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 53.3%.
A persistent XSS vulnerability exists in the User-Agent header of the login process of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to steal session IDs of logged in users when the. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 68.2%.
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DIR-645 Router (Rev. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 92.2%.
Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 63.9%.
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 allow remote attackers to inject arbitrary web script or. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 allows. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 76.5%.
Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 16.3%.
The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back in the page, allowing unauthenticated attackers to run arbitrary web scripts in a visitor's browser if they can trick the visitor into following a crafted link (reflected XSS).
The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of several directly accessible scripts, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone they can induce to submit a crafted request.
Stored cross-site scripting in the Photo Gallery by 10Web - Mobile-Friendly Image Gallery WordPress plugin (all versions up to and including 1.8.44) lets an authenticated attacker holding Author-level capabilities or higher inject arbitrary JavaScript through the plugin's shortcode attributes, which is then persisted and executed in the browser of any user who subsequently loads the injected page. The practical impact is limited - the payload only fires when a victim, ideally a higher-privileged administrator or editor, views the poisoned content, and the attacker must already hold a legitimate Author account - and no public exploit code has been identified at time of analysis, with no CISA KEV entry indicating active exploitation. The issue is rated moderate (CVSS 6.4) rather than critical, reflecting the authenticated prerequisite and the requirement that a victim visit the affected page.
Stored cross-site scripting in Craft CMS (5.7.0 through 5.10.12) allows an authenticated content editor to plant malicious JavaScript that executes in the Control Panel session of a higher-privileged user who views the affected element index. The flaw lives in the Generated Fields feature, which disables Twig autoescaping and caches field values without encoding, so injected markup is served raw; exploitation requires an editor-level account (PR:L), the optional Generated Fields feature to be in use, and the victim to open the index (UI:P), and the resulting impact is confined to the victim's browser session with no server-side confidentiality, integrity, or availability loss. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the practical risk is moderate rather than critical because of the account, feature, and interaction prerequisites.
Stored cross-site scripting in AVideo through 29.0 (revision e01e41ecc) allows unauthenticated remote attackers to inject arbitrary HTML/JavaScript into the videos_statistics table via the view-counter endpoint, which is then executed in the session of a video owner or administrator who visits the statistics page. The vulnerability arises because unrecognized User-Agent strings are stored verbatim in the app column without invoking the sanitizing setter, and the DataTables 1.12.1 renderer on view/videoViewsInfo.php uses innerHTML. No vendor patch is available, no public exploit code was identified at time of analysis, and exploitation is limited by the need for a privileged user to view the stats page and a 45-character payload truncation.
Stored and reflected cross-site scripting in djust (pip package djust) before 1.0.7 allows a javascript: URL supplied through user-controllable data to survive into the href/action attributes of built-in component template tags, executing script in a victim's authenticated browser session when the link is clicked. Only applications that bind untrusted URLs to components such as breadcrumb, dj_nav link/dropdown/brand, citation URL, cookie-consent privacy link, error-page action or form action are affected; default djust output is not exposed. The issue is developer-usage-conditional, the assessed vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N (user interaction required, low-privileged/authenticated injecting party), no public exploit identified at time of analysis, and the vendor fix is available in djust 1.0.7.
HTML markup injection in changedetection.io through 0.60.6 allows an attacker who controls the <title> of a page being monitored to inject arbitrary markup into the notification messages that changedetection.io generates. When a user's notification template uses the watch_title token and HTML-format notifications are enabled for a channel such as email or Telegram, that markup is delivered as live content rather than escaped text, enabling content spoofing and phishing inside notifications. Exploitation is unauthenticated (PR:N per the assessed vector) but heavily gated by preconditions - the victim must monitor an attacker-influenced page, use the watch_title token, enable HTML notifications, and actually view the rendered notification - and publicly available exploit code exists, though there is no confirmed active exploitation (CISA KEV).
Reflected cross-site scripting in the web-based management interface of Cisco Identity Services Engine (ISE) lets a remote, unauthenticated attacker execute arbitrary script code in the browser session of an ISE interface user who is persuaded to click a crafted link (CVSS 3.1 base 6.1, CWE-79). Successful exploitation is confined to the victim's browser context - the attacker can read browser-based information or act as the interface user, but there is no server-side code execution and no availability impact (C:L/I:L/A:N). Exploitation requires user interaction (UI:R) against a legitimate interface user, so exposure drops sharply if the admin interface is not reachable from untrusted networks; at time of analysis there is no CISA KEV entry and no public exploit code identified, although the affected version list is broad, covering ISE 3.1.0 through 3.5 releases.
Stored cross-site scripting in ChangeWeDer CRM allows an authenticated low-privilege user to plant JavaScript in the customerName argument submitted through the customer record Save Endpoint (src/main/resources/public/js/customerServe/customer.serve.js), which then executes in the browser of a CRM operator who later opens the same customer record. The project follows a rolling-release model, so no affected or fixed version numbers are published, and the maintainers were notified through an upstream GitHub issue but have not responded. Publicly available exploit code exists; there is no CISA KEV listing, and EPSS data is not available. The assessed CVSS:3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, matching a low-to-moderate severity finding rather than a top-priority emergency.
Stored cross-site scripting in Adobe Experience Manager lets a low-privileged authenticated attacker (CVSS vector PR:L) persist malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who later views the affected page (UI:R), driving the score to 5.4 with a changed scope (S:C) because the impact lands on the victim's session rather than the vulnerable component itself. The affected line-up is AEM as a Cloud Service, AEM 6.5 LTS, and AEM 6.5, and exploitation is not self-contained: the attacker needs an account able to write into the form field and must wait for a separate, ideally higher-privileged, victim to browse that page. No public exploit code and no confirmed active exploitation were identified at time of analysis, and this is assessed as a genuinely moderate, not high-priority, issue.
Concrete CMS 9.2.0 through 9.5.3 fails to enforce an authorization check on its REST API user-creation endpoint (POST /ccm/api/1.0/users), so any request bearing a valid OAuth token that carries the users:add scope - including a client_credentials token with no associated user context - can create active, validated accounts while bypassing email verification and administrator approval. The endpoint's add() method in concrete/src/Api/Controller/Users.php performs no permission verification, making this a classic missing-authorization weakness (CWE-862) that an authenticated API consumer can abuse to gain a foothold. Under default registration settings the newly minted accounts are allowed to edit page content, which provides an escalation path to stored cross-site scripting and further compromise of the CMS. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the reporter-independent assessment rates the impact as limited to low integrity loss on the CMS itself.
Cross-site scripting (XSS) in the Category Update function (/admin/update_category.php) of SourceCodester Online Food Ordering System 1.0 allows an authenticated administrator to inject script payloads that execute in the browser when the manipulated category page is rendered, requiring user interaction. Publicly available exploit code exists, but the high-privilege prerequisite (admin access) and limited integrity-only impact make this a low-severity admin self-XSS scenario; no active exploitation (CISA KEV) is indicated.
Cross-site scripting in PbootCMS versions 3.2.0 through 3.2.22 lets an authenticated backend user supply a malicious value in the content Title argument, which the decode_string function in apps/admin/controller/content/ContentController.php fails to neutralize before the Template Rendering component outputs it; the injected script then executes in the browser of any user who loads the rendered page. Publicly available exploit code exists, but exploitation is constrained by two prerequisites - a valid backend account and victim interaction with the tainted page - and the assessed impact is limited to manipulation of page content in the viewer's browser, with no confidentiality or availability impact. This is a low-priority issue despite being remotely reachable.
Cross-site scripting in udecode Plate's core HTML deserialization APIs allows attacker-controlled script to execute in a consuming application's origin when untrusted or cross-user HTML is deserialized and then loaded by another user; affected builds are all versions prior to 53.3.11 plus the discontinued 54.0.0-beta.0 and 54.0.0-beta.1 prereleases. The pre-fix code parsed supplied HTML strings in the active document, so certain attributes triggered browser behavior before the markup was converted into editor nodes; the assessed vector (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) reflects network-delivered input needing no authentication (PR:N) but requiring victim interaction (UI:R) and a scope change, and exploitation is only realistic where the consuming application itself wires attacker-influenced HTML into these APIs. There is no public exploit identified at time of analysis and no KEV listing, but the vendor has shipped a fix in 53.3.11.
Stored cross-site scripting (XSS) in the Jenkins Gitee Plugin (versions up to and including 1301.v8957053c7902) allows an authenticated attacker who can trigger builds via the plugin's push webhook and control the sender name field to inject malicious JavaScript into build causes, which executes when a Jenkins user views the affected build's causes page. The vulnerability requires the plugin's webhook endpoint to be reachable and a user to subsequently view the build page (UI:R). No public exploit code has been identified at time of analysis, and the vendor's CVSS score of 6.8 uses a boilerplate vector; independent assessment rates it as CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Stored cross-site scripting in the Modbus transaction management interface of Advantech EKI-1242EIMS and EKI-1242IEIMS industrial gateways (firmware V1.06.01) lets an attacker who already holds high-privileged authenticated access to the gateway web UI persist malicious script that later executes in the browser of any administrator who opens the affected management page. Because the payload is stored and served from the device itself, the more serious consequences land in the victim administrator's browser session (scope change to High per the CVSS:4.0 vector, and C:H/I:H/S:H in the 3.1 assessment) while impact on the gateway itself is limited to Low confidentiality and integrity, with no availability impact. Exploitation requires two compounding preconditions - pre-existing admin credentials (PR:H) and a victim administrator's subsequent page view (UI:P) - so there is no unauthenticated or zero-interaction path; no public exploit code or confirmed active exploitation was identified at time of analysis.
A stored/cross-context cross-site scripting flaw (CWE-79) in GitLab CE/EE's Content Editor allows an unauthenticated attacker to run arbitrary JavaScript in a targeted user's session, because pasted HTML is not sanitized properly. All GitLab Community and Enterprise Edition versions from 19.0 up to (but not including) 19.1.8, 19.2.6, and 19.3.2 are affected. Publicly available exploit information exists via a HackerOne report, but the issue is not listed in CISA KEV and its low EPSS-relevant profile (CVSS 4.7, AC:H, UI:R) places it in the moderate rather than emergency tier.
The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting.
The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the browser of a high privileged user, such as an administrator, viewing that screen.
Reflected cross-site scripting in the Better Messages WordPress plugin (Chat Rooms, Group Chat, Private Messages & AI Chat Bots) affects all versions up to and including 2.15.22, where the 'icn' parameter is neither sanitized on input nor escaped on output. An attacker who can craft a link with a malicious 'icn' value and persuade a logged-in or anonymous visitor to click it can execute arbitrary JavaScript in that victim's browser context on the affected site. No public exploit code or active exploitation has been reported, but the flaw is trivially automatable and the fix is already published in the 2.15.23 tag.
Stored cross-site scripting in the Bold Page Builder plugin for WordPress, affecting all versions up to and including 5.9.6, lets authenticated users with Contributor-level access plant persistent JavaScript that executes in the browser of anyone who views the injected page. The plugin's bt_bb_save_pre filter is bypassable via null-byte injection, and the bt_bb_raw_content shortcode handler outputs base64-decoded content without adequate sanitization, so payloads survive the intended checks. No public exploit code or CISA KEV entry was identified at time of analysis; the supplied Trac changeset indicates an upstream fix has been committed, but no patched release version is confirmed in the available data.
Stored cross-site scripting in the Advanced Popups WordPress plugin (all versions up to and including 1.2.3) lets an authenticated attacker holding author-level rights or above inject arbitrary JavaScript through the popup 'Notification Button Link' field, which is then rendered unsanitized to every visitor of the affected page. Because the payload is persisted in the site's database, any visitor — including administrators — who opens the injected page will execute the script in their own browser session. No public exploit code and no CISA KEV entry were reported at the time of analysis, and the maintainers shipped a fix in version 1.2.4.
Cross-site scripting in the a2a-chat-canvas markdown rendering component of a2ui (a2ui-project) up to version 0.10.7 allows a low-privileged authenticated user to plant script that executes in another user's browser when the chat canvas renders the crafted content. The defect lives in samples/community/client/angular/projects/a2a-chat-canvas/src/lib/services/sanitizer-markdown-renderer-service.ts, where markdown is converted to HTML without fully neutralizing dangerous markup, yielding an integrity/behavior impact (VI:L) rather than data disclosure (VC:N). There is confirmed CISA KEV status: no active exploitation has been reported, no public exploit code exists, and tracking is currently handled through a public GitHub issue rather than a formal vendor security bulletin.
kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. The OnlinePreviewController passes the user-controlled page and kkagent request parameters to FreeMarker templates without sanitization, and the templates insert these values into raw JavaScript contexts.
Netcore NR255-V firmware 1.5.130703 stores attacker-supplied script in L7 content management fields - specifically the call board text and policy group handling components - and later renders that content through eval() sinks, so the payload executes in the browser of any user who views the affected page. Exploitation requires an authenticated management session (CVSS PR:L) plus a victim who opens the poisoned page (UI:P), which keeps the practical severity moderate (CVSS 5.1, low confidentiality and integrity impact). There is no public exploit identified at time of analysis and no CISA KEV listing; the issue is documented through a VulnCheck advisory and a GitHub proof-of-concept-style technical write-up rather than a vendor security bulletin.
Stored cross-site scripting in Netcore NR255-V firmware 1.5.130703 allows an attacker positioned on the same LAN to inject script through DHCP client hostname fields and ARP bind entries; the router persists the payload and network_config.js and network_security.js render it unescaped in the web management interface. When an administrator opens the DHCP dynamic IP list or ARP bind list page, the injected script runs in their authenticated session, potentially exposing session tokens or enabling management actions as the admin. The issue is rated CVSS 5.1 (AV:A, PR:N, UI:P) and no public exploit was identified at time of analysis.
Stored cross-site scripting in the Netcore NR255-V router (firmware 1.5.130703) lets a user with access to the web management interface persist malicious JavaScript into DHCP static IP reservations and IP ACL entries via the dhcp_add_staticip_cgi, dhcp_staticip_show_cgi, ip_acl_set_cgi and ip_acl_show_cgi handlers. The injected script is stored on the device and executes in the browser of any other user — typically a higher-privileged administrator — who opens the affected DHCP or ACL pages, enabling session theft or unauthorised configuration changes performed as that victim. The issue carries only a moderate CVSS 4.0 base score of 5.1 (AV:N/AC:L/AT:N/PR:L/UI:P), no CISA KEV listing and no confirmed public exploit code, so it is a real but comparatively narrow risk concentrated on this specific legacy SOHO router model.
Stored cross-site scripting in the web management interface of the Netcore NR255-V router (firmware 1.5.130703) allows an attacker who already holds a valid management session to plant persistent JavaScript on routing and NAT configuration pages; the payload then executes in the browser of any user who later opens those pages, including higher-privileged administrators. The flaw sits in four CGI handlers (routing_tab_add_cgi, routing_table_list_show_cgi, route_policy_add_cgi, route_policy_parame_show_cgi) that fail to sanitise or encode route/NAT parameters before rendering them. CVSS 4.0 is a moderate 5.1 (AV:N/AC:L/AT:N/PR:L/UI:P), reflecting the need for an authenticated foothold plus a victim viewing the page; at time of analysis there is no CISA KEV listing and no public exploit code identified.
Stored cross-site scripting in the Netcore NR255-V router (firmware 1.5.130703) lets an authenticated administrator persist malicious JavaScript inside a QoS rule name, which the qos_xianz_add_cgi, qos_xianz_show_cgi, qos_filter_add_cgi and qos_filter_show_cgi handlers later pass to eval() without sanitisation. The injected script runs in the browser of any administrator who subsequently opens the affected QoS pages, allowing session theft, credential capture, or silent reconfiguration of the device through the victim's authenticated session. No public exploit code or active exploitation has been confirmed from the available intelligence.
Stored cross-site scripting in Netcore NR255-V firmware 1.5.130703 lets an authenticated administrator plant malicious JavaScript through the router's DDNS configuration, which then executes persistently every time the DDNS WAN list page (ddns_wan_list_show.cgi) is opened. The flaw stems from unsafe eval() handling of DDNS-supplied data in that CGI endpoint, so the injected payload is saved with the device configuration and survives page reloads and reboots. Confidentiality and integrity impact are rated low and no public exploit code has been identified at time of analysis, though the VulnCheck advisory and a public reference write-up are available.
Reflected cross-site scripting in QloApps up to and including 1.7.0 lets an attacker inject JavaScript into the back-office Hotel Reservation System feature-management page by supplying a crafted child_features parameter that is echoed back unescaped inside a validation error message. Only authenticated back-office users are targeted, and they must follow an attacker-supplied link before the payload fires in their administrative session, which is why the CVSS 4.0 base score is a moderate 5.1 rather than critical. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but an upstream fix exists in commit 54a3b30 / PR #1796.
Stored cross-site scripting in Concrete CMS 9.5.2 and earlier allows an authenticated user with file-upload rights to embed a javascript: URI in an SVG's xlink:href attribute that survives storage and executes in the browser of any user who opens the uploaded file directly. The flaw only manifests when the non-default 'Reject files containing potentially harmful elements' mode is selected (concrete.file_manager.images.svg_sanitization.action = reject), because in that mode the CMS discarded the output of the enshrined/svg-sanitize pass and relied solely on a narrow built-in blocklist covering <script> and on* handlers. No public exploit code or CISA KEV listing was identified, and the vendor-assigned CVSS v4.0 base score is a low 1.8, reflecting the need for upload privileges, a non-default configuration, and victim interaction.
Concrete CMS versions 9.4.0 through 9.5.2 fail to escape page paths before rendering them inside the location panel's duplicate-path confirmation dialog: the panel's check endpoint reflects the submitted path unmodified in its JSON response, and client-side JavaScript injects that value as raw HTML, so a crafted path executes script in an authenticated editor's browser session. An attacker must already hold page-authoring privileges and must engineer a path collision so the confirmation dialog appears, and the victim must then open that panel; no public exploit code or CISA KEV entry is associated with this CVE at time of analysis.
Let me synthesize. CVE-2026-18426: Concrete CMS 9.0.0 through 9.5.2, missing block-level edit permission check on Express Form block control-management actions, relying solely on CSRF token validation. Token bound to user and action, not block/page/form. So authenticated user with edit access to one Express Form could reuse token to add/modify/delete controls on forms they aren't authorized to edit, including injecting control whose value later rendered as HTML → stored XSS. CVSS 4.0 2.0, AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N. CWE-862 missing authorization. Tags: XSS, Authentication Bypass, CSRF. Hmm — "Authentication Bypass" tag is arguably mislabeled since it's a missing authorization check (CWE-862), not authentication bypass. Actually that's a good candidate for data_quality_flags mislabeled_tag. The tag "Authentication Bypass" is wrong — this is an authorization flaw (CWE-862), not authentication bypass. Confidence: medium/high. I'd say medium-high. Let's use "high" given CWE-862 is explicitly missing authorization and PR:H required (authenticated user). Actually the tag list includes both XSS and CSRF — both apply somewhat (stored XSS outcome, CSRF token bypass). "Authentication Bypass" is the questionable one. I'll flag it with confidence "medium" or "high". I'll use "high" — the description explicitly says "did not enforce a block-level edit-permission check", which is authorization, and CVSS PR:H means authenticated. So "Authentication Bypass" is mislabeled. Suggest "Missing Authorization" — hmm, suggested field is "the correct/canonical slug if you know it". Perhaps suggested: "missing-authorization" or "authorization-bypass". I'll say "authorization-bypass". Missing tags? Maybe "concrete-cms" / "concrete5" vendor tag absent. Tags list: XSS, Authentication Bypass, CSRF. Missing tag candidates: "Concrete CMS" (vendor/product) — suggested "concrete-cms", high confidence from description. Also "CWE-862" / "Missing Authorization" technique tag. I'll add "
Reflected cross-site scripting in Concrete CMS versions 5.0.0 through 9.5.2 lets an attacker run arbitrary JavaScript in a victim's browser by abusing the conversation messages feature's handling of a user-supplied custom date format. Because the conversation view endpoint carries no CSRF token, the payload can be delivered through an auto-submitting cross-origin POST from an attacker-controlled page, and the independently assessed vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) treats the attack as unauthenticated, requiring only that the victim load a malicious page. Impact is limited to the victim's browser session - reflected rather than stored XSS, with partial confidentiality and integrity loss and no availability impact - and the vendor's own CVSS v4.0 score of 2.1 (AT:P/PR:L/UI:P) reflects that exploitability depends on attacker-provided content and victim interaction; no public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fully remediated in 9.5.3.
Authenticated administrators of the HPE (Aruba) EdgeConnect SD-WAN Orchestrator web management interface can be tricked into running attacker-supplied script in their own browser session, exposing data handled by the management plane. The flaw is a cross-site scripting (CWE-79) issue rated CVSS 5.5 with a scope change (S:C), meaning the injected code runs in the victim's browser context rather than inside the orchestrator process itself. There is no public exploit identified at time of analysis and the issue does not appear on CISA KEV, but exploitation requires an already-authenticated account, so the practical risk depends heavily on how many privileged accounts exist and how well the UI is network-restricted.
Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance <= V6.0104 allows a remote attacker to execute arbitrary code via the size parameter in ptzpreset.pml component and the showmovies.pml component
Stored cross-site scripting in Concrete CMS 5.0.0 through 9.5.2 lets an unauthenticated attacker inject raw HTML through a publicly accessible Express Form; the payload is rendered unsanitized as an Express entry label whenever associated entries are displayed, executing in an administrator's dashboard session and in the browsers of visitors to pages containing an Express Entry List block with association columns. The Concrete CMS security team rates this CVSS v4.0 2.3 (AV:N/AC:L/AT:P/PR:N/UI:P), reflecting that exploitation depends on specific Express configuration and passive victim interaction rather than open, unconditional exposure. No public exploit code or CISA KEV listing was identified at time of analysis, and fixed code is available in Concrete CMS 9.5.3.
Stored cross-site scripting in IBM Cloud Pak for Business Automation allows an authenticated user to plant JavaScript inside Web UI content that is later rendered to other users. When a victim loads the affected page, the injected script runs inside the application's trusted origin, enabling session-token or credential theft and UI manipulation (CVSS 3.1 6.4, CWE-79). IBM has published a fix; no public exploit code and no CISA KEV listing were identified at time of analysis.
Stored cross-site scripting in IBM Cloud Pak for Business Automation allows an authenticated user to persist arbitrary JavaScript inside Web UI content, which then executes in the browser of any other user who views the affected page. Successful exploitation can disclose session credentials or other sensitive data belonging to the victim's trusted session, and can alter the intended behavior of the Web UI for that user. IBM has published an advisory and states that a fix is available from the vendor; no public exploit code or CISA KEV listing was identified at time of analysis.
IBM Cloud Pak for Business Automation is affected by HTML injection (CWE-80) in one or more web UI components, allowing an attacker who already holds low-privileged authenticated access to inject markup that executes in a victim's browser within the hosting site's security context. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting a network-reachable, low-complexity flaw that still requires authentication and victim interaction, with scope change because the injected script runs against the site's origin. No EPSS score, CISA KEV entry, or public exploit code was provided in the intelligence feed, so active exploitation is unconfirmed; IBM has published a fix advisory.
Stored/reflected cross-site scripting in code-projects Record Management System 1.0 allows an attacker to inject JavaScript through the 'desc' parameter processed by main/reg.php, which then executes in the browser of any user viewing the affected page. The flaw is remotely reachable without authentication, though it does require a victim to interact with the poisoned page or field. Publicly available exploit code exists (a GitHub write-up demonstrating the payload), but the issue is not listed in CISA KEV and no EPSS signal was supplied, so exploitation in the wild has not been confirmed. The CVSS 4.0 base score of 5.3 is moderate; the practical impact is limited to session theft, credential phishing, or defacement within the deployed instance rather than server compromise.
A reflected cross-site scripting (XSS) flaw in the Italian government school WordPress theme "Design Scuole Italia" lets an unauthenticated attacker run arbitrary JavaScript in a victim's browser by luring them to a crafted URL whose archive parameter is echoed unsanitized by filters-scheda-didattica.php. All versions from 1.0 through 2.18.2 are reported affected by ENISA/EUVD. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but any site running the theme is exposed to session theft, credential phishing and drive-by redirects against visitors and logged-in administrators alike.
A DOM-based cross-site scripting flaw in the Crawl4AI Playground UI (versions before 0.9.3) lets attacker-controlled crawled content — for example a malicious page title — be re-parsed as HTML inside the forceHighlightElement() routine, which writes textContent back into innerHTML. Because the Playground stores the operator's API token in sessionStorage, a successful payload can read that token and hand an attacker full control of the underlying Crawl4AI server. Exploitation requires the operator to load attacker-controlled page content in the Playground and trigger the highlight action; no public exploit code or CISA KEV entry is confirmed in the supplied intelligence, and the vendor has released a fix in 0.9.3.
Let me synthesize. CVE-2026-91942: crawl4ai before 0.9.3, DOM-based XSS in Docker Playground UI, innerHTML assignment of untrusted crawl results. Malicious PDFs with event-handler markup execute JS in Playground origin, steal API tokens from sessionStorage. CVSS 4.0 vector given: AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N — score 5.1. UI:A means user interaction active (user must open the PDF in the playground). Subsequent system impacts limited (SC:L/SI:L). PR:N unauthenticated. Wait — description says "steal API tokens from sessionStorage for authenticated API abuse" — the attacker themselves may be unauthenticated but the victim is an authenticated user. PR:N with UI:A. Let me construct fields. product_name: "Crawl4AI" (2 words? one token). Fine. prevalence: crawl4ai is a popular open-source LLM-friendly web crawler — medium? It's fairly widely used in AI/RAG pipelines. It's a Python library with ~40k GitHub stars. Deployment footprint: medium. Docker Playground UI is a specific deployment mode though — that reduces. I'd say "medium" with basis "popular open-source LLM crawler; Playground UI subset narrower". Hmm, but the specific vulnerable component (Docker Playground UI) is niche. But prevalence is about the product. crawl4ai is popular open-source library. Medium seems fair. assessed_cvss_vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N — scope changed because it impacts the Playground origin / API tokens (sessionStorage tokens, the script executes in the Playground origin). Actually the CVSS 4.0 vector shows SC:L/SI:L which implies subsequent system impacts → in 3.1 that maps to S:C with C:L/I:L. Hmm, but is scope change right? The vulnerable component is the Playground UI; the impacted component is... the API tokens / authenticated API. The XSS executes in the Playground origin — same origin. Stealing sessionStorage tokens then abusing the API — the API is arguably a different security authority. Given the CVSS 4.0 has subsequent-sys
Stored cross-site scripting in the Bridge creative multipurpose WordPress theme affects every version through 30.8.9.1, allowing authenticated users with contributor-level access or higher to inject arbitrary JavaScript into pages by abusing the 'circle_line' shortcode attribute, which is stored unsanitized and rendered unescaped. The injected script executes in the browser of any user — including administrators previewing a submitted post — who views the affected page. No public exploit code is identified and the flaw is not listed in CISA KEV, but the low privilege bar (a contributor account) and the scope-changing CVSS vector (S:C) make it a realistic privilege-escalation vector on multi-author sites.
Reflected cross-site scripting in Steedos Platform (all versions through 3.0.15-beta.47) lets an attacker inject JavaScript into the anonymous /api/page/render endpoint by abusing the schemaApi or data query parameters, which are written unescaped into inline script elements. Because the endpoint requires no authentication, a crafted link is enough: when a logged-in Steedos user opens it, the attacker's script runs in the victim's browser context and can read and exfiltrate the X-Auth-Token session credential, enabling full account takeover of that session. No public exploit code or active exploitation has been observed at time of analysis, though the vulnerable source files and route are publicly linked in the advisory references.
Stored Cross-Site Scripting in the Job Postings WordPress plugin (versions ≤ 2.8.1) allows authenticated attackers with contributor-level access to inject persistent JavaScript payloads via the 'position_button' parameter, which subsequently execute in the browsers of any user who views the affected page. The vulnerability stems from insufficient sanitization of input and missing output escaping in class-job-add-edit.php, enabling session hijacking, credential theft, or malicious redirects against visiting users including administrators. No public exploit has been identified at time of analysis and no KEV listing is present, making this a medium-priority finding gated entirely on attacker access to a contributor account.
Stored Cross-Site Scripting in the Eventin WordPress plugin (all versions up to and including 4.1.23) allows contributor-level authenticated attackers to inject persistent arbitrary JavaScript via the `etn_shedule_objective` field within the schedule_slot REST API parameter. The injected payload executes in the browsers of any user who subsequently views an affected event schedule page, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stored XSS in bizwell xClick groupware allows authenticated low-privileged users to inject malicious scripts that execute in the browsers of other users who view the affected content. The flaw stems from improper input validation (CWE-20) across xClick releases R2, R3, and R3.1. No public exploit code or active exploitation has been identified at time of analysis, and real-world impact is limited by the product's regional deployment footprint.
Cross-site scripting (CWE-79) in PHPGurukul Hostel Management System 3.0 lets an attacker inject script through the admin-side /admin/manage-students.php page, which is then rendered without adequate output encoding. Publicly available exploit code exists, so a working payload is already circulating against a target set that is mostly small institutional or academic deployments. The CVSS 4.0 score of 1.9 is low because the vector requires high privileges (PR:H) and user interaction (UI:P), with only a limited integrity impact and no confidentiality or availability loss recorded.
Cross-site scripting in Governikus AusweisApp through version 2.5.4 lets a remote attacker plant script through the ResultMessage argument handled by the StartPAOSResponse component, so that attacker-influenced content is rendered instead of plain result text. The flaw is network-reachable with no privileges required, but the user must be engaged in an eID flow before the malicious response is processed. No public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and the vendor has released version 2.5.5 as the fix.
Stored XSS in the PublishPress Authors WordPress plugin (all versions through 4.15.0) allows authenticated users holding Author-level access or above to inject persistent malicious scripts via the `profile_fields_user_email_value_prefix` parameter in author box configuration. The injected payload executes in the browser of any site user who clicks the affected author box link, enabling session hijacking, credential theft, or admin account takeover through the browser context of higher-privileged victims. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Stored Cross-Site Scripting in the ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress (versions up to and including 4.9.5) allows authenticated attackers with Author-level access or higher to persistently inject arbitrary JavaScript via the `shopengine_product_title_header_size` parameter. The injected payload executes in any site visitor's browser upon loading an affected page, enabling session hijacking, credential theft, or malicious redirects. No public exploit code has been identified at time of analysis, and it is not listed in the CISA KEV catalog.
Stored cross-site scripting in PHPGurukul Daily Expense Tracker System 1.1 allows an authenticated attacker to inject malicious JavaScript via the FullName parameter handled by /dets/includes/sidebar.php. Because sidebar content is rendered for other users viewing the application, the payload executes in victims' browsers, enabling session hijacking or credential theft against other authenticated users or administrators. A public proof-of-concept is available via GitHub, though no active exploitation has been confirmed in CISA KEV.
Cross-site scripting in the Trufflebox UI (trufflebox-ui) of BharatMLStack up to and including v1.3.0 allows injected script to run in a logged-in operator's browser when the affected GenericNumerixTable.jsx table view renders unsanitized data. Impact is confined to the victim's browser session - limited confidentiality and integrity (C:L/I:L) with no server-side code execution or availability impact (A:N) - and exploitation requires user interaction, meaning an operator must load the poisoned table view. Authentication requirements are not fully settled: the published vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, but the independent assessment rates it PR:L, since a stored/table-data injection path would first require authenticated write access to plant the payload. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and EPSS is 0.15% (4th percentile), indicating low real-world urgency.
Stored cross-site scripting in the file upload feature of 1024-lab SmartAdmin v3.30.0 lets an authenticated remote attacker persist malicious script that executes in the browser of any user who later views the uploaded file or its entry in the file listing. The vendor-assigned vector requires a low-privileged account (PR:L) plus victim interaction (UI:R) and rates the issue 6.5 (Medium), with no CISA KEV listing, no EPSS score, and no confirmed public exploit code in the supplied intelligence. Impact is limited to low confidentiality, integrity, and availability effects within the victim's browser session, but the scope change (S:C) means the injected script can act on resources beyond the vulnerable component.
BharatMLStack up to and including 1.3.0 is vulnerable to Cross Site Scripting (XSS) via the component Trufflebox UI (trufflebox-ui) in ExpressionViewModal.jsx.
Bacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in the client address field.
Bacularis 4.7.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in director tags.
Stored cross-site scripting in itranswarp's Markdown rendering pipeline allows authenticated users to inject arbitrary JavaScript into page content that executes in other visitors' browsers. The flaw exists in the `Markdown.toHtml()` method of `Markdown.java`, which fails to sanitize malicious HTML or script constructs embedded in Markdown input before writing rendered output to the page. All 2.x releases through 2.19 are affected, the project is officially end-of-life with no maintainer response to the vulnerability report, and exploit code has been publicly published.
Cross-site scripting in Takahe through 0.11.0 allows any remote ActivityPub actor to inject executable `javascript:` scheme URLs into federated post content or profile summaries. The sanitizer in `core/html.py` does not block this URL scheme when processing inbound federated HTML, so a crafted link persists in the instance's rendered content. When a local user clicks such a link, the JavaScript executes in the Takahe instance's origin, enabling session hijacking or account impersonation without requiring any privileges on the target server. No public exploit or active exploitation has been identified at time of analysis.
Authenticated HTML injection in IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 lets a logged-in user plant unescaped markup in the management interface, so the product renders attacker-controlled content as trusted UI. The result is UI spoofing and phishing: a crafted page can impersonate legitimate Sterling Secure Proxy screens to harvest credentials or trick operators into unsafe actions, with limited confidentiality and integrity impact (CVSS 5.4). No public exploit code has been identified and the flaw is not listed in CISA KEV; the vendor has published a fix, though an exact fixed version is not named in the provided data.
Stored cross-site scripting in IBM Cognos Analytics 12.0.4 through 12.0.4 FP2 and 12.1.0 through 12.1.3 FP1 allows any authenticated non-privileged user to embed JavaScript in their own given name or surname profile fields. The payload is later rendered without encoding in the administrative user-account management panel, so the script executes in an administrator's browser session when that account's permissions are reviewed, potentially exposing the administrator's session cookies. The issue is rated CVSS 5.4 (medium) and a vendor patch is available; no public exploit code or CISA KEV entry was present in the provided intelligence, so active exploitation is not confirmed.
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting.
Cross-site scripting (CWE-79) in IBM Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and IBM Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001, including the corresponding container editions, allows a remote unauthenticated attacker to run script in the browser of a logged-in user who follows a crafted link, potentially hijacking an authenticated session or performing actions as that user. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), which reflects the need for victim interaction and the limited but scope-changing confidentiality and integrity impact typical of reflected XSS. There is no public exploit code identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and the EPSS probability is only 0.20% (10th percentile), so this is a patching-hygiene issue rather than an emergency response item.
HTTP request smuggling in IBM WebSphere Application Server 8.5 and 9.0 (including the Liberty variant) enables unauthenticated remote attackers to manipulate shared HTTP caches, circumvent web application firewall rules, and inject malicious scripts into responses served to other users. The root cause is improper parsing of the HTTP Transfer-Encoding request header (CWE-444), a class of vulnerability that exploits disagreement between a front-end proxy and the back-end application server over where one HTTP request ends and the next begins. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available.
HTTP request smuggling in IBM WebSphere Application Server 8.5, 9.0, and Liberty allows remote unauthenticated attackers to poison web caches, bypass web application firewall protections, and conduct cross-site scripting attacks by sending specially crafted Transfer-Encoding headers. The root cause is CWE-444, inconsistent interpretation of HTTP request boundaries between WebSphere and a frontend proxy component. No public exploit or confirmed active exploitation has been identified at time of analysis; a vendor patch is available from IBM.
Reflected cross-site scripting in IBM WebSphere Application Server 8.5 and 9.0 allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a specially crafted link to the vulnerable server. Successful exploitation can lead to session token theft, credential harvesting, or unauthorized actions performed under the victim's browser context. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.
Stored cross-site scripting in the share renderer of Trilium Notes v0.103.0 and earlier lets anyone with note-authoring privileges embed arbitrary JavaScript in a webView note via the unescaped #webViewSrc attribute, which then executes in the browser of every user who opens the shared note — including administrators. The flaw requires an authenticated author to create or modify the note and a victim to open the shared link (CVSS 5.4, PR:L/UI:R/S:C), so it is a privilege-escalation and session-hijack vector rather than an unauthenticated remote compromise. CISA SSVC rates exploitation as none and automatable as no, and no public exploit code or KEV listing is present in the supplied intelligence.
Insufficient HTML sanitization in the WSO2 API Manager Publisher Portal and Developer Portal lets untrusted input be rendered without encoding, so malicious JavaScript injected into API documentation executes in the browser of anyone who opens the affected document. Attackers need an authenticated portal account with permission to author or edit API documentation, then can act on behalf of any user viewing that documentation depending on that user's session privileges. No public exploit code or active exploitation has been identified, and the vendor has released patched update levels for all affected release trains.
Reflected cross-site scripting in itsourcecode Loan Management System 1.0 allows a remote, unauthenticated attacker to inject arbitrary script through the 'page' argument processed by navbar.php, because the value is echoed back into the HTML response without output encoding. Publicly available exploit code exists (a GitHub issue referenced from the CVE record), and the CVSS 4.0 base score is only 2.1 because exploitation requires the victim to interact and the demonstrated impact is limited to integrity (VI:L) with no confidentiality or availability loss and no scope change. It is not reported as actively exploited and no CISA KEV entry is present.
DOM-based cross-site scripting in TripleLift's video-bundle.js ad rendering script allows unauthenticated remote attackers to execute arbitrary JavaScript within a publisher's domain by sending crafted postMessage events without origin validation. The attack requires social engineering a victim into visiting an attacker-controlled page, which then fires malicious postMessage payloads at any publisher page running the TripleLift video ad script. Successful exploitation enables session hijacking and unauthorized DOM manipulation in the victim's browser context on the publisher domain. A publicly available proof-of-concept exists; no KEV listing at time of analysis.
Stored XSS in MISP ≤2.5.45 allows an authenticated user who can upload SVG files to plant malicious JavaScript that executes on the MISP origin when any other authenticated user navigates directly to the SVG URL (organisation logos or event-report pictures). Because the vulnerability lives in the serve path rather than the upload path, SVG payloads deposited while uploads were enabled remain exploitable even after SVG upload support is later disabled. No public exploit or CISA KEV listing identified; CVSS 4.0 scores this 5.1 and SSVC rates technical impact as partial with no known exploitation.
Stored cross-site scripting in LaraDashboard 0.9.0-1.2.2 allows any authenticated user holding only the `media.create` permission to upload SVG files containing embedded JavaScript. When any user - including administrators - opens the stored SVG served inline from the application origin, the script executes in the dashboard's browser context, enabling session cookie theft and full administrative account takeover. SSVC confirms a proof-of-concept exists; no active exploitation has been identified in CISA KEV at time of analysis.
Cross-site scripting in Apache Syncope's Console and Enduser login pages allows unsanitized HTML and JavaScript to be rendered via a maliciously crafted notification message link. Versions 4.0.4 through 4.0.7 and 4.1.0-M0 through 4.1.2 are affected. An attacker who can deliver a crafted HTTP link to a Syncope user can execute arbitrary JavaScript in that user's browser upon visiting the login page, enabling session hijacking, credential theft, or UI redress attacks.
Stored cross-site scripting in SourceCodester Inventory Management System 1.0 allows an authenticated remote attacker to inject malicious scripts via the Product_Name parameter handled by /api/products_handler.php in the Product Management Module. When other authenticated users subsequently view affected product listings, the injected payload executes in their browsers, enabling session hijacking, credential theft, or UI redressing. A public proof-of-concept exploit is available on GitHub, lowering the bar for exploitation by non-expert attackers.
Cross-site scripting in SourceCodester Inventory Management System 1.0 allows authenticated remote attackers to inject and execute arbitrary client-side scripts via the `/api/vendors_handler.php` Vendor Management endpoint. A public proof-of-concept exploit has been published on GitHub (gist by fhewm98), confirming the issue is reproducible. Exploitation requires low-privilege authentication and victim interaction, limiting blast radius, but successful attacks can hijack sessions, redirect users, or perform unauthorized actions on behalf of the victim.
Reflected or stored cross-site scripting in SourceCodester Inventory Management System 1.0 allows an authenticated remote attacker to inject malicious JavaScript via the Customer_Name parameter in the Customer Management Module's /api/customers_handler.php endpoint. When a second user (such as an administrator) loads the affected customer record, the payload executes in their browser, enabling session hijacking or unauthorized actions on their behalf. A public proof-of-concept exploit is available on GitHub; no active exploitation (KEV) has been confirmed.
Cross-site scripting in the Image Management component of Contec SolarView Compact (models sv-cpt-mc310 and sv-cpt-mc310f) enables authenticated attackers to inject malicious script that can trigger arbitrary OS command execution on the underlying device. Reported by JPCERT/CC (JVNVU97753461) with a Contec vendor advisory, the vulnerability chains CWE-79 XSS with a command injection pathway, making it more dangerous than its CVSS 4.0 score of 5.1 suggests. No public exploit code and no CISA KEV listing have been identified at time of analysis.