CWE-79 · Cross-site Scripting (page 32)
Page 32 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-34396 | Medium | 6.1 | 2026-03-31 | WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo admin panel renders plugin configuration values in HTML forms without appl… |
CVE-2026-34206 | Medium | 6.1 | 2026-03-31 | Captcha Protect is a Traefik middleware to add an anti-bot challenge to individual IPs in a subnet when traffic spikes are detected from that subnet. Prior to… |
CVE-2026-5209 | Low | 2.4 | 2026-03-31 | A security vulnerability has been detected in SourceCodester Leave Application System 1.0. Affected by this issue is some unknown functionality of the componen… |
CVE-2026-32607 | Medium | 5.4 | 2026-03-31 | Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to b… |
CVE-2026-32273 | Medium | 5.4 | 2026-03-31 | Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to b… |
CVE-2026-32243 | Medium | 5.4 | 2026-03-31 | Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to b… |
CVE-2025-62184 | Low | 3.4 | 2026-03-31 | Pega Platform versions 8.1.0 through 25.1.0 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. Requires an administrat… |
CVE-2026-34231 | Medium | 6.1 | 2026-03-31 | Slippers is a UI component framework for Django. Prior to version 0.6.3, a Cross-Site Scripting (XSS) vulnerability exists in the {% attrs %} template tag of t… |
CVE-2026-33276 | Medium | 5.4 | 2026-03-31 | Stored cross-site scripting (XSS) in Checkmk 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create hosts or services to execute arbi… |
CVE-2026-20915 | Medium | 5.4 | 2026-03-31 | Stored cross-site scripting (XSS) in Checkmk version 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create pending changes to inject… |
CVE-2026-4267 | High | 7.2 | 2026-03-31 | The Query Monitor – The developer tools panel for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘$_SERVER['REQUEST_URI… |
CVE-2026-34887 | Medium | 6.5 | 2026-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Kubio AI Page Builder allows Stored XSS.Thi… |
CVE-2026-3107 | Medium | 5.4 | 2026-03-31 | Stored Cross-Site Scripting (XSS) in Teampass versions prior to 3.1.5.16, affecting the password manager's password import functionality at the endpoint 'redac… |
CVE-2026-3106 | Medium | 5.4 | 2026-03-31 | Blind Cross-Site Scripting (XSS) in Teampass, versions prior to 3.1.5.16, within the password manager login functionality in the 'contraseña' parameter of the… |
CVE-2025-41357 | Medium | 6.1 | 2026-03-31 | Reflected Cross-Site Scripting (XSS) vulnerability in Anon Proxy Server v0.104. This vulnerability allows an attacker to execute JavaScript code in the victim'… |
CVE-2025-41356 | Medium | 6.1 | 2026-03-31 | Reflected Cross-Site Scripting (XSS) vulnerability in Anon Proxy Server v0.104. This vulnerability allows an attacker to execute JavaScript code in the victim'… |
CVE-2025-41355 | Medium | 6.1 | 2026-03-31 | Reflected Cross-Site Scripting (XSS) vulnerability in Anon Proxy Server v0.104. This vulnerability allows an attacker to execute JavaScript code in the victi… |
CVE-2025-10553 | High | 8.7 | 2026-03-31 | A Stored Cross-site Scripting (XSS) vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x thr… |
CVE-2025-10551 | High | 8.7 | 2026-03-31 | A Stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x thr… |
CVE-2026-1877 | Medium | 6.1 | 2026-03-31 | The Auto Post Scheduler plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.84. This is due to missing non… |
CVE-2026-4146 | Medium | 6.1 | 2026-03-31 | The Loco Translate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘update_href’ parameter in all versions up to, and including, 2… |
CVE-2026-4794 | Medium | 4.8 | 2026-03-31 | Multiple cross-site scripting (XSS) vulnerabilities in PaperCut NG/MF before 25.0.10 allow authenticated administrator users to inject arbitrary web script or… |
CVE-2026-32734 | High | 7.1 | 2026-03-31 | baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has DOM-based cross-site scripting in tag creation. This issue has been patched i… |
CVE-2026-30879 | Medium | 6.1 | 2026-03-31 | baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has a cross-site scripting vulnerability in blog posts. This issue has been patch… |
CVE-2026-5157 | Medium | 4.3 | 2026-03-31 | A vulnerability was identified in code-projects Online Food Ordering System 1.0. Affected is an unknown function of the file /form/order.php of the component O… |
CVE-2026-34558 | Critical | 9.1 | 2026-03-30 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version… |
CVE-2026-34557 | Critical | 9.1 | 2026-03-30 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version… |
CVE-2026-27599 | Medium | 4.7 | 2026-03-30 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version… |
CVE-2026-32275 | Critical | 9.1 | 2026-03-30 | Tautulli is a Python based monitoring and tracking tool for Plex Media Server. From version 1.3.10 to before version 2.17.0, an unsanitized JSONP callback para… |
CVE-2026-27508 | Medium | 5.4 | 2026-03-30 | Smoothwall Express versions prior to 3.1 Update 13 contain a reflected cross-site scripting vulnerability in the /redirect.cgi endpoint due to improper sanitat… |
CVE-2026-26352 | Medium | 5.4 | 2026-03-30 | Smoothwall Express versions prior to 3.1 Update 13 contain a stored cross-site scripting vulnerability in the /cgi-bin/vpnmain.cgi script due to improper sanit… |
CVE-2026-30562 | Critical | 9.3 | 2026-03-30 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located in the add_stock.php… |
CVE-2026-30561 | Medium | 6.1 | 2026-03-30 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located in the add_purchase… |
CVE-2026-30560 | Medium | 6.1 | 2026-03-30 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located in the add_supplier… |
CVE-2026-30559 | Medium | 6.1 | 2026-03-30 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located in the add_sales.php… |
CVE-2026-30558 | Medium | 6.1 | 2026-03-30 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located in the add_customer… |
CVE-2026-30557 | Medium | 6.1 | 2026-03-30 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located in the add_category… |
CVE-2026-30556 | Medium | 6.1 | 2026-03-30 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located in the index.php fil… |
CVE-2026-30566 | Medium | 6.1 | 2026-03-30 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located in the view_customer… |
CVE-2026-30565 | Medium | 6.1 | 2026-03-30 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located in the view_supplier… |
CVE-2026-30564 | Medium | 6.1 | 2026-03-30 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located in the view_payments… |
CVE-2026-30563 | Medium | 6.1 | 2026-03-30 | A Stored Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located in the update_details.p… |
CVE-2026-30082 | Medium | 6.1 | 2026-03-30 | Multiple stored cross-site scripting (XSS) vulnerabilities in the Edit feature of the Software Package List page of IngEstate Server v11.14.0 allow attackers t… |
CVE-2026-5106 | Low | 2.4 | 2026-03-30 | A flaw has been found in code-projects Exam Form Submission 1.0. The impacted element is an unknown function of the file /admin/update_fst.php. Executing a man… |
CVE-2026-2602 | Medium | 6.4 | 2026-03-29 | The Twentig plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'featuredImageSizeWidth' parameter in versions up to, and including, 1.9… |
CVE-2026-5015 | Medium | 4.3 | 2026-03-28 | A vulnerability was determined in elecV2 elecV2P up to 3.8.3. The impacted element is an unknown function of the file /logs of the component Endpoint. This man… |
CVE-2026-2595 | Medium | 5.4 | 2026-03-28 | The Quads Ads Manager for Google AdSense plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.98.1 due to in… |
CVE-2026-4995 | Low | 3.5 | 2026-03-28 | A vulnerability was determined in wandb OpenUI up to 1.0. Affected by this vulnerability is an unknown functionality of the file frontend/public/annotator/inde… |
CVE-2026-4992 | Medium | 4.3 | 2026-03-27 | A flaw has been found in wandb OpenUI up to 1.0. This affects the function create_share/get_share of the file backend/openui/server.py of the component HTMLAnn… |
CVE-2026-4991 | Low | 3.5 | 2026-03-27 | A vulnerability was detected in QDOCS Smart School Management System up to 7.2. The impacted element is an unknown function of the file /admin/enquiry of the c… |
CVE-2026-33979 | High | 8.2 | 2026-03-27 | Express XSS Sanitizer is Express 4.x and 5.x middleware which sanitizes user input data (in req.body, req.query, req.headers and req.params) to prevent Cross S… |
CVE-2026-33976 | Critical | 9.6 | 2026-03-27 | Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop and 3.3.17 on Android/iOS, a stored XSS in the Web Clipper rendering flow can be escalat… |
CVE-2026-33955 | High | 8.6 | 2026-03-27 | Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop, a cross-site scripting vulnerability stored in the note history comparison viewer can e… |
CVE-2026-33941 | High | 8.2 | 2026-03-27 | Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Handlebars CLI precompiler (`bin/handlebars… |
CVE-2026-33916 | Medium | 4.7 | 2026-03-27 | Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the Handlebars runtime re… |
CVE-2026-33883 | Medium | 6.1 | 2026-03-27 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the `user:reset_password_form` tag could render use… |
CVE-2026-4973 | Low | 3.5 | 2026-03-27 | A vulnerability was detected in SourceCodester Online Quiz System up to 1.0. Affected by this vulnerability is an unknown functionality of the file endpoint/ad… |
CVE-2026-4972 | Low | 2.4 | 2026-03-27 | A security vulnerability has been detected in code-projects Online Reviewer System up to 1.0. Affected is an unknown function of the file /system/system/studen… |
CVE-2026-33739 | Medium | 5.7 | 2026-03-27 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1812, the listing tables on multiple management pages (Host… |
CVE-2026-33045 | Medium | 5.4 | 2026-03-27 | Home Assistant is open source home automation software that puts local control and privacy first. Starting in version 2025.02 and prior to version 2026.01 the… |
CVE-2026-33044 | Medium | 5.4 | 2026-03-27 | Home Assistant is open source home automation software that puts local control and privacy first. Starting in version 2020.02 and prior to version 2026.01, an… |
CVE-2026-4969 | Low | 3.5 | 2026-03-27 | A vulnerability was identified in code-projects Social Networking Site 1.0. The impacted element is an unknown function of the file /home.php of the component… |
CVE-2026-34375 | High | 8.2 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the YPTWallet Stripe payment confirmation page directly echoes the `$_REQUE… |
CVE-2026-30568 | Medium | 4.8 | 2026-03-27 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0 in in the view_purchase.php file via the "limit" p… |
CVE-2026-30567 | Medium | 6.1 | 2026-03-27 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0 in the view_product.php file via the "limit" param… |
CVE-2026-30571 | Medium | 6.1 | 2026-03-27 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0 in the view_category.php file via the "limit" para… |
CVE-2026-30570 | Medium | 6.1 | 2026-03-27 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0 in the view_sales.php file via the "limit" paramet… |
CVE-2026-30569 | Medium | 6.1 | 2026-03-27 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located in the view_stock_av… |
CVE-2026-30527 | Medium | 5.4 | 2026-03-27 | A Stored Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Category management module within the admin… |
CVE-2026-5026 | Medium | 5.4 | 2026-03-27 | The '/api/v1/files/images/{flow_id}/{file_name}' endpoint serves SVG files with the 'image/svg+xml' content type without sanitizing their content. Since SVG f… |
CVE-2026-5010 | | 2026-03-27 | A reflected Cross-Site Scripting (XSS) vulnerability has been discovered in Clickedu. This vulnerability allows an attacker to execute JavaScript code in the v… | |
CVE-2026-33758 | Medium | 6.1 | 2026-03-27 | OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method e… |
CVE-2025-61190 | Medium | 6.1 | 2026-03-27 | A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in DSpace JSPUI 6.5 within the search/discover filtering functionality. The vulnerabil… |
CVE-2026-32859 | Medium | 5.4 | 2026-03-27 | ByteDance DeerFlow versions prior to commit 5dbb362 contain a stored cross-site scripting vulnerability in the artifacts API that allows attackers to execute a… |
CVE-2026-25100 | Medium | 5.4 | 2026-03-27 | Bludit is vulnerable to Stored Cross-Site Scripting (XSS) in its image upload functionality. An authenticated attacker with content upload privileges (such as… |
CVE-2026-3457 | | 2026-03-27 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Thales Sentinel LDK Runtime on Windows allows Stor… | |
CVE-2026-33559 | Medium | 5.4 | 2026-03-27 | WordPress Plugin "OpenStreetMap" provided by MiKa contains a cross-site scripting vulnerability. On the site with the affected version of the plugin enabled, a… |
CVE-2026-4909 | Low | 2.4 | 2026-03-27 | A weakness has been identified in code-projects Exam Form Submission 1.0. This impacts an unknown function of the file /admin/update_s7.php. This manipulation… |
CVE-2026-4899 | Low | 2.4 | 2026-03-26 | A security flaw has been discovered in code-projects Online Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file /dbfood/… |
CVE-2026-4898 | Medium | 4.3 | 2026-03-26 | A vulnerability was identified in code-projects Online Food Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /dbfood… |
CVE-2026-33673 | High | 7.6 | 2026-03-26 | PrestaShop is an open source e-commerce web application. Versions prior to 8.2.5 and 9.1.0 are vulnerable to stored Cross-Site Scripting (stored XSS) vulnerabi… |
CVE-2026-33664 | High | 7.3 | 2026-03-26 | Kestra is an open-source, event-driven orchestration platform Versions up to and including 1.3.3 render user-supplied flow YAML metadata fields — description… |
CVE-2026-33653 | Medium | 4.6 | 2026-03-26 | Ulloady is a file uploader script with multi-file upload support. A Stored Cross-Site Scripting (XSS) vulnerability exists in versions prior to 3.1.2 due to im… |
CVE-2026-3529 | Medium | 6.1 | 2026-03-26 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Google Analytics GA4 allows Cross-Site Scripting (… |
CVE-2026-3528 | Medium | 6.1 | 2026-03-26 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Calculation Fields allows Cross-Site Scripting (XS… |
CVE-2026-33742 | Medium | 5.4 | 2026-03-26 | Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Product notes fields in Invoice Ninja v5.13.0 allow raw H… |
CVE-2026-33738 | Medium | 5.4 | 2026-03-26 | Lychee is a free, open-source photo-management tool. Prior to version 7.5.3, the photo `description` field is stored without HTML sanitization and rendered usi… |
CVE-2026-33628 | Medium | 5.4 | 2026-03-26 | Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Invoice line item descriptions in Invoice Ninja v5.13.0 b… |
CVE-2026-33525 | Medium | 6.1 | 2026-03-26 | Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web port… |
CVE-2026-29969 | Medium | 6.1 | 2026-03-26 | A cross-site scripting (XSS) vulnerability in the wff_cols_pref.css.aspx endpoint of staffwiki v7.0.1.19219 allows attackers to execute arbitrary Javascript in… |
CVE-2026-34071 | Medium | 5.4 | 2026-03-26 | Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. In version 2.7.3, the /api/v1/convert/eml/pdf endp… |
CVE-2026-33402 | Medium | 6.1 | 2026-03-26 | Sakai is a Collaboration and Learning Environment (CLE). In versions 23.0 through 23.4 and 25.0 through 25.1, group titles and description can contain cross-si… |
CVE-2026-30162 | Medium | 6.1 | 2026-03-26 | Cross Site Scripting (xss) vulnerability in Timo 2.0.3 via crafted links in the title field. |
CVE-2026-29934 | Medium | 6.1 | 2026-03-26 | A reflected cross-site scripting (XSS) vulnerability in the /admin/menus component of Lightcms v2.0 allows attackers to execute arbitrary Javascript in the con… |
CVE-2026-29933 | Medium | 6.1 | 2026-03-26 | A reflected cross-site scripting (XSS) vulnerability in the /index/login.html component of YZMCMS v7.4 allows attackers to execute arbitrary Javascript in the… |
CVE-2026-28298 | Medium | 5.9 | 2026-03-26 | SolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended scri… |
CVE-2026-28297 | Medium | 6.1 | 2026-03-26 | SolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended scri… |
CVE-2026-4877 | Medium | 4.3 | 2026-03-26 | A security flaw has been discovered in itsourcecode Payroll Management System up to 1.0. This affects an unknown function of the file /index.php. Performing a… |
CVE-2026-2389 | Medium | 4.9 | 2026-03-26 | The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 7.4.4.2. This… |
CVE-2026-2231 | High | 7.2 | 2026-03-26 | The Fluent Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in all versions up to, and including, 2.0.01 due t… |