XSS
Monthly
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript in a victim's browser by luring them to a crafted URL or page that manipulates the client-side DOM. Affected deployments span AEM 6.5 on-premises (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0), covering a broad range of enterprise CMS installations. The scope-changed CVSS vector (S:C) signals that the script executes beyond the AEM application context - enabling session hijacking, credential theft, or action-on-behalf-of attacks targeting higher-privilege users. No public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to deliver a crafted URL that, when visited by an authenticated victim, executes arbitrary JavaScript within the victim's browser context with scope change across security boundaries. Affected deployments span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. Adobe has released APSB26-98 addressing this issue; no public exploit code or active exploitation has been identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to inject malicious JavaScript that executes entirely within a victim's browser, bypassing server-side defenses. Affected products span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. The scope-changed classification (S:C) indicates the injected script can operate beyond the AEM application boundary in the victim's browser context, enabling session hijacking or credential theft from a higher-privileged user. No confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject malicious JavaScript that executes within a victim's browser session by luring them to a crafted webpage. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, with scope changed - meaning injected scripts can affect resources beyond the immediate AEM origin. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor advisory APSB26-98 covers remediation.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged remote attacker to execute malicious JavaScript in a victim's browser by luring the victim to a crafted URL or page that manipulates the client-side DOM environment. Affected versions span the entire AEM 6.5 line through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. Adobe has addressed this through APSB26-98; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated low-privileged attackers to execute arbitrary JavaScript in victims' browsers by crafting pages that manipulate the DOM environment. Affected deployments include AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. The scope-changed CVSS vector signals that script execution can cross component or trust boundaries within the victim's browser session. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0 allows low-privileged authenticated attackers to execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment. Exploitation requires the victim to visit a crafted webpage, placing this in a social-engineering or insider-threat scenario rather than direct network exploitation. The scope change (S:C) in the CVSS vector confirms the JavaScript executes outside AEM's security boundary in the victim's browser context. No public exploit or CISA KEV listing is identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute arbitrary JavaScript within a victim's browser session by manipulating the DOM environment via a crafted webpage. Affected deployments span AEM as a Cloud Service through July 2026, AEM 6.5 through version 6.5.24, and AEM 6.5 LTS through SP2. No public exploit or active exploitation has been identified at time of analysis; the CVSS score of 5.4 reflects the authentication prerequisite and mandatory victim interaction, though the scope-changed rating indicates the injected script can affect resources outside the AEM application boundary.
DOM-based cross-site scripting in Adobe Experience Manager allows authenticated users to execute malicious JavaScript within their browser context by visiting a crafted webpage. The vulnerability affects AEM as a Cloud Service (up to version 2026.7.0) and on-premises versions (6.5 up to 6.5.24, 6.5 LTS through SP2). With scope changed, the attack can extend beyond the vulnerable component to affect other AEM systems or data. No public exploit code or active exploitation confirmed at time of analysis.
DOM-based cross-site scripting in Adobe Experience Manager 6.5 releases through version 6.5.24 and Cloud Service deployments through 2026.7.0 allows authenticated attackers to execute malicious JavaScript in victims' browsers by injecting attacker-controlled DOM manipulation code into shared content. Successful exploitation harvests session tokens, performs unauthorized actions as the victim, and accesses sensitive data within the victim's authorized scope. The attack requires both attacker authentication and victim user interaction with crafted pages; no active exploitation or public exploits identified at analysis time.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment. Affected deployments span AEM as a Cloud Service through 2026.7.0 and on-premises AEM 6.5 through 6.5.24 and LTS through SP2. Exploitation requires that a low-privileged attacker socially engineer a target user into visiting a specially crafted URL or page; vendor advisory APSB26-98 confirms the issue and provides patched releases. No public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and execute malicious JavaScript within a victim's browser session by manipulating client-side DOM data without server-side interaction. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. The scope-changed nature of the flaw means successful exploitation can affect browser resources beyond the AEM application boundary; no public exploit code or active exploitation has been identified at time of analysis.
Stored XSS in Adobe Experience Manager allows authenticated low-privileged attackers to inject malicious JavaScript into vulnerable form fields that later executes in victims' browsers when they visit the affected page. Affected deployments span AEM 6.5 (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0). Adobe has addressed this in security bulletin APSB26-98; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged, network-accessible attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in any victim's browser upon visiting the affected page. Scope change (S:C) confirms the attack crosses from the application server context into the victim's browser security context, enabling session hijacking, credential theft, or further phishing within the authenticated AEM environment. No public exploit or KEV listing is present at time of analysis; CVSS 5.4 (Medium) reflects the privilege and user-interaction barriers that limit opportunistic mass exploitation.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to persistently inject malicious JavaScript into vulnerable form fields within the CMS. When any victim - including administrators - browses to the page containing the injected payload, the script executes in their browser session under the AEM application's trust boundary, with scope changing to the victim's context. Affected versions span AEM 6.5 ≤6.5.24, AEM as a Cloud Service ≤2026.7.0, and AEM 6.5 LTS ≤SP2, with remediation available via Adobe advisory APSB26-98. No public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript within a victim's browser by inducing them to visit a crafted URL. Affected deployments span AEM as a Cloud Service (≤2026.7.0), AEM 6.5 LTS (≤SP2), and AEM 6.5 on-premises (≤6.5.24), as confirmed by EUVD-2026-74147 and Adobe APSB26-98. The scope-change rating reflects that injected script runs in the victim's browser security context, enabling session theft, credential harvesting, or UI redress attacks against higher-privileged users. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows an authenticated low-privileged attacker to inject and execute arbitrary JavaScript within victim browsers by crafting a malicious URL that manipulates the client-side DOM environment. Affected products span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. The scope-changed CVSS vector (S:C) indicates the injected script can reach resources beyond the AEM application's own security boundary. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment via a crafted webpage. Affected deployments span AEM 6.5 on-premises (≤6.5.24), AEM 6.5 LTS (≤SP2), and AEM as a Cloud Service (≤2026.7.0), as documented in Adobe APSB26-98. The CVSS S:C scope-change designation confirms the payload can escape the vulnerable component's security boundary, enabling session hijacking or cross-origin data exfiltration against privileged AEM users. No public exploit code or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager 6.5 (through 6.5.24), 6.5 LTS (through SP2), and Cloud Service (through 2026.7.0) enables an authenticated attacker to inject malicious JavaScript that executes in a victim's browser by manipulating client-side DOM state. The scope change (S:C) in the CVSS vector reflects that the injected script runs within the AEM domain's browser context, potentially reaching session tokens, saved credentials, or authoring capabilities beyond the attacker's original privilege level. Exploitation requires the attacker to hold a valid low-privilege AEM account and to socially engineer a victim into visiting a crafted URL; no public exploit code has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to execute arbitrary JavaScript in a victim's browser by luring them to a crafted URL that manipulates the DOM environment. Affected across AEM 6.5 (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0). The scope-changed CVSS vector confirms the script executes outside the originating security context, enabling session theft, credential harvesting, or actions-on-behalf-of-victim against the AEM interface. No public exploit code or CISA KEV listing identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by manipulating client-side DOM sinks via a crafted URL. Scope change (S:C) means the injected script executes outside AEM's own origin context, enabling session token theft or privilege escalation against higher-privileged AEM users. Affected versions span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, per Adobe advisory APSB26-98. No public exploit or active exploitation is identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager enables an authenticated low-privileged attacker to inject and execute malicious JavaScript in a victim's browser by tricking them into visiting a specially crafted URL. The vulnerability spans AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, covering a broad enterprise install base. The CVSS scope-change flag (S:C) is the most significant risk amplifier, indicating injected scripts can reach security contexts beyond the originating AEM application. No public exploit or CISA KEV listing exists at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker with low privileges to execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Because scope is changed (S:C per CVSS), the injected script can reach browser resources beyond the AEM origin, enabling session token theft or unauthorized actions performed as the victim. No public exploit code has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged remote attacker to execute malicious JavaScript in a victim's browser by manipulating the DOM environment of a crafted webpage. Affected versions span AEM 6.5 through 6.5.24, AEM as a Cloud Service through the 2026.7.0 release, and AEM 6.5 LTS through SP2. No public exploit or active exploitation has been identified at time of analysis; Adobe has issued advisory APSB26-98 with patch availability.
Stored Cross-Site Scripting in Adobe Experience Manager allows low-privileged authenticated attackers to inject persistent malicious JavaScript into vulnerable form fields, which then executes in the browsers of users who visit the affected pages. Affected deployments include AEM 6.5 through version 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the scope-changed CVSS vector indicates meaningful session and interface impact when exploited.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) allows an authenticated attacker to inject malicious JavaScript into a victim's browser by manipulating the DOM environment through a crafted webpage. The vulnerability affects AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, and carries a scope change meaning injected scripts execute beyond the attacker's origin context. No public exploit identified at time of analysis, and it is not listed in the CISA KEV catalog.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malicious JavaScript within a victim's browser by luring them to a crafted webpage. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and the Cloud Service through the 2026.7.0 release. Scope is changed per the CVSS vector, meaning the exploit crosses the boundary from the AEM application context into the broader browser environment; no public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows low-privilege authenticated attackers to execute arbitrary JavaScript in victims' browsers by delivering crafted URLs or pages that manipulate the client-side DOM environment. All supported AEM deployment modes are affected: on-premises 6.5.x through 6.5.24, 6.5 LTS through SP2, and Cloud Service through 2026.7.0. Adobe addressed this in security bulletin APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When a higher-privileged user (such as an administrator) browses the affected page, the script executes in their browser context, enabling session hijacking, credential theft, or UI redirection. The scope change (S:C in CVSS) signals that injected scripts can operate outside the application's own origin, amplifying the effective impact beyond the application boundary. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in HTML::FormHandler before 0.410000 (Perl/CPAN) allows unauthenticated network attackers to inject arbitrary JavaScript by submitting markup to any form field that triggers a validation error message embedding the submitted value. The library's rendering roles - Render::Simple, Render::Table, and Widget::Form::Simple - interpolate error strings directly into HTML error spans without entity encoding, so fields using check regexps, check lists, or type constraints expose the reflected XSS path. A stored XSS variant is also possible when applications persist and later re-render rejected form values. No public exploit is identified; vendor-released patch 0.410000 is available.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to execute arbitrary JavaScript in a victim's browser by luring them to a crafted webpage. The vulnerability spans Adobe Experience Manager as a Cloud Service (≤2026.7.0), AEM 6.5 LTS (≤SP2), and AEM 6.5 (≤6.5.24), per APSB26-98. No active exploitation or public exploit code has been identified at time of analysis, though the scope-changed nature means successful exploitation can cross security boundaries within the victim's browser context.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated, low-privileged attacker to inject and execute arbitrary JavaScript in the browser session of any victim who visits a crafted AEM page. Affected are AEM as a Cloud Service through 2026.7.0, AEM 6.5 LTS through SP2, and AEM 6.5 on-premise through 6.5.24. The scope-changed CVSS rating (S:C) reflects that the injected script executes in the victim's browser context and can reach resources-such as session tokens and authenticated API calls-beyond the originating AEM page, amplifying the practical impact relative to the medium base score.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to execute malicious JavaScript within a victim's browser by delivering a crafted URL or page that manipulates the client-side DOM. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. The scope change in the CVSS vector reflects that injected script executes beyond the originating component boundary, potentially enabling session theft or privilege escalation against higher-privileged AEM users. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) allows an authenticated attacker to execute arbitrary JavaScript within a victim's browser by enticing them to visit a crafted URL, affecting AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the July 2026 release. The CVSS scope change (S:C) signals that the injected script escapes AEM's own browser origin boundary, enabling session hijacking or unauthorized CMS operations under the victim's identity. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the broad enterprise footprint of AEM makes patching a priority.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When any user - including higher-privileged administrators - browses to the page containing the injected payload, the script executes in their browser context, crossing scope boundaries into the victim's session. Affected versions span AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2, as confirmed by APSB26-98. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which executes in any victim's browser that subsequently visits the affected page. The scope-changed nature of this flaw (S:C in CVSS) means the attacker's script runs within the victim's browser security context, enabling session token theft, credential harvesting, or further client-side attacks. Affected deployments span AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2; no public exploit code or KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields within the CMS. When any user-including administrators-browses to a page containing the injected content, the script executes in their browser under a changed security context (S:C), enabling session hijacking, credential theft, or unauthorized actions performed on behalf of the victim. Affected versions span AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2; no public exploit or active exploitation confirmed via CISA KEV at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields within the authoring environment. When any higher-privileged user subsequently browses the affected page, the script executes in their browser within a changed scope, potentially enabling session theft or unauthorized actions. Adobe has issued advisory APSB26-98 covering AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0; no public exploit or CISA KEV listing has been identified.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to persist malicious JavaScript payloads in vulnerable form fields, which then execute in any victim's browser upon page visit. Affected versions span AEM 6.5 (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0). Adobe has addressed the issue in security bulletin APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.
Stored XSS in Adobe Experience Manager permits low-privileged authenticated users to inject persistent JavaScript payloads into vulnerable form fields within the CMS authoring interface. When any user - including administrators - browses a page containing the injected field, their browser executes the attacker's script in the context of the AEM domain, with scope change confirming cross-boundary impact. All AEM 6.5 versions through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 build are affected; remediation is available via Adobe APSB26-98. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in the browsers of other users - including administrators - when they visit the affected page. Affected deployments span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. No public exploit or CISA KEV listing has been identified at time of analysis; the scope-changed CVSS vector reflects the cross-user browser impact.
Stored XSS in Adobe Experience Manager allows low-privileged authenticated attackers to inject malicious JavaScript into vulnerable form fields, where it persists server-side and executes in any victim's browser upon visiting the affected page. Three release tracks are affected: AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. The scope-changed impact means attacker-controlled scripts run in victim browser contexts - including those of administrators - enabling session hijacking, credential theft, or unauthorized actions on behalf of higher-privileged users. No public exploit or CISA KEV listing identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in any victim's browser when they navigate to the affected page. Affected deployments span AEM 6.5 through 6.5.24 and 6.5 LTS through SP2 (on-premises), as well as AEM as a Cloud Service through the July 2026 release (2026.7.0). Adobe has published advisory APSB26-98 confirming the scope-changed impact; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields that persists and executes in the browsers of other users who visit the affected page. Affected products span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. The scope-changed nature of the vulnerability means the attacker's payload crosses from the AEM application context into victim browser sessions, enabling session hijacking, credential theft, or unauthorized actions performed as the victim. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to manipulate client-side DOM processing and execute arbitrary JavaScript in a victim's browser session. Affected deployments span AEM 6.5 up to version 6.5.24, AEM 6.5 LTS up to SP2, and AEM as a Cloud Service up to release 2026.7.0. Exploitation requires convincing an authenticated victim to visit a specially crafted URL; scope is changed because the injected script runs in the victim's browser context outside the AEM application boundary. No public exploit code or CISA KEV listing has been identified at time of analysis; Adobe has issued patches under advisory APSB26-98.
Cross-site scripting in on-premises Skype for Business Server enables network-accessible spoofing attacks across three supported server generations. The CVSS 6.5 rating reflects limited confidentiality and integrity impact, consistent with content-injection or UI-spoofing outcomes rather than full session takeover. A vendor-released patch is available through the Microsoft Security Response Center; no public exploit has been identified at time of analysis.
Cross-site scripting in Microsoft Skype for Business Server enables network-based spoofing against authenticated users across three distinct server product lines. An unauthenticated remote attacker can inject malicious script into a vulnerable web component that executes in a victim's browser upon user interaction, resulting in high-confidentiality-impact session token theft or UI-level spoofing consistent with the CVSS C:H/I:N pairing. Vendor-released patches are confirmed available via MSRC; no public exploit code and no CISA KEV listing exist at time of analysis.
Cross-site scripting in AVEVA PIMBoards (Pipeline Integrity Monitor ≤ 2025 SP1 P1, build 7.1.9580.8513) enables unauthenticated remote attackers to execute arbitrary JavaScript in a targeted user's active browser session by tricking the user into clicking a crafted malicious link. The attack is classified CWE-79 (reflected XSS), requires active user interaction, and is reported by ICS-CERT - indicating relevance to operational technology and industrial pipeline environments. No public exploit code has been identified at time of analysis, and CISA SSVC rates current exploitation as none.
Cross-site scripting in Microsoft SharePoint Server Subscription Edition allows an authenticated network attacker with low-level privileges to inject malicious scripts into pages rendered by SharePoint, enabling spoofing attacks against other authenticated users. The flaw is classified CWE-79 and confirmed by Microsoft (secure@microsoft.com) with a vendor patch available targeting builds below 16.0.20326.20090. No public exploit code has been identified and the vulnerability does not appear in CISA KEV.
Cross-site scripting in Microsoft SharePoint Server Subscription Edition enables an authorized high-privilege attacker to inject malicious script into SharePoint pages, causing spoofing attacks against other users who view the injected content. The CVSS base score of 3.5 reflects the high authentication bar (PR:H) and mandatory victim interaction (UI:R), confining realistic exploitation to insider-threat scenarios or compromised privileged accounts rather than external unauthenticated attackers. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Cross-site scripting in Microsoft SharePoint Server Subscription Edition (builds prior to 16.0.20326.20090) allows an authenticated low-privileged attacker to inject malicious scripts into SharePoint pages, enabling spoofing attacks against users who view the compromised content. The CVSS vector (PR:L/UI:R/C:H/I:H) indicates victim interaction is required and that impact may extend to session token exposure or impersonation within the SharePoint context. No public exploit code has been confirmed and no active exploitation is listed in CISA KEV at time of analysis.
Cross-site scripting in Microsoft SharePoint Server Subscription Edition allows an authenticated network attacker to inject malicious script into page output, enabling spoofing attacks against other users. Successful exploitation requires the victim to interact with attacker-controlled content but can result in high confidentiality and integrity impact within the victim's SharePoint session context. Microsoft has released patch version 16.0.20326.20090 addressing this flaw, reported internally via secure@microsoft.com.
Cross-site scripting in aircheng-org iWebShop-5 through version 5.15 allows unauthenticated remote attackers to inject malicious JavaScript via the outerSrc and selectPhoto parameters of the uploadFile function in controllers/pic.php. Victim interaction is required to trigger script execution in the target's browser, resulting in limited integrity impact such as session hijacking or page defacement. A public proof-of-concept exists via a GitHub issue report; the project maintainer has not responded to the disclosure.
Stored cross-site scripting in ShowDoc 3.9.0 and 3.9.1 allows an authenticated low-privileged user to inject malicious JavaScript via a crafted Mermaid diagram block saved through the API Page Save Endpoint, which then executes in the browser of any user who views the poisoned documentation page. The root cause is the Mermaid rendering library operating in its permissive default mode - with `htmlLabels` enabled and `securityLevel` not set to `strict` - combined with the absence of DOMPurify sanitization on rendered SVG output. A public proof-of-concept exploit is available; vendor-confirmed patch v3.9.2 resolves the issue.
Cross-site scripting in XenForo's dynamic redirect handler allows unauthenticated attackers to inject and execute arbitrary JavaScript in the board origin against authenticated users. The attack abuses a URI parsing confusion flaw: crafting a javascript: URI with the legitimate board hostname embedded in the authority component and percent-encoded newlines (%0a) to evade server-side host validation filters. When a logged-in user is induced to perform a Follow action via the crafted URL, attacker-controlled JavaScript executes in the victim's browser under the XenForo board's origin. No public exploit or KEV listing identified at time of analysis; vendor patch released in 2.3.13.
Stored cross-site scripting in LearnPress - WordPress LMS Plugin versions through 4.3.9.1 allows authenticated contributors to inject persistent malicious scripts via the 'layout_custom_css' parameter in the Elementor instructor list widget. The payload is written to the database and executes silently in the browser of any subsequent visitor, including administrators, enabling session hijacking, credential theft, or unauthorized actions on behalf of victims. No public exploit or CISA KEV listing has been identified; version 4.4.0 resolves the issue.
Stored Cross-Site Scripting in the Zephyr Project Manager WordPress plugin (all versions through 3.3.205) allows authenticated attackers holding Custom-level access or higher to inject persistent JavaScript via the 'message' parameter across three distinct code paths (Projects.php, AjaxHandler.php, Tasks.php). The injected payload executes in the browser of any subsequent user who visits the affected page, enabling session hijacking, credential harvesting, or UI redirection. No public exploit or active exploitation has been identified; a fix has been committed to the WordPress.org plugin repository (changeset 3656930).
Universal cross-site scripting in ZTE's NuBrowser (NebulaOS) allows remote unauthenticated attackers to execute arbitrary JavaScript within the origin of any website visited by the victim. The browser fails to enforce a protocol whitelist on the S.browser_fallback_url parameter of Android's intent:// URI scheme; by serving a 302 redirect pointing to a javascript: URL as the fallback destination, an attacker can trigger script execution under the target page's origin, breaking same-origin protections entirely. No public exploit or KEV listing has been identified at time of analysis, though the fix is pinned to NebulaOS Browser V1.6.8.
An authenticated stored cross-site scripting flaw in the Column Management component of ClassCMS 1CMS v5.6 lets an attacker with a valid low-privileged account inject a crafted payload into the title field, which is persisted and later rendered to other users. When a victim views the poisoned column listing, arbitrary script or HTML executes in their browser session, enabling session theft, credential harvesting, or actions performed as the victim. EPSS places exploitation probability at roughly 0.34% (27th percentile) and there is no CISA KEV listing, though a public proof-of-concept repository referencing this CVE has been published.
Reflected XSS in AppNitro MachForm v30 allows unauthenticated network attackers to execute arbitrary JavaScript in a victim's browser by embedding a malicious payload in the filter[filters][0][field] parameter of the grid_datasource.php component and socially engineering the victim into following the crafted URL. The vulnerability requires user interaction but no authentication (CVSS PR:N, UI:R), enabling session hijacking, credential theft, or forced browser actions against authenticated MachForm users. Publicly available exploit code exists via a GitHub PoC repository and a PacketStorm Security entry; however, the EPSS score of 0.24% (15th percentile) indicates low observed exploitation activity at time of analysis.
Stored cross-site scripting in JetBrains YouTrack before version 2026.2.18634 allows a high-privileged attacker to inject malicious scripts by uploading crafted project or organization icon files. When other authenticated users subsequently view the affected project or organization page, the stored payload executes in their browser context, enabling session data exposure or unauthorized in-application actions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Stored XSS in JetBrains YouTrack before version 2026.2.18634 allows authenticated low-privilege users to inject AngularJS template expressions through issue assignee name fields, which are then evaluated as client-side JavaScript in the browsers of any user who views the affected issue or project board. The attack persists server-side, meaning every subsequent viewer triggers execution without further attacker interaction. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Stored cross-site scripting in JetBrains YouTrack before version 2026.2.18634 allows authenticated low-privileged users to inject persistent malicious scripts through custom field values displayed on Agile board cards. When a victim with an active YouTrack session views the affected Agile board, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized actions on their behalf. No public exploit code has been identified at time of analysis, and JetBrains has released a patched version.
Cross-site scripting in league/commonmark 2.7.0-2.9.0 allows unauthenticated attackers to inject arbitrary JavaScript into rendered HTML output by prefixing an attribute name with a U+000C form feed byte, bypassing the AttributesExtension's event-handler filter and the allow_unsafe_links safeguard. The bypass exploits a mismatch between what PHP's built-in trim() considers whitespace (excluding U+000C) and what PCRE \s matches (including U+000C), leaving the byte embedded in the attribute name where PHP's string comparison logic fails to recognize it but browsers' HTML parsers strip it and treat the remainder as a genuine event handler. Exploitation requires the AttributesExtension to be enabled and untrusted Markdown to be fed to the converter; no public exploit has been identified at time of analysis, though the GHSA advisory provides a precise technical breakdown sufficient to reproduce the issue.
Stored XSS in MISP's dashboard Button widget (≤2.5.45) allows an authenticated low-privilege user to embed javascript: URLs or WHATWG-normalized backslash authority forms into widget configuration, which execute in the browser of any analyst who subsequently interacts with that widget. The root cause is a parser differential between PHP's URL handling and the WHATWG URL Standard implemented by browsers: forms such as \\evil.com or /\evil.com appear relative or host-matching under PHP's parse_url() but resolve to an off-origin authority in modern browsers. The upstream fix, confirmed via commit adf704e94 authored by the MISP maintainers at CIRCL, introduces a shared DashboardURLValidator that explicitly rejects raw backslashes, javascript: and other dangerous schemes, control characters, and unauthorized absolute origins. No public exploit code or active exploitation has been identified at time of analysis.
Cross-site scripting in Standard Notes for Android's Evernote (.enex) and Google Keep HTML note importers allows an attacker who socially engineers a victim into importing a crafted file to execute arbitrary JavaScript inside the app's WebView, stealing in-memory encryption keys and plaintext note data and invoking native Android device APIs. The impact is especially severe given Standard Notes' core value proposition is end-to-end encrypted note storage - key theft directly undermines that guarantee. Proof-of-concept exploit code exists per CVSS 4.0 E:P supplemental metric; no active exploitation (CISA KEV) identified at time of analysis.
Reflected cross-site scripting (XSS) in code-projects Hospital Information System 1.0 allows a remote authenticated attacker to inject arbitrary JavaScript into victim browsers via the unsanitized `id` parameter in `/HIS/src/patients/editPatient.php`. An attacker who can craft a malicious URL and induce an authenticated user to click it can execute scripts in the victim's browser session, enabling session hijacking, credential theft, or UI redress. A public proof-of-concept exploit is available on GitHub; no KEV listing exists, and the CVSS 4.0 score of 2.0 reflects the limited real-world impact given authentication and user-interaction prerequisites.
Stored Cross-Site Scripting in the Powerkit WordPress plugin (all versions up to and including 3.0.4) allows authenticated Contributors to permanently embed malicious JavaScript into published pages via a flawed regex-based HTML attribute parser in the Lazy Load module's `content_process_images` function. Any site visitor who subsequently loads an injected page triggers script execution in their browser context, enabling session hijacking, credential theft, or malicious redirects. A fix is confirmed available via WordPress plugin Trac changeset 3604146; no active exploitation or public exploit code has been identified at time of analysis.
Cross-site scripting in SourceCodester Simple Traffic Offense System 1.0 allows remote attackers to inject arbitrary JavaScript via the site_name and site_desc parameters of the save-settings.php Settings Update Endpoint. The injected payload is stored server-side and executes in the browser of any user who subsequently loads the affected page. A public proof-of-concept exploit has been disclosed on GitHub (issue #3 in tan1540684326-QAQ/cve), confirming the vulnerability is reproducible.
Cross-site scripting in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript via the msg, title, or content parameters in manage_subjects.php. A public proof-of-concept on GitHub documents both reflected and stored XSS variants, confirming the vulnerability is exploitable and the details are widely available. No vendor-released patch has been identified, and no active exploitation has been confirmed via CISA KEV.
Reflected cross-site scripting in sfturing ssm_pro's OrderController allows unauthenticated remote attackers to inject arbitrary JavaScript via the hospitalName, officesName, or doctorName parameters of the Order Endpoint. The affected codebase (up to commit 627f426331da8086ce8fff2017d65b1ddef384f8) is a Java-based hospital order management system that fails to sanitize user-supplied input before rendering it in the browser. An exploit has been published and is publicly available; the project maintainer has not yet responded to the disclosure despite being notified via a GitHub issue report.
Cross-site scripting in FastAdmin's User Controller (versions up to 1.2.0.20210401_beta) allows remote unauthenticated attackers to inject arbitrary JavaScript by crafting a malicious `url` redirect parameter on the login or register endpoint. The commit diff confirms the `$url` variable was echoed unescaped into HTML attribute contexts and a JavaScript `location.href` assignment in three template files, enabling `javascript:` URI injection in addition to classic reflected XSS. A public proof-of-concept exploit exists; the vendor-released patch in version 1.2.1.20210731_beta resolves all three injection points.
Reflected cross-site scripting in projectworlds Online Examination System 1.0 allows unauthenticated remote attackers to inject arbitrary JavaScript via the Name and Subject parameters of feedback.php. Exploitation delivers malicious script payload to any user whose browser renders the tampered response, enabling session hijacking, credential theft, or defacement within the application context. A public proof-of-concept exploit is available on GitHub; no CISA KEV listing has been identified at time of analysis.
Cross-site scripting in Projectwolds Online Attendance System 1.0 allows authenticated remote attackers to inject arbitrary client-side scripts via the email parameter in profile.php. Successful exploitation requires the victim to interact with a crafted page, resulting in low-integrity impact such as session hijacking or UI redressing. A public exploit has been released, though the low CVSS 4.0 score of 2.0 reflects the limited impact and authentication requirement.
Reflected cross-site scripting in code-projects Hotel and Tourism Reservation in PHP 1.0 allows unauthenticated remote attackers to inject arbitrary JavaScript via the `room` parameter in `/ht/details.php`. When a victim user follows a crafted URL, the unsanitized parameter is reflected directly into the HTML response, executing attacker-controlled script in the victim's browser context and enabling session hijacking or credential theft. A public proof-of-concept writeup exists on GitHub, though no active exploitation has been confirmed and no CISA KEV listing is present.
Stored cross-site scripting in code-projects Task Management System 1.0 allows authenticated remote attackers to inject malicious scripts via the `lname` parameter in `/user/UpdateUserProfile.php`. When a victim views the tampered profile, the injected script executes in their browser session. A public proof-of-concept exploit is available on GitHub, lowering the bar for exploitation.
Stored cross-site scripting in the Bold Page Builder WordPress plugin (all versions before 5.9.9) permits any user holding the Contributor role or higher to embed arbitrary JavaScript inside an HTML attribute via an unsanitized shortcode parameter. A publicly available exploit exists per WPScan (EUVD-2026-72064). When a higher-privileged user such as an administrator views a page containing the injected payload, the script executes in their browser, enabling session hijacking, nonce theft, or full administrative takeover of the WordPress installation.
Stored XSS in Grav CMS before 2.0.20 lets low-privileged page editors inject arbitrary JavaScript that executes in every visitor's browser, including administrators, by abusing the Twig content sandbox's allowlisted `addJs`/`addCss` methods on `Grav\Common\Assets`. The asset URL is concatenated directly into `<script src>` and `<link href>` tags in the document head without output escaping, and Grav's built-in XSS scanner cannot detect the payload because `addJs()` mutates the shared Assets service and returns only an object key - no inspectable markup is produced at scan time. Vendor-released patch Grav 2.0.20 is available; no public exploit has been identified at time of analysis.
Unauthenticated cross-site scripting in AVideo's YPTSocket plugin allows remote attackers to execute arbitrary JavaScript in the browsers of connected users by sending crafted WebSocket messages. The attack leverages the plugin's WebSocket callback dispatch mechanism, which resolves attacker-controlled callback names to global JavaScript functions (e.g., `avideoConfirmHTML`) that assign untrusted message data directly to `innerHTML` without sanitization. Because the exploit path runs entirely through the WebSocket layer, no authentication and no secondary victim interaction beyond holding an active session are required, enabling persistent script injection into any connected user's origin context.
Stored Cross-Site Scripting in the Pods - Custom Content Types and Fields WordPress plugin (all versions ≤ 3.3.9.1) allows contributor-level authenticated attackers to inject persistent malicious scripts via the 'not_found' shortcode attribute, executing in victim browsers on page load. The root cause is insufficient sanitization and output escaping in general.php (lines 1399, 2535, 2539) and PodsInit.php (line 514), as identified by Wordfence. No public exploit or KEV listing has been identified at time of analysis, but the contributor-level access bar is low on multi-author WordPress sites.
Stored XSS in the FooGallery WordPress plugin (all versions through 3.3.2) allows authenticated contributors to inject persistent JavaScript via the `custom_settings` shortcode attribute. The malicious payload executes in any visitor's browser when they access an affected page, enabling session hijacking, credential theft, or privilege escalation against higher-privileged users including site administrators. No public exploit code or CISA KEV listing has been identified, but the low privilege barrier - a contributor account - makes this realistically exploitable on sites with open or loosely managed contributor registration.
Reflected XSS in the Unlimited Elements For Elementor WordPress plugin (all versions through 2.0.17) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL containing a malicious payload in the `formData[id]` parameter. The plugin registers a front-end AJAX handler on the public WordPress `wp` action with no nonce, capability, or referer check; the attacker-controlled parameter value is interpolated verbatim into an exception message and echoed in the HTTP response without output escaping, and when the content-type resolves to text/html the browser parses and executes the injected markup. No public exploit has been identified at the time of analysis, though the unauthenticated network vector and low attack complexity make social-engineering delivery straightforward against WordPress sites running this plugin.
DOM-based stored Cross-Site Scripting in the Divi WordPress theme (all versions through 4.27.6) allows authenticated Contributor-level attackers to inject persistent arbitrary JavaScript via the `image_src` attribute of the `et_pb_video_slider_item` shortcode. The payload survives server-side sanitization because `esc_attr()` encodes double quotes as `"`, but jQuery's `.data('image')` call in `custom.unified.js` silently HTML-entity-decodes that value at runtime, and the decoded string is then concatenated into HTML and injected into the DOM via `jQuery.after()` with no further escaping. No public exploit or CISA KEV listing is identified; a patched release (4.27.7) is available per the Divi changelog.
Reflected XSS in Beaver Builder Plugin (Starter Version) for WordPress (all versions ≤2.11.0.1) permits unauthenticated attackers to inject arbitrary JavaScript via the unsanitized `no_results_message` parameter in the `node_preview` endpoint. Successful exploitation requires tricking a victim into clicking a crafted URL, after which the injected script executes in the victim's browser with access to session cookies, page DOM, and any credentials present in that context. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in the Joli Table Of Contents WordPress plugin (versions before 3.0.3) permits any user holding the Author role or higher to inject arbitrary HTML attributes and JavaScript via an unsanitized shortcode attribute, with the payload executing in the browser of any visitor - including administrators - who views the post. Because Authors in WordPress are explicitly barred from posting unfiltered HTML, this constitutes a privilege-boundary violation that can be leveraged to hijack administrator sessions or trigger privileged actions covertly. A public exploit is documented by WPScan; EPSS stands at 0.15% (5th percentile), indicating limited automated targeting, and no CISA KEV listing exists.
Stored XSS in CatFolders Document Gallery & PDF Library WordPress plugin before version 2.0.7 allows any user holding an Author account or higher to inject persistent malicious scripts via an unsanitized block attribute that is directly interpolated as an HTML tag name in gallery rendering output. Any visitor who views a post containing the crafted gallery block will execute the attacker's payload in their browser without additional interaction. No active exploitation has been confirmed in CISA KEV, but a publicly available proof-of-concept exists per WPScan disclosure, reducing the technical barrier for any authenticated attacker.
Stored XSS in VikWidgetsLoader WordPress plugin before 1.12.0 allows Contributor-role users to permanently embed arbitrary JavaScript into posts by supplying a malicious block attribute that is output unsanitized inside an inline script tag. When an administrator reviews the pending submission, the payload executes in their browser, enabling full session hijacking and site takeover without any further attacker interaction. A publicly available exploit exists (via WPScan), though EPSS is low (0.15%, 5th percentile) and SSVC records no confirmed exploitation at this time.
Stored cross-site scripting in King Addons for Elementor WordPress plugin before version 51.1.77 allows any Contributor-level (or higher) user to inject persistent JavaScript into a widget display-style setting that is written unescaped into an HTML attribute at render time. The payload fires in every visitor's browser upon page load - including logged-in administrators - enabling session hijacking, credential theft, or silent execution of privileged site actions. A publicly available proof-of-concept was disclosed via WPScan; no active exploitation is confirmed in the CISA KEV catalog at time of analysis.
Stored cross-site scripting in Bold Page Builder WordPress plugin (all versions before 5.9.8) allows authenticated Contributor-level users to inject persistent arbitrary JavaScript through unsanitized shortcode attribute values, which then execute in the browsers of any visitor rendering the affected page. A publicly available proof-of-concept exists via WPScan, and the vendor has released a patched version (5.9.8). Despite a low EPSS score (0.15%, 5th percentile), the public PoC and low privilege bar make this a realistic attack vector against sites with open contributor registration.
Stored cross-site scripting in the Bold Page Builder WordPress plugin before 5.9.8 allows authenticated users holding the Contributor role or higher to inject arbitrary JavaScript via a crafted link URL that bypasses the plugin's client-side filter. When a victim user subsequently clicks the malicious link rendered in the page builder output, the injected script executes in their browser session. A publicly available proof-of-concept exists per WPScan, though EPSS remains very low (0.15%), indicating limited observed exploitation despite public disclosure.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript in a victim's browser by luring them to a crafted URL or page that manipulates the client-side DOM. Affected deployments span AEM 6.5 on-premises (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0), covering a broad range of enterprise CMS installations. The scope-changed CVSS vector (S:C) signals that the script executes beyond the AEM application context - enabling session hijacking, credential theft, or action-on-behalf-of attacks targeting higher-privilege users. No public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to deliver a crafted URL that, when visited by an authenticated victim, executes arbitrary JavaScript within the victim's browser context with scope change across security boundaries. Affected deployments span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. Adobe has released APSB26-98 addressing this issue; no public exploit code or active exploitation has been identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to inject malicious JavaScript that executes entirely within a victim's browser, bypassing server-side defenses. Affected products span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. The scope-changed classification (S:C) indicates the injected script can operate beyond the AEM application boundary in the victim's browser context, enabling session hijacking or credential theft from a higher-privileged user. No confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject malicious JavaScript that executes within a victim's browser session by luring them to a crafted webpage. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, with scope changed - meaning injected scripts can affect resources beyond the immediate AEM origin. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor advisory APSB26-98 covers remediation.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged remote attacker to execute malicious JavaScript in a victim's browser by luring the victim to a crafted URL or page that manipulates the client-side DOM environment. Affected versions span the entire AEM 6.5 line through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. Adobe has addressed this through APSB26-98; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated low-privileged attackers to execute arbitrary JavaScript in victims' browsers by crafting pages that manipulate the DOM environment. Affected deployments include AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. The scope-changed CVSS vector signals that script execution can cross component or trust boundaries within the victim's browser session. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0 allows low-privileged authenticated attackers to execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment. Exploitation requires the victim to visit a crafted webpage, placing this in a social-engineering or insider-threat scenario rather than direct network exploitation. The scope change (S:C) in the CVSS vector confirms the JavaScript executes outside AEM's security boundary in the victim's browser context. No public exploit or CISA KEV listing is identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute arbitrary JavaScript within a victim's browser session by manipulating the DOM environment via a crafted webpage. Affected deployments span AEM as a Cloud Service through July 2026, AEM 6.5 through version 6.5.24, and AEM 6.5 LTS through SP2. No public exploit or active exploitation has been identified at time of analysis; the CVSS score of 5.4 reflects the authentication prerequisite and mandatory victim interaction, though the scope-changed rating indicates the injected script can affect resources outside the AEM application boundary.
DOM-based cross-site scripting in Adobe Experience Manager allows authenticated users to execute malicious JavaScript within their browser context by visiting a crafted webpage. The vulnerability affects AEM as a Cloud Service (up to version 2026.7.0) and on-premises versions (6.5 up to 6.5.24, 6.5 LTS through SP2). With scope changed, the attack can extend beyond the vulnerable component to affect other AEM systems or data. No public exploit code or active exploitation confirmed at time of analysis.
DOM-based cross-site scripting in Adobe Experience Manager 6.5 releases through version 6.5.24 and Cloud Service deployments through 2026.7.0 allows authenticated attackers to execute malicious JavaScript in victims' browsers by injecting attacker-controlled DOM manipulation code into shared content. Successful exploitation harvests session tokens, performs unauthorized actions as the victim, and accesses sensitive data within the victim's authorized scope. The attack requires both attacker authentication and victim user interaction with crafted pages; no active exploitation or public exploits identified at analysis time.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment. Affected deployments span AEM as a Cloud Service through 2026.7.0 and on-premises AEM 6.5 through 6.5.24 and LTS through SP2. Exploitation requires that a low-privileged attacker socially engineer a target user into visiting a specially crafted URL or page; vendor advisory APSB26-98 confirms the issue and provides patched releases. No public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and execute malicious JavaScript within a victim's browser session by manipulating client-side DOM data without server-side interaction. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. The scope-changed nature of the flaw means successful exploitation can affect browser resources beyond the AEM application boundary; no public exploit code or active exploitation has been identified at time of analysis.
Stored XSS in Adobe Experience Manager allows authenticated low-privileged attackers to inject malicious JavaScript into vulnerable form fields that later executes in victims' browsers when they visit the affected page. Affected deployments span AEM 6.5 (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0). Adobe has addressed this in security bulletin APSB26-98; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged, network-accessible attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in any victim's browser upon visiting the affected page. Scope change (S:C) confirms the attack crosses from the application server context into the victim's browser security context, enabling session hijacking, credential theft, or further phishing within the authenticated AEM environment. No public exploit or KEV listing is present at time of analysis; CVSS 5.4 (Medium) reflects the privilege and user-interaction barriers that limit opportunistic mass exploitation.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to persistently inject malicious JavaScript into vulnerable form fields within the CMS. When any victim - including administrators - browses to the page containing the injected payload, the script executes in their browser session under the AEM application's trust boundary, with scope changing to the victim's context. Affected versions span AEM 6.5 ≤6.5.24, AEM as a Cloud Service ≤2026.7.0, and AEM 6.5 LTS ≤SP2, with remediation available via Adobe advisory APSB26-98. No public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript within a victim's browser by inducing them to visit a crafted URL. Affected deployments span AEM as a Cloud Service (≤2026.7.0), AEM 6.5 LTS (≤SP2), and AEM 6.5 on-premises (≤6.5.24), as confirmed by EUVD-2026-74147 and Adobe APSB26-98. The scope-change rating reflects that injected script runs in the victim's browser security context, enabling session theft, credential harvesting, or UI redress attacks against higher-privileged users. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows an authenticated low-privileged attacker to inject and execute arbitrary JavaScript within victim browsers by crafting a malicious URL that manipulates the client-side DOM environment. Affected products span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. The scope-changed CVSS vector (S:C) indicates the injected script can reach resources beyond the AEM application's own security boundary. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment via a crafted webpage. Affected deployments span AEM 6.5 on-premises (≤6.5.24), AEM 6.5 LTS (≤SP2), and AEM as a Cloud Service (≤2026.7.0), as documented in Adobe APSB26-98. The CVSS S:C scope-change designation confirms the payload can escape the vulnerable component's security boundary, enabling session hijacking or cross-origin data exfiltration against privileged AEM users. No public exploit code or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager 6.5 (through 6.5.24), 6.5 LTS (through SP2), and Cloud Service (through 2026.7.0) enables an authenticated attacker to inject malicious JavaScript that executes in a victim's browser by manipulating client-side DOM state. The scope change (S:C) in the CVSS vector reflects that the injected script runs within the AEM domain's browser context, potentially reaching session tokens, saved credentials, or authoring capabilities beyond the attacker's original privilege level. Exploitation requires the attacker to hold a valid low-privilege AEM account and to socially engineer a victim into visiting a crafted URL; no public exploit code has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to execute arbitrary JavaScript in a victim's browser by luring them to a crafted URL that manipulates the DOM environment. Affected across AEM 6.5 (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0). The scope-changed CVSS vector confirms the script executes outside the originating security context, enabling session theft, credential harvesting, or actions-on-behalf-of-victim against the AEM interface. No public exploit code or CISA KEV listing identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by manipulating client-side DOM sinks via a crafted URL. Scope change (S:C) means the injected script executes outside AEM's own origin context, enabling session token theft or privilege escalation against higher-privileged AEM users. Affected versions span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, per Adobe advisory APSB26-98. No public exploit or active exploitation is identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager enables an authenticated low-privileged attacker to inject and execute malicious JavaScript in a victim's browser by tricking them into visiting a specially crafted URL. The vulnerability spans AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, covering a broad enterprise install base. The CVSS scope-change flag (S:C) is the most significant risk amplifier, indicating injected scripts can reach security contexts beyond the originating AEM application. No public exploit or CISA KEV listing exists at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker with low privileges to execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Because scope is changed (S:C per CVSS), the injected script can reach browser resources beyond the AEM origin, enabling session token theft or unauthorized actions performed as the victim. No public exploit code has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged remote attacker to execute malicious JavaScript in a victim's browser by manipulating the DOM environment of a crafted webpage. Affected versions span AEM 6.5 through 6.5.24, AEM as a Cloud Service through the 2026.7.0 release, and AEM 6.5 LTS through SP2. No public exploit or active exploitation has been identified at time of analysis; Adobe has issued advisory APSB26-98 with patch availability.
Stored Cross-Site Scripting in Adobe Experience Manager allows low-privileged authenticated attackers to inject persistent malicious JavaScript into vulnerable form fields, which then executes in the browsers of users who visit the affected pages. Affected deployments include AEM 6.5 through version 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the scope-changed CVSS vector indicates meaningful session and interface impact when exploited.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) allows an authenticated attacker to inject malicious JavaScript into a victim's browser by manipulating the DOM environment through a crafted webpage. The vulnerability affects AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, and carries a scope change meaning injected scripts execute beyond the attacker's origin context. No public exploit identified at time of analysis, and it is not listed in the CISA KEV catalog.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malicious JavaScript within a victim's browser by luring them to a crafted webpage. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and the Cloud Service through the 2026.7.0 release. Scope is changed per the CVSS vector, meaning the exploit crosses the boundary from the AEM application context into the broader browser environment; no public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows low-privilege authenticated attackers to execute arbitrary JavaScript in victims' browsers by delivering crafted URLs or pages that manipulate the client-side DOM environment. All supported AEM deployment modes are affected: on-premises 6.5.x through 6.5.24, 6.5 LTS through SP2, and Cloud Service through 2026.7.0. Adobe addressed this in security bulletin APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When a higher-privileged user (such as an administrator) browses the affected page, the script executes in their browser context, enabling session hijacking, credential theft, or UI redirection. The scope change (S:C in CVSS) signals that injected scripts can operate outside the application's own origin, amplifying the effective impact beyond the application boundary. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in HTML::FormHandler before 0.410000 (Perl/CPAN) allows unauthenticated network attackers to inject arbitrary JavaScript by submitting markup to any form field that triggers a validation error message embedding the submitted value. The library's rendering roles - Render::Simple, Render::Table, and Widget::Form::Simple - interpolate error strings directly into HTML error spans without entity encoding, so fields using check regexps, check lists, or type constraints expose the reflected XSS path. A stored XSS variant is also possible when applications persist and later re-render rejected form values. No public exploit is identified; vendor-released patch 0.410000 is available.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to execute arbitrary JavaScript in a victim's browser by luring them to a crafted webpage. The vulnerability spans Adobe Experience Manager as a Cloud Service (≤2026.7.0), AEM 6.5 LTS (≤SP2), and AEM 6.5 (≤6.5.24), per APSB26-98. No active exploitation or public exploit code has been identified at time of analysis, though the scope-changed nature means successful exploitation can cross security boundaries within the victim's browser context.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated, low-privileged attacker to inject and execute arbitrary JavaScript in the browser session of any victim who visits a crafted AEM page. Affected are AEM as a Cloud Service through 2026.7.0, AEM 6.5 LTS through SP2, and AEM 6.5 on-premise through 6.5.24. The scope-changed CVSS rating (S:C) reflects that the injected script executes in the victim's browser context and can reach resources-such as session tokens and authenticated API calls-beyond the originating AEM page, amplifying the practical impact relative to the medium base score.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to execute malicious JavaScript within a victim's browser by delivering a crafted URL or page that manipulates the client-side DOM. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. The scope change in the CVSS vector reflects that injected script executes beyond the originating component boundary, potentially enabling session theft or privilege escalation against higher-privileged AEM users. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) allows an authenticated attacker to execute arbitrary JavaScript within a victim's browser by enticing them to visit a crafted URL, affecting AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the July 2026 release. The CVSS scope change (S:C) signals that the injected script escapes AEM's own browser origin boundary, enabling session hijacking or unauthorized CMS operations under the victim's identity. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the broad enterprise footprint of AEM makes patching a priority.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When any user - including higher-privileged administrators - browses to the page containing the injected payload, the script executes in their browser context, crossing scope boundaries into the victim's session. Affected versions span AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2, as confirmed by APSB26-98. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which executes in any victim's browser that subsequently visits the affected page. The scope-changed nature of this flaw (S:C in CVSS) means the attacker's script runs within the victim's browser security context, enabling session token theft, credential harvesting, or further client-side attacks. Affected deployments span AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2; no public exploit code or KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields within the CMS. When any user-including administrators-browses to a page containing the injected content, the script executes in their browser under a changed security context (S:C), enabling session hijacking, credential theft, or unauthorized actions performed on behalf of the victim. Affected versions span AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2; no public exploit or active exploitation confirmed via CISA KEV at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields within the authoring environment. When any higher-privileged user subsequently browses the affected page, the script executes in their browser within a changed scope, potentially enabling session theft or unauthorized actions. Adobe has issued advisory APSB26-98 covering AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0; no public exploit or CISA KEV listing has been identified.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to persist malicious JavaScript payloads in vulnerable form fields, which then execute in any victim's browser upon page visit. Affected versions span AEM 6.5 (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0). Adobe has addressed the issue in security bulletin APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.
Stored XSS in Adobe Experience Manager permits low-privileged authenticated users to inject persistent JavaScript payloads into vulnerable form fields within the CMS authoring interface. When any user - including administrators - browses a page containing the injected field, their browser executes the attacker's script in the context of the AEM domain, with scope change confirming cross-boundary impact. All AEM 6.5 versions through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 build are affected; remediation is available via Adobe APSB26-98. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in the browsers of other users - including administrators - when they visit the affected page. Affected deployments span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. No public exploit or CISA KEV listing has been identified at time of analysis; the scope-changed CVSS vector reflects the cross-user browser impact.
Stored XSS in Adobe Experience Manager allows low-privileged authenticated attackers to inject malicious JavaScript into vulnerable form fields, where it persists server-side and executes in any victim's browser upon visiting the affected page. Three release tracks are affected: AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. The scope-changed impact means attacker-controlled scripts run in victim browser contexts - including those of administrators - enabling session hijacking, credential theft, or unauthorized actions on behalf of higher-privileged users. No public exploit or CISA KEV listing identified at time of analysis.
Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in any victim's browser when they navigate to the affected page. Affected deployments span AEM 6.5 through 6.5.24 and 6.5 LTS through SP2 (on-premises), as well as AEM as a Cloud Service through the July 2026 release (2026.7.0). Adobe has published advisory APSB26-98 confirming the scope-changed impact; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields that persists and executes in the browsers of other users who visit the affected page. Affected products span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. The scope-changed nature of the vulnerability means the attacker's payload crosses from the AEM application context into victim browser sessions, enabling session hijacking, credential theft, or unauthorized actions performed as the victim. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to manipulate client-side DOM processing and execute arbitrary JavaScript in a victim's browser session. Affected deployments span AEM 6.5 up to version 6.5.24, AEM 6.5 LTS up to SP2, and AEM as a Cloud Service up to release 2026.7.0. Exploitation requires convincing an authenticated victim to visit a specially crafted URL; scope is changed because the injected script runs in the victim's browser context outside the AEM application boundary. No public exploit code or CISA KEV listing has been identified at time of analysis; Adobe has issued patches under advisory APSB26-98.
Cross-site scripting in on-premises Skype for Business Server enables network-accessible spoofing attacks across three supported server generations. The CVSS 6.5 rating reflects limited confidentiality and integrity impact, consistent with content-injection or UI-spoofing outcomes rather than full session takeover. A vendor-released patch is available through the Microsoft Security Response Center; no public exploit has been identified at time of analysis.
Cross-site scripting in Microsoft Skype for Business Server enables network-based spoofing against authenticated users across three distinct server product lines. An unauthenticated remote attacker can inject malicious script into a vulnerable web component that executes in a victim's browser upon user interaction, resulting in high-confidentiality-impact session token theft or UI-level spoofing consistent with the CVSS C:H/I:N pairing. Vendor-released patches are confirmed available via MSRC; no public exploit code and no CISA KEV listing exist at time of analysis.
Cross-site scripting in AVEVA PIMBoards (Pipeline Integrity Monitor ≤ 2025 SP1 P1, build 7.1.9580.8513) enables unauthenticated remote attackers to execute arbitrary JavaScript in a targeted user's active browser session by tricking the user into clicking a crafted malicious link. The attack is classified CWE-79 (reflected XSS), requires active user interaction, and is reported by ICS-CERT - indicating relevance to operational technology and industrial pipeline environments. No public exploit code has been identified at time of analysis, and CISA SSVC rates current exploitation as none.
Cross-site scripting in Microsoft SharePoint Server Subscription Edition allows an authenticated network attacker with low-level privileges to inject malicious scripts into pages rendered by SharePoint, enabling spoofing attacks against other authenticated users. The flaw is classified CWE-79 and confirmed by Microsoft (secure@microsoft.com) with a vendor patch available targeting builds below 16.0.20326.20090. No public exploit code has been identified and the vulnerability does not appear in CISA KEV.
Cross-site scripting in Microsoft SharePoint Server Subscription Edition enables an authorized high-privilege attacker to inject malicious script into SharePoint pages, causing spoofing attacks against other users who view the injected content. The CVSS base score of 3.5 reflects the high authentication bar (PR:H) and mandatory victim interaction (UI:R), confining realistic exploitation to insider-threat scenarios or compromised privileged accounts rather than external unauthenticated attackers. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Cross-site scripting in Microsoft SharePoint Server Subscription Edition (builds prior to 16.0.20326.20090) allows an authenticated low-privileged attacker to inject malicious scripts into SharePoint pages, enabling spoofing attacks against users who view the compromised content. The CVSS vector (PR:L/UI:R/C:H/I:H) indicates victim interaction is required and that impact may extend to session token exposure or impersonation within the SharePoint context. No public exploit code has been confirmed and no active exploitation is listed in CISA KEV at time of analysis.
Cross-site scripting in Microsoft SharePoint Server Subscription Edition allows an authenticated network attacker to inject malicious script into page output, enabling spoofing attacks against other users. Successful exploitation requires the victim to interact with attacker-controlled content but can result in high confidentiality and integrity impact within the victim's SharePoint session context. Microsoft has released patch version 16.0.20326.20090 addressing this flaw, reported internally via secure@microsoft.com.
Cross-site scripting in aircheng-org iWebShop-5 through version 5.15 allows unauthenticated remote attackers to inject malicious JavaScript via the outerSrc and selectPhoto parameters of the uploadFile function in controllers/pic.php. Victim interaction is required to trigger script execution in the target's browser, resulting in limited integrity impact such as session hijacking or page defacement. A public proof-of-concept exists via a GitHub issue report; the project maintainer has not responded to the disclosure.
Stored cross-site scripting in ShowDoc 3.9.0 and 3.9.1 allows an authenticated low-privileged user to inject malicious JavaScript via a crafted Mermaid diagram block saved through the API Page Save Endpoint, which then executes in the browser of any user who views the poisoned documentation page. The root cause is the Mermaid rendering library operating in its permissive default mode - with `htmlLabels` enabled and `securityLevel` not set to `strict` - combined with the absence of DOMPurify sanitization on rendered SVG output. A public proof-of-concept exploit is available; vendor-confirmed patch v3.9.2 resolves the issue.
Cross-site scripting in XenForo's dynamic redirect handler allows unauthenticated attackers to inject and execute arbitrary JavaScript in the board origin against authenticated users. The attack abuses a URI parsing confusion flaw: crafting a javascript: URI with the legitimate board hostname embedded in the authority component and percent-encoded newlines (%0a) to evade server-side host validation filters. When a logged-in user is induced to perform a Follow action via the crafted URL, attacker-controlled JavaScript executes in the victim's browser under the XenForo board's origin. No public exploit or KEV listing identified at time of analysis; vendor patch released in 2.3.13.
Stored cross-site scripting in LearnPress - WordPress LMS Plugin versions through 4.3.9.1 allows authenticated contributors to inject persistent malicious scripts via the 'layout_custom_css' parameter in the Elementor instructor list widget. The payload is written to the database and executes silently in the browser of any subsequent visitor, including administrators, enabling session hijacking, credential theft, or unauthorized actions on behalf of victims. No public exploit or CISA KEV listing has been identified; version 4.4.0 resolves the issue.
Stored Cross-Site Scripting in the Zephyr Project Manager WordPress plugin (all versions through 3.3.205) allows authenticated attackers holding Custom-level access or higher to inject persistent JavaScript via the 'message' parameter across three distinct code paths (Projects.php, AjaxHandler.php, Tasks.php). The injected payload executes in the browser of any subsequent user who visits the affected page, enabling session hijacking, credential harvesting, or UI redirection. No public exploit or active exploitation has been identified; a fix has been committed to the WordPress.org plugin repository (changeset 3656930).
Universal cross-site scripting in ZTE's NuBrowser (NebulaOS) allows remote unauthenticated attackers to execute arbitrary JavaScript within the origin of any website visited by the victim. The browser fails to enforce a protocol whitelist on the S.browser_fallback_url parameter of Android's intent:// URI scheme; by serving a 302 redirect pointing to a javascript: URL as the fallback destination, an attacker can trigger script execution under the target page's origin, breaking same-origin protections entirely. No public exploit or KEV listing has been identified at time of analysis, though the fix is pinned to NebulaOS Browser V1.6.8.
An authenticated stored cross-site scripting flaw in the Column Management component of ClassCMS 1CMS v5.6 lets an attacker with a valid low-privileged account inject a crafted payload into the title field, which is persisted and later rendered to other users. When a victim views the poisoned column listing, arbitrary script or HTML executes in their browser session, enabling session theft, credential harvesting, or actions performed as the victim. EPSS places exploitation probability at roughly 0.34% (27th percentile) and there is no CISA KEV listing, though a public proof-of-concept repository referencing this CVE has been published.
Reflected XSS in AppNitro MachForm v30 allows unauthenticated network attackers to execute arbitrary JavaScript in a victim's browser by embedding a malicious payload in the filter[filters][0][field] parameter of the grid_datasource.php component and socially engineering the victim into following the crafted URL. The vulnerability requires user interaction but no authentication (CVSS PR:N, UI:R), enabling session hijacking, credential theft, or forced browser actions against authenticated MachForm users. Publicly available exploit code exists via a GitHub PoC repository and a PacketStorm Security entry; however, the EPSS score of 0.24% (15th percentile) indicates low observed exploitation activity at time of analysis.
Stored cross-site scripting in JetBrains YouTrack before version 2026.2.18634 allows a high-privileged attacker to inject malicious scripts by uploading crafted project or organization icon files. When other authenticated users subsequently view the affected project or organization page, the stored payload executes in their browser context, enabling session data exposure or unauthorized in-application actions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Stored XSS in JetBrains YouTrack before version 2026.2.18634 allows authenticated low-privilege users to inject AngularJS template expressions through issue assignee name fields, which are then evaluated as client-side JavaScript in the browsers of any user who views the affected issue or project board. The attack persists server-side, meaning every subsequent viewer triggers execution without further attacker interaction. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Stored cross-site scripting in JetBrains YouTrack before version 2026.2.18634 allows authenticated low-privileged users to inject persistent malicious scripts through custom field values displayed on Agile board cards. When a victim with an active YouTrack session views the affected Agile board, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized actions on their behalf. No public exploit code has been identified at time of analysis, and JetBrains has released a patched version.
Cross-site scripting in league/commonmark 2.7.0-2.9.0 allows unauthenticated attackers to inject arbitrary JavaScript into rendered HTML output by prefixing an attribute name with a U+000C form feed byte, bypassing the AttributesExtension's event-handler filter and the allow_unsafe_links safeguard. The bypass exploits a mismatch between what PHP's built-in trim() considers whitespace (excluding U+000C) and what PCRE \s matches (including U+000C), leaving the byte embedded in the attribute name where PHP's string comparison logic fails to recognize it but browsers' HTML parsers strip it and treat the remainder as a genuine event handler. Exploitation requires the AttributesExtension to be enabled and untrusted Markdown to be fed to the converter; no public exploit has been identified at time of analysis, though the GHSA advisory provides a precise technical breakdown sufficient to reproduce the issue.
Stored XSS in MISP's dashboard Button widget (≤2.5.45) allows an authenticated low-privilege user to embed javascript: URLs or WHATWG-normalized backslash authority forms into widget configuration, which execute in the browser of any analyst who subsequently interacts with that widget. The root cause is a parser differential between PHP's URL handling and the WHATWG URL Standard implemented by browsers: forms such as \\evil.com or /\evil.com appear relative or host-matching under PHP's parse_url() but resolve to an off-origin authority in modern browsers. The upstream fix, confirmed via commit adf704e94 authored by the MISP maintainers at CIRCL, introduces a shared DashboardURLValidator that explicitly rejects raw backslashes, javascript: and other dangerous schemes, control characters, and unauthorized absolute origins. No public exploit code or active exploitation has been identified at time of analysis.
Cross-site scripting in Standard Notes for Android's Evernote (.enex) and Google Keep HTML note importers allows an attacker who socially engineers a victim into importing a crafted file to execute arbitrary JavaScript inside the app's WebView, stealing in-memory encryption keys and plaintext note data and invoking native Android device APIs. The impact is especially severe given Standard Notes' core value proposition is end-to-end encrypted note storage - key theft directly undermines that guarantee. Proof-of-concept exploit code exists per CVSS 4.0 E:P supplemental metric; no active exploitation (CISA KEV) identified at time of analysis.
Reflected cross-site scripting (XSS) in code-projects Hospital Information System 1.0 allows a remote authenticated attacker to inject arbitrary JavaScript into victim browsers via the unsanitized `id` parameter in `/HIS/src/patients/editPatient.php`. An attacker who can craft a malicious URL and induce an authenticated user to click it can execute scripts in the victim's browser session, enabling session hijacking, credential theft, or UI redress. A public proof-of-concept exploit is available on GitHub; no KEV listing exists, and the CVSS 4.0 score of 2.0 reflects the limited real-world impact given authentication and user-interaction prerequisites.
Stored Cross-Site Scripting in the Powerkit WordPress plugin (all versions up to and including 3.0.4) allows authenticated Contributors to permanently embed malicious JavaScript into published pages via a flawed regex-based HTML attribute parser in the Lazy Load module's `content_process_images` function. Any site visitor who subsequently loads an injected page triggers script execution in their browser context, enabling session hijacking, credential theft, or malicious redirects. A fix is confirmed available via WordPress plugin Trac changeset 3604146; no active exploitation or public exploit code has been identified at time of analysis.
Cross-site scripting in SourceCodester Simple Traffic Offense System 1.0 allows remote attackers to inject arbitrary JavaScript via the site_name and site_desc parameters of the save-settings.php Settings Update Endpoint. The injected payload is stored server-side and executes in the browser of any user who subsequently loads the affected page. A public proof-of-concept exploit has been disclosed on GitHub (issue #3 in tan1540684326-QAQ/cve), confirming the vulnerability is reproducible.
Cross-site scripting in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript via the msg, title, or content parameters in manage_subjects.php. A public proof-of-concept on GitHub documents both reflected and stored XSS variants, confirming the vulnerability is exploitable and the details are widely available. No vendor-released patch has been identified, and no active exploitation has been confirmed via CISA KEV.
Reflected cross-site scripting in sfturing ssm_pro's OrderController allows unauthenticated remote attackers to inject arbitrary JavaScript via the hospitalName, officesName, or doctorName parameters of the Order Endpoint. The affected codebase (up to commit 627f426331da8086ce8fff2017d65b1ddef384f8) is a Java-based hospital order management system that fails to sanitize user-supplied input before rendering it in the browser. An exploit has been published and is publicly available; the project maintainer has not yet responded to the disclosure despite being notified via a GitHub issue report.
Cross-site scripting in FastAdmin's User Controller (versions up to 1.2.0.20210401_beta) allows remote unauthenticated attackers to inject arbitrary JavaScript by crafting a malicious `url` redirect parameter on the login or register endpoint. The commit diff confirms the `$url` variable was echoed unescaped into HTML attribute contexts and a JavaScript `location.href` assignment in three template files, enabling `javascript:` URI injection in addition to classic reflected XSS. A public proof-of-concept exploit exists; the vendor-released patch in version 1.2.1.20210731_beta resolves all three injection points.
Reflected cross-site scripting in projectworlds Online Examination System 1.0 allows unauthenticated remote attackers to inject arbitrary JavaScript via the Name and Subject parameters of feedback.php. Exploitation delivers malicious script payload to any user whose browser renders the tampered response, enabling session hijacking, credential theft, or defacement within the application context. A public proof-of-concept exploit is available on GitHub; no CISA KEV listing has been identified at time of analysis.
Cross-site scripting in Projectwolds Online Attendance System 1.0 allows authenticated remote attackers to inject arbitrary client-side scripts via the email parameter in profile.php. Successful exploitation requires the victim to interact with a crafted page, resulting in low-integrity impact such as session hijacking or UI redressing. A public exploit has been released, though the low CVSS 4.0 score of 2.0 reflects the limited impact and authentication requirement.
Reflected cross-site scripting in code-projects Hotel and Tourism Reservation in PHP 1.0 allows unauthenticated remote attackers to inject arbitrary JavaScript via the `room` parameter in `/ht/details.php`. When a victim user follows a crafted URL, the unsanitized parameter is reflected directly into the HTML response, executing attacker-controlled script in the victim's browser context and enabling session hijacking or credential theft. A public proof-of-concept writeup exists on GitHub, though no active exploitation has been confirmed and no CISA KEV listing is present.
Stored cross-site scripting in code-projects Task Management System 1.0 allows authenticated remote attackers to inject malicious scripts via the `lname` parameter in `/user/UpdateUserProfile.php`. When a victim views the tampered profile, the injected script executes in their browser session. A public proof-of-concept exploit is available on GitHub, lowering the bar for exploitation.
Stored cross-site scripting in the Bold Page Builder WordPress plugin (all versions before 5.9.9) permits any user holding the Contributor role or higher to embed arbitrary JavaScript inside an HTML attribute via an unsanitized shortcode parameter. A publicly available exploit exists per WPScan (EUVD-2026-72064). When a higher-privileged user such as an administrator views a page containing the injected payload, the script executes in their browser, enabling session hijacking, nonce theft, or full administrative takeover of the WordPress installation.
Stored XSS in Grav CMS before 2.0.20 lets low-privileged page editors inject arbitrary JavaScript that executes in every visitor's browser, including administrators, by abusing the Twig content sandbox's allowlisted `addJs`/`addCss` methods on `Grav\Common\Assets`. The asset URL is concatenated directly into `<script src>` and `<link href>` tags in the document head without output escaping, and Grav's built-in XSS scanner cannot detect the payload because `addJs()` mutates the shared Assets service and returns only an object key - no inspectable markup is produced at scan time. Vendor-released patch Grav 2.0.20 is available; no public exploit has been identified at time of analysis.
Unauthenticated cross-site scripting in AVideo's YPTSocket plugin allows remote attackers to execute arbitrary JavaScript in the browsers of connected users by sending crafted WebSocket messages. The attack leverages the plugin's WebSocket callback dispatch mechanism, which resolves attacker-controlled callback names to global JavaScript functions (e.g., `avideoConfirmHTML`) that assign untrusted message data directly to `innerHTML` without sanitization. Because the exploit path runs entirely through the WebSocket layer, no authentication and no secondary victim interaction beyond holding an active session are required, enabling persistent script injection into any connected user's origin context.
Stored Cross-Site Scripting in the Pods - Custom Content Types and Fields WordPress plugin (all versions ≤ 3.3.9.1) allows contributor-level authenticated attackers to inject persistent malicious scripts via the 'not_found' shortcode attribute, executing in victim browsers on page load. The root cause is insufficient sanitization and output escaping in general.php (lines 1399, 2535, 2539) and PodsInit.php (line 514), as identified by Wordfence. No public exploit or KEV listing has been identified at time of analysis, but the contributor-level access bar is low on multi-author WordPress sites.
Stored XSS in the FooGallery WordPress plugin (all versions through 3.3.2) allows authenticated contributors to inject persistent JavaScript via the `custom_settings` shortcode attribute. The malicious payload executes in any visitor's browser when they access an affected page, enabling session hijacking, credential theft, or privilege escalation against higher-privileged users including site administrators. No public exploit code or CISA KEV listing has been identified, but the low privilege barrier - a contributor account - makes this realistically exploitable on sites with open or loosely managed contributor registration.
Reflected XSS in the Unlimited Elements For Elementor WordPress plugin (all versions through 2.0.17) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL containing a malicious payload in the `formData[id]` parameter. The plugin registers a front-end AJAX handler on the public WordPress `wp` action with no nonce, capability, or referer check; the attacker-controlled parameter value is interpolated verbatim into an exception message and echoed in the HTTP response without output escaping, and when the content-type resolves to text/html the browser parses and executes the injected markup. No public exploit has been identified at the time of analysis, though the unauthenticated network vector and low attack complexity make social-engineering delivery straightforward against WordPress sites running this plugin.
DOM-based stored Cross-Site Scripting in the Divi WordPress theme (all versions through 4.27.6) allows authenticated Contributor-level attackers to inject persistent arbitrary JavaScript via the `image_src` attribute of the `et_pb_video_slider_item` shortcode. The payload survives server-side sanitization because `esc_attr()` encodes double quotes as `"`, but jQuery's `.data('image')` call in `custom.unified.js` silently HTML-entity-decodes that value at runtime, and the decoded string is then concatenated into HTML and injected into the DOM via `jQuery.after()` with no further escaping. No public exploit or CISA KEV listing is identified; a patched release (4.27.7) is available per the Divi changelog.
Reflected XSS in Beaver Builder Plugin (Starter Version) for WordPress (all versions ≤2.11.0.1) permits unauthenticated attackers to inject arbitrary JavaScript via the unsanitized `no_results_message` parameter in the `node_preview` endpoint. Successful exploitation requires tricking a victim into clicking a crafted URL, after which the injected script executes in the victim's browser with access to session cookies, page DOM, and any credentials present in that context. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in the Joli Table Of Contents WordPress plugin (versions before 3.0.3) permits any user holding the Author role or higher to inject arbitrary HTML attributes and JavaScript via an unsanitized shortcode attribute, with the payload executing in the browser of any visitor - including administrators - who views the post. Because Authors in WordPress are explicitly barred from posting unfiltered HTML, this constitutes a privilege-boundary violation that can be leveraged to hijack administrator sessions or trigger privileged actions covertly. A public exploit is documented by WPScan; EPSS stands at 0.15% (5th percentile), indicating limited automated targeting, and no CISA KEV listing exists.
Stored XSS in CatFolders Document Gallery & PDF Library WordPress plugin before version 2.0.7 allows any user holding an Author account or higher to inject persistent malicious scripts via an unsanitized block attribute that is directly interpolated as an HTML tag name in gallery rendering output. Any visitor who views a post containing the crafted gallery block will execute the attacker's payload in their browser without additional interaction. No active exploitation has been confirmed in CISA KEV, but a publicly available proof-of-concept exists per WPScan disclosure, reducing the technical barrier for any authenticated attacker.
Stored XSS in VikWidgetsLoader WordPress plugin before 1.12.0 allows Contributor-role users to permanently embed arbitrary JavaScript into posts by supplying a malicious block attribute that is output unsanitized inside an inline script tag. When an administrator reviews the pending submission, the payload executes in their browser, enabling full session hijacking and site takeover without any further attacker interaction. A publicly available exploit exists (via WPScan), though EPSS is low (0.15%, 5th percentile) and SSVC records no confirmed exploitation at this time.
Stored cross-site scripting in King Addons for Elementor WordPress plugin before version 51.1.77 allows any Contributor-level (or higher) user to inject persistent JavaScript into a widget display-style setting that is written unescaped into an HTML attribute at render time. The payload fires in every visitor's browser upon page load - including logged-in administrators - enabling session hijacking, credential theft, or silent execution of privileged site actions. A publicly available proof-of-concept was disclosed via WPScan; no active exploitation is confirmed in the CISA KEV catalog at time of analysis.
Stored cross-site scripting in Bold Page Builder WordPress plugin (all versions before 5.9.8) allows authenticated Contributor-level users to inject persistent arbitrary JavaScript through unsanitized shortcode attribute values, which then execute in the browsers of any visitor rendering the affected page. A publicly available proof-of-concept exists via WPScan, and the vendor has released a patched version (5.9.8). Despite a low EPSS score (0.15%, 5th percentile), the public PoC and low privilege bar make this a realistic attack vector against sites with open contributor registration.
Stored cross-site scripting in the Bold Page Builder WordPress plugin before 5.9.8 allows authenticated users holding the Contributor role or higher to inject arbitrary JavaScript via a crafted link URL that bypasses the plugin's client-side filter. When a victim user subsequently clicks the malicious link rendered in the page builder output, the injected script executes in their browser session. A publicly available proof-of-concept exists per WPScan, though EPSS remains very low (0.15%), indicating limited observed exploitation despite public disclosure.