CWE-79 · Cross-site Scripting (page 36)
Page 36 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-4225 | Low | 2.4 | 2026-03-16 | A security flaw has been discovered in CMS Made Simple up to 2.2.21. Impacted is an unknown function of the file admin/listusers.php of the component User Mana… |
CVE-2026-4186 | Low | 3.5 | 2026-03-16 | A vulnerability was determined in UEditor up to 1.4.3.2. This issue affects some unknown processing of the file php/controller.php?action=uploadimage of the co… |
CVE-2026-4175 | Low | 3.5 | 2026-03-16 | A vulnerability was determined in Aureus ERP up to 1.3.0-BETA2. The affected element is an unknown function of the file plugins/webkul/chatter/resources/views/… |
CVE-2026-4169 | Low | 2.4 | 2026-03-16 | A security flaw has been discovered in Tecnick TCExam up to 16.6.0. Affected is the function F_xml_export_users of the file admin/code/tce_xml_users.php of the… |
CVE-2026-4168 | Low | 2.4 | 2026-03-16 | A vulnerability was identified in Tecnick TCExam 16.5.0. This impacts an unknown function of the file /admin/code/tce_edit_group.php of the component Group Han… |
CVE-2026-4166 | Low | 3.5 | 2026-03-16 | A vulnerability was found in Wavlink WL-NU516U1 240425. The impacted element is the function sub_404F68 of the file /cgi-bin/login.cgi. The manipulation of the… |
CVE-2026-4165 | Low | 2.4 | 2026-03-16 | A vulnerability has been found in Worksuite HR, CRM and Project Management up to 5.5.25. The affected element is an unknown function of the file /account/order… |
CVE-2026-3024 | Medium | 5.4 | 2026-03-16 | Stored Cross-Site Scripting (XSS) vulnerability in the Wakyma web application, specifically in the endpoint 'vets.wakyma.com/configuracion/agenda/modelo-formul… |
CVE-2026-32774 | Medium | 6.4 | 2026-03-16 | Vulnogram 1.0.0 contains a stored cross-site scripting vulnerability in comment hypertext handling that allows attackers to inject malicious scripts. Remote at… |
CVE-2026-32635 | Critical | 9.0 | 2026-03-16 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21… |
CVE-2026-32626 | Critical | 9.6 | 2026-03-16 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, AnythingLLM… |
CVE-2025-69245 | Medium | 6.1 | 2026-03-16 | Raytha CMS is vulnerable to Reflected XSS via returnUrl parameter in logon functionality. An attacker can craft a malicious URL which, when opened by the authe… |
CVE-2025-69242 | Medium | 6.1 | 2026-03-16 | Raytha CMS is vulnerable to reflected XSS via the backToListUrl parameter. An attacker can craft a malicious URL which, when opened by authenticated victim, re… |
CVE-2025-69241 | Medium | 5.4 | 2026-03-16 | Raytha CMS is vulnerable to Stored XSS via FirstName and LastName parameters in profile editing functionality. Authenticated attacker can inject arbitrary HTML… |
CVE-2025-69237 | Medium | 5.4 | 2026-03-16 | Raytha CMS is vulnerable to Stored XSS via FieldValues[0].Value parameter in page creation functionality. Authenticated attacker with permissions to create con… |
CVE-2025-69236 | Medium | 5.4 | 2026-03-16 | Raytha CMS is vulnerable to Stored XSS via FieldValues[1].Value parameter in post editing functionality. Authenticated attacker with permissions to edit posts… |
CVE-2017-20219 | Medium | 6.1 | 2026-03-16 | Serviio PRO 1.8 DLNA Media Streaming Server contains a DOM-based cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script… |
CVE-2016-20036 | Medium | 6.1 | 2026-03-16 | Wowza Streaming Engine 4.5.0 contains multiple reflected cross-site scripting vulnerabilities in the enginemanager interface where input passed through various… |
CVE-2016-20032 | High | 7.2 | 2026-03-16 | ZKTeco ZKAccess Security System 5.3.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by i… |
CVE-2016-20027 | Medium | 6.1 | 2026-03-16 | ZKTeco ZKBioSecurity 3.0 contains multiple reflected cross-site scripting vulnerabilities that allow attackers to execute arbitrary HTML and script code by inj… |
CVE-2015-20119 | Medium | 6.4 | 2026-03-16 | Next Click Ventures RealtyScript 4.0.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious HTML and if… |
CVE-2015-20118 | High | 7.2 | 2026-03-16 | Next Click Ventures RealtyScript 4.0.2 contains a stored cross-site scripting vulnerability in the location_name parameter of the admin locations interface. At… |
CVE-2015-20116 | Medium | 6.1 | 2026-03-16 | Next Click Ventures RealtyScript 4.0.2 fails to properly sanitize CSV file uploads, allowing attackers to inject malicious scripts through filename parameters… |
CVE-2015-20115 | High | 7.2 | 2026-03-16 | Next Click Ventures RealtyScript 4.0.2 fails to properly sanitize file uploads, allowing attackers to store malicious scripts through the file POST parameter i… |
CVE-2015-20114 | Medium | 6.1 | 2026-03-16 | Next Click Ventures RealtyScript 4.0.2 contains a cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by injecti… |
CVE-2013-20006 | High | 7.5 | 2026-03-16 | Qool CMS contains multiple persistent cross-site scripting vulnerabilities in several administrative scripts where POST parameters are not properly sanitized b… |
CVE-2013-20005 | Medium | 5.3 | 2026-03-16 | Qool CMS 2.0 RC2 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by tricking logged-in users into v… |
CVE-2026-3986 | Medium | 6.4 | 2026-03-13 | The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form settings in all versions up to, and including, 5.4.5… |
CVE-2026-32612 | Medium | 5.4 | 2026-03-13 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 6.6.2, stored XSS in the control panel color mode preference allows authenticat… |
CVE-2026-32462 | Medium | 5.9 | 2026-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liton Arefin Master Addons for Elementor master-addons al… |
CVE-2026-32460 | Medium | 6.5 | 2026-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Ultimate Addons for Contact Form 7 ultimate-addo… |
CVE-2026-32455 | Medium | 6.5 | 2026-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter a… |
CVE-2026-32454 | Medium | 6.5 | 2026-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Avada Core fusion-core allows DOM-Based XSS.T… |
CVE-2026-32450 | Medium | 6.5 | 2026-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-… |
CVE-2026-32449 | Medium | 6.5 | 2026-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Event Post themify-event-post allows St… |
CVE-2026-32448 | Medium | 6.5 | 2026-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eric Teubert Podlove Podcast Publisher podlove-podcasting… |
CVE-2026-32431 | Medium | 6.5 | 2026-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Astra Bulk Edit astra-bulk-edit allows D… |
CVE-2026-32430 | Medium | 6.5 | 2026-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpac… |
CVE-2026-32429 | Medium | 6.5 | 2026-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Magical Addons For Elementor magical-addons-for… |
CVE-2026-32424 | Medium | 6.5 | 2026-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Sprout Clients sprout-clients allows Stored XSS… |
CVE-2026-32419 | Medium | 5.9 | 2026-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fernando Briano List category posts list-category-posts a… |
CVE-2026-32411 | Medium | 6.5 | 2026-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simpma Embed Calendly embed-calendly-scheduling allows St… |
CVE-2026-32403 | Medium | 6.5 | 2026-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in toocheke Toocheke Companion toocheke-companion allows DOM… |
CVE-2026-32361 | Medium | 6.5 | 2026-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marketing Fire Editorial Calendar editorial-calendar allo… |
CVE-2026-32360 | Medium | 5.9 | 2026-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in richplugins Rich Showcase for Google Reviews widget-googl… |
CVE-2026-32359 | Medium | 6.5 | 2026-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Icon List Block icon-list-block allows Stored XS… |
CVE-2026-32356 | Medium | 6.5 | 2026-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robosoft Robo Gallery robo-gallery allows DOM-Based XSS.T… |
CVE-2026-32352 | Medium | 6.5 | 2026-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows DOM-… |
CVE-2026-32351 | Medium | 5.9 | 2026-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in blubrry PowerPress Podcasting powerpress allows Stored XS… |
CVE-2026-32308 | High | 7.6 | 2026-03-13 | OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the Markdown viewer component renders Mermaid diagrams with securityLeve… |
CVE-2026-31918 | Medium | 6.5 | 2026-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in immonex immonex Kickstart immonex-kickstart allows Stored… |
CVE-2026-22210 | Medium | 4.4 | 2026-03-13 | wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through unescaped attachment URLs in HTML o… |
CVE-2026-22209 | Medium | 5.5 | 2026-03-13 | wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability in the customCss field that allows administrators to inject malicious scripts by breaking… |
CVE-2026-22183 | Medium | 6.1 | 2026-03-13 | wpDiscuz before 7.6.47 contains a stored cross-site scripting vulnerability in the inline comment preview functionality that allows authenticated users to inje… |
CVE-2026-0835 | Medium | 5.4 | 2026-03-13 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, and 6.2.2.0 are vuln… |
CVE-2025-14504 | Medium | 5.4 | 2026-03-13 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, and 6.2.2.0 is vulne… |
CVE-2025-13702 | Medium | 6.1 | 2026-03-13 | IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 is vulnerable to cross-site scripting. This vulnerability allows an… |
CVE-2025-12454 | Medium | 6.1 | 2026-03-13 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText™ Vertica allows Reflected XSS. The vulnerabilit… |
CVE-2025-12453 | Medium | 6.1 | 2026-03-13 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText™ Vertica allows Reflected XSS. The vulnerabilit… |
CVE-2023-40693 | Medium | 5.4 | 2026-03-13 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, and 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1 are vulnerable to… |
CVE-2026-32139 | Medium | 5.4 | 2026-03-12 | Dataease is an open source data visualization analysis tool. In DataEase 2.10.19 and earlier, the static resource upload interface allows SVG uploads. However… |
CVE-2026-31873 | Unrated | | 2026-03-12 | Unhead is a document head and template manager. Prior to 2.1.11, The link.href check in makeTagSafe (safe.ts) uses String.includes(), which is case-sensitive… |
CVE-2026-31860 | Medium | 6.1 | 2026-03-12 | Unhead is a document head and template manager. Prior to 2.1.11, useHeadSafe() can be bypassed to inject arbitrary HTML attributes, including event handlers, i… |
CVE-2026-25529 | High | 8.1 | 2026-03-12 | Postal is an open source SMTP server. Postal versions less than 3.3.5 had a HTML injection vulnerability that allowed unescaped data to be included in the admi… |
CVE-2026-2987 | Medium | 6.1 | 2026-03-12 | The Simple Ajax Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'c' parameter in versions up to, and including, 20260217 due to… |
CVE-2026-2514 | | 2026-03-12 | In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, a vulnerability exists whereby an adversary with access to Flowmon monitoring ports may craft mali… | |
CVE-2026-2513 | | 2026-03-12 | A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, whereby an administrator who clicks a malicious link provided by an attacke… | |
CVE-2026-3993 | Medium | 4.3 | 2026-03-12 | A security vulnerability has been detected in itsourcecode Payroll Management System 1.0. This vulnerability affects unknown code of the file /manage_employee_… |
CVE-2026-3990 | Medium | 4.3 | 2026-03-12 | A security flaw has been discovered in CesiumGS CesiumJS up to 1.137.0. Affected by this issue is some unknown functionality of the file Apps/Sandcastle/standa… |
CVE-2026-3984 | Low | 3.5 | 2026-03-12 | A weakness has been identified in Campcodes Division Regional Athletic Meet Game Result Matrix System 2.1. This vulnerability affects unknown code of the file… |
CVE-2026-3983 | Low | 3.5 | 2026-03-12 | A security flaw has been discovered in Campcodes Division Regional Athletic Meet Game Result Matrix System 2.1. This affects an unknown part of the file save-g… |
CVE-2026-2687 | Medium | 4.3 | 2026-03-12 | The Reading progressbar WordPress plugin before 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2026-3982 | Medium | 4.3 | 2026-03-12 | A vulnerability was determined in itsourcecode University Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /view_r… |
CVE-2026-3962 | Medium | 4.3 | 2026-03-11 | A vulnerability was identified in Jcharis Machine-Learning-Web-Apps up to a6996b634d98ccec4701ac8934016e8175b60eb5. The impacted element is the function render… |
CVE-2026-32117 | High | 7.6 | 2026-03-11 | The grafanacubism-panel plugin allows use of cubism.js in Grafana. In 0.1.2 and earlier, the panel's zoom-link handler passes a dashboard-editor-supplied URL d… |
CVE-2026-32125 | Medium | 5.4 | 2026-03-11 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, track/item names from the Track Anyt… |
CVE-2026-32124 | Medium | 5.4 | 2026-03-11 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, the dynamic code picker AJAX endpoin… |
CVE-2026-32121 | High | 7.7 | 2026-03-11 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, Stored XSS in prescription CSS/HTML… |
CVE-2026-32118 | Medium | 5.4 | 2026-03-11 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, stored cross-site scripting (XSS) in… |
CVE-2026-32112 | Medium | 6.8 | 2026-03-11 | ha-mcp is a Home Assistant MCP Server. Prior to 7.0.0, the ha-mcp OAuth consent form renders user-controlled parameters via Python f-strings with no HTML escap… |
CVE-2026-32109 | Low | 3.7 | 2026-03-11 | Copyparty is a portable file server. Prior to 1.20.12, if an attacker has been given both read- and write-permissions to the server, they can upload a maliciou… |
CVE-2026-3951 | Medium | 4.3 | 2026-03-11 | A security flaw has been discovered in LockerProject Locker 0.0.0/0.0.1/0.1.0. Affected is the function authIsAwesome of the file source-code/Locker-master/Ops… |
CVE-2026-32095 | Medium | 5.4 | 2026-03-11 | Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.1, Plunk's image upload endpoint accepted SVG files, which browsers treat as activ… |
CVE-2026-31879 | Medium | 5.4 | 2026-03-11 | Frappe is a full-stack web application framework. Prior to 14.100.2, 15.101.0, and 16.10.0, due to a lack of validation and improper permission checks, users c… |
CVE-2026-31876 | Medium | 5.4 | 2026-03-11 | Notesnook is a note-taking app focused on user privacy & ease of use. Prior to 3.3.9, a Stored Cross-Site Scripting (XSS) vulnerability existed in Notesnook's… |
CVE-2026-31868 | Medium | 6.1 | 2026-03-11 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.4 and 8.6.30, an attacker can uplo… |
CVE-2026-31859 | Medium | 6.1 | 2026-03-11 | Craft is a content management system (CMS). The fix for CVE-2025-35939 in craftcms/cms introduced a strip_tags() call in src/web/User.php to sanitize return UR… |
CVE-2026-30235 | Medium | 6.5 | 2026-03-11 | OpenProject is an open-source, web-based project management software. Prior to 17.2.0, this vulnerability occurs due to improper validation of OpenProject’s Ma… |
CVE-2026-20162 | Medium | 6.3 | 2026-03-11 | In Splunk Enterprise versions below 10.2.0, 10.0.3, 9.4.9, and 9.3.9, and Splunk Cloud Platform versions below 10.2.2510.4, 10.1.2507.15, 10.0.2503.11, and 9.3… |
CVE-2026-20117 | Medium | 6.1 | 2026-03-11 | A vulnerability in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to… |
CVE-2026-20116 | Medium | 6.1 | 2026-03-11 | A vulnerability in the web-based management interface of Cisco Finesse, Cisco Packaged Contact Center Enterprise (Packaged CCE), Cisco Unified Contact Ce… |
CVE-2026-1090 | High | 8.7 | 2026-03-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allow… |
CVE-2026-3946 | Low | 3.5 | 2026-03-11 | A vulnerability was detected in PHPEMS 11.0. The affected element is an unknown function of the file /index.php?ask=app-ask. Performing a manipulation of the a… |
CVE-2026-3178 | High | 7.2 | 2026-03-11 | The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name_directory_name' parameter in all versions up to, and includi… |
CVE-2026-3492 | Medium | 6.4 | 2026-03-11 | The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.9.28.1. This is due to a compound f… |
CVE-2026-3231 | High | 7.2 | 2026-03-11 | The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom radio and checkboxgro… |
CVE-2026-1454 | High | 7.2 | 2026-03-11 | The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and inclu… |
CVE-2026-3825 | Medium | 6.1 | 2026-03-11 | IFTOP developed by WellChoose has a Reflected Cross-site Scripting vulnerability, allowing authenticated remote attackers to execute arbitrary JavaScript codes… |
CVE-2026-3534 | Medium | 6.4 | 2026-03-11 | The Astra theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `ast-page-background-meta` and `ast-content-background-meta` post meta field… |
CVE-2026-3884 | Medium | 6.1 | 2026-03-11 | Versions of the package spin.js before 3.0.0 are vulnerable to Cross-site Scripting (XSS) via the spin() function that allows a creation of more than 1 alert f… |