CWE-79 · Cross-site Scripting (page 39)
Page 39 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-26272 | Medium | 4.6 | 2026-03-03 | HomeBox is a home inventory and organization system. Prior to 0.24.0-rc.1, a stored cross-site scripting (XSS) vulnerability exists in the item attachment uplo… |
CVE-2026-26266 | Critical | 9.3 | 2026-03-03 | AliasVault is a privacy-first password manager with built-in email aliasing. A stored cross-site scripting (XSS) vulnerability was identified in the email rend… |
CVE-2026-25590 | Medium | 4.5 | 2026-03-03 | The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Prior to 1.6.6, there is a reflected… |
CVE-2026-24415 | Medium | 6.1 | 2026-03-03 | OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contains Reflected XSS vulnerabi… |
CVE-2026-21866 | Medium | 5.4 | 2026-03-03 | Dify is an open-source LLM app development platform. Prior to 1.11.2, Dify is vulnerable to a stored XSS issue when rendering Mermaid diagrams within chats. Th… |
CVE-2026-0540 | Medium | 6.1 | 2026-03-03 | DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass at… |
CVE-2025-15599 | Medium | 6.1 | 2026-03-03 | DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by ex… |
CVE-2021-35483 | Medium | 4.1 | 2026-03-03 | The Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to arbitrarily upload JavaScript files via… |
CVE-2026-3343 | Medium | 6.1 | 2026-03-03 | A reflected cross-site scripting (XSS) vulnerability in the Fireware OS Web UI enabled execution of malicious JavaScript in the context of an authenticated man… |
CVE-2026-2568 | High | 7.2 | 2026-03-03 | The WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form su… |
CVE-2026-3455 | Medium | 6.1 | 2026-03-03 | Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the improper sanitisation of… |
CVE-2026-2583 | Medium | 6.4 | 2026-03-02 | The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `blocksy_meta` metadata fields in all versions up to, and including, 2.1.3… |
CVE-2026-28401 | Medium | 5.4 | 2026-03-02 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, rich text cell content rendered via v-html without sanitization enables st… |
CVE-2026-28398 | Medium | 5.4 | 2026-03-02 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, user-controlled content in comments and rich text cells was rendered via v… |
CVE-2026-28397 | Medium | 5.4 | 2026-03-02 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, comments rendered via v-html without sanitization enable stored XSS. This… |
CVE-2026-28359 | Medium | 5.4 | 2026-03-02 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Editor role can inject arbitrary HTML into Rich… |
CVE-2026-28357 | Medium | 5.4 | 2026-03-02 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, a stored XSS vulnerability exists in the Formula virtual cell. Formula res… |
CVE-2025-66880 | Medium | 6.1 | 2026-03-02 | Cross Site Scripting vulnerability in Wethink Technology Inc 720yun pano-sdk 0.5.877 allows a remote attacker to execute arbitrary code via the LoginComp (Modu… |
CVE-2025-52563 | Medium | 6.1 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is a reflected cross-site scripting (XSS) vulnerability due to insufficient sanitizati… |
CVE-2025-52476 | Medium | 6.1 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is a reflected cross-site scripting (XSS) vulnerability due to improper sanitization o… |
CVE-2025-52475 | Medium | 6.1 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is a reflected cross-site scripting (XSS) vulnerability in the admin/user_list.php end… |
CVE-2025-52470 | Medium | 4.8 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, a stored cross-site scripting (XSS) vulnerability exists in the session_category_add.php scr… |
CVE-2025-52468 | High | 8.8 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, an input validation vulnerability exists when importing user data from CSV files. This flaw… |
CVE-2025-65465 | Medium | 6.1 | 2026-03-02 | A reflected Cross-Site Scripting (XSS) vulnerability in the RaiseError function of Skrol29 TbsZip version 2.17 and earlier allows remote attackers to execute a… |
CVE-2025-52482 | High | 8.3 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, a Stored XSS vulnerability exists in the glossary function, enabling all users with the Teac… |
CVE-2025-50186 | Medium | 4.8 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, a stored cross-site scripting (XSS) vulnerability exists due to insufficient sanitization of… |
CVE-2026-3412 | Medium | 4.3 | 2026-03-02 | A vulnerability was detected in itsourcecode University Management System 1.0. This affects an unknown part of the file /att_single_view.php. The manipulation… |
CVE-2026-3403 | Low | 2.4 | 2026-03-02 | A vulnerability was detected in PHPGurukul Student Record Management System 1.0. This issue affects some unknown processing of the file /edit-subject.php. Perf… |
CVE-2026-3402 | Low | 2.4 | 2026-03-02 | A security vulnerability has been detected in PHPGurukul Student Record Management System up to 1.0. This vulnerability affects unknown code of the file /edit-… |
CVE-2026-28561 | Medium | 5.5 | 2026-02-28 | wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows administrators to inject persistent JavaScript via forum description field… |
CVE-2026-28560 | Medium | 5.5 | 2026-02-28 | wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injection via forum URL data output into an inline script block usi… |
CVE-2026-28558 | Medium | 6.4 | 2026-02-28 | wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows authenticated subscribers to upload SVG files as profile avatars through t… |
CVE-2026-3010 | Medium | 6.1 | 2026-02-28 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimePictra allows Query System for Infor… |
CVE-2026-28426 | High | 8.7 | 2026-02-27 | Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, stored XSS vulnerability in svg and icon related c… |
CVE-2026-28355 | | 2026-02-27 | Canarytokens help track activity and actions on a network. Versions prior to `sha-7ff0e12` have a Self Cross-Site Scripting vulnerability in the "PWA" Canaryto… | |
CVE-2026-28338 | Medium | 6.8 | 2026-02-27 | PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's `vbhtml` and `yahtml` report formats insert rule violation messages int… |
CVE-2026-28272 | High | 8.1 | 2026-02-27 | Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks Email Protection Gateway allows authenticated administrators to… |
CVE-2026-26997 | Medium | 5.4 | 2026-02-27 | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 #59, a normal authenticated user can store the XSS payload. The payload is trigg… |
CVE-2026-27756 | Medium | 6.1 | 2026-02-27 | SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a reflected cross-site scripting vulnerability in the management interface where user input… |
CVE-2026-26862 | High | 8.3 | 2026-02-27 | CleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage in the Visual Builder module. The ori… |
CVE-2025-69437 | High | 8.7 | 2026-02-27 | PublicCMS v5.202506.d and earlier is vulnerable to stored XSS. Uploaded PDFs can contain JavaScript payloads and bypass PDF security checks in the backend CmsF… |
CVE-2026-3327 | | 2026-02-27 | Authenticated Iframe Injection in Dato CMS Web Previews plugin. This vulnerability permits a malicious authenticated user to circumvent the restriction enforce… | |
CVE-2025-11950 | Medium | 6.3 | 2026-02-27 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in KNOWHY Advanced Technology Trading Ltd. Co. EduAsi… |
CVE-2026-24351 | Medium | 5.4 | 2026-02-27 | PluXml CMS is vulnerable to Stored XSS in Static Pages editing functionality. Attacker with editing privileges can inject arbitrary HTML and JS into website, w… |
CVE-2026-24350 | Medium | 5.4 | 2026-02-27 | PluXml CMS is vulnerable to Stored XSS in file uploading functionality. An authenticated attacker can upload an SVG file containing a malicious payload, which… |
CVE-2026-1434 | Medium | 6.1 | 2026-02-27 | Omega-PSIR is vulnerable to Reflected XSS via the lang parameter. An attacker can craft a malicious URL that, when opened, causes arbitrary JavaScript to execu… |
CVE-2025-14142 | Medium | 6.4 | 2026-02-27 | The Electric Enquiries plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button' parameter of the electric-enquiry shortcode in all ve… |
CVE-2026-2383 | Medium | 6.4 | 2026-02-27 | The Simple Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom field in all versions up to, and including, 4.0.5 due… |
CVE-2026-2362 | Medium | 6.4 | 2026-02-27 | The WP Accessibility plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'alt' attribute of images processed by the "Long Descr… |
CVE-2026-3302 | Medium | 4.3 | 2026-02-27 | A weakness has been identified in SourceCodester Doctor Appointment System 1.0. Affected by this issue is some unknown functionality of the file /register.php… |
CVE-2025-14149 | Medium | 6.4 | 2026-02-27 | The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Scroller widget box link… |
CVE-2025-14040 | Medium | 6.4 | 2026-02-27 | The Automotive Car Dealership Business WordPress Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Call to Action' custom fields in all… |
CVE-2026-28280 | Medium | 6.1 | 2026-02-26 | osctrl is an osquery management solution. Prior to version 0.5.0, a stored cross-site scripting (XSS) vulnerability exists in the `osctrl-admin` on-demand quer… |
CVE-2026-28274 | High | 8.7 | 2026-02-26 | Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 are vulnerable to Stored Cross-Site Scripting (XSS) in the… |
CVE-2026-27154 | Medium | 6.1 | 2026-02-26 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, a user full name can be evaluated as raw HTML when the fo… |
CVE-2025-56605 | Medium | 5.4 | 2026-02-26 | A reflected Cross-Site Scripting (XSS) vulnerability exists in the register.php backend script of PuneethReddyHC Event Management System 1.0. The mobile POST p… |
CVE-2026-2680 | Medium | 6.1 | 2026-02-26 | Reflected Cross-Site Scripting (XSS) on the A3factura web platform, in parameter 'customerVATNumber', in 'a3factura-app.wolterskluwer.es/#/incomes/salesDeliver… |
CVE-2026-2679 | Medium | 6.1 | 2026-02-26 | Reflected Cross-Site Scripting (XSS) on the A3factura web platform, in parameter 'customerName', in 'a3factura-app.wolterskluwer.es/#/incomes/salesInvoices' en… |
CVE-2026-2678 | Medium | 6.1 | 2026-02-26 | Reflected Cross-Site Scripting (XSS) on the A3factura web platform, in parameter 'name', parameter 'name', in 'a3factura-app.wolterskluwer.es/#/incomes/custome… |
CVE-2026-2677 | Medium | 6.1 | 2026-02-26 | Reflected Cross-Site Scripting (XSS) on the A3factura web platform, in parameter 'name', in 'a3factura-app.wolterskluwer.es/#/incomes/representatives-managemen… |
CVE-2025-14343 | High | 7.6 | 2026-02-26 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dokuzsoft Technology Ltd. E-Commerce Product allow… |
CVE-2025-64999 | Medium | 5.4 | 2026-02-26 | Improper neutralization of input in Checkmk versions 2.4.0 before 2.4.0p22, and 2.3.0 before 2.3.0p43 allows an attacker that can manipulate a host's check out… |
CVE-2026-28083 | Medium | 6.5 | 2026-02-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UX-themes Flatsome flatsome allows Stored XSS.This issue… |
CVE-2026-1696 | Medium | 6.1 | 2026-02-26 | Some HTTP security headers are not properly set by the web server when sending responses to the client application. |
CVE-2026-1695 | Medium | 6.1 | 2026-02-26 | An XSS vulnerability affects the OAuth web services used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 i… |
CVE-2026-27974 | Medium | 4.8 | 2026-02-26 | Audiobookshelf is a self-hosted audiobook and podcast server. A cross-site scripting (XSS) vulnerability exists in versions prior to 0.12.0-beta of the Audiobo… |
CVE-2026-27963 | Medium | 4.8 | 2026-02-26 | Audiobookshelf is a self-hosted audiobook and podcast server. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.32.0 of the Audio… |
CVE-2026-2506 | Medium | 6.1 | 2026-02-26 | The EM Cost Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.3.1. This is due to the plugin sto… |
CVE-2026-2499 | Medium | 4.4 | 2026-02-26 | The Custom Logo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.2 due to insuffici… |
CVE-2026-2498 | Medium | 4.4 | 2026-02-26 | The WP Social Meta plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.1 due to insu… |
CVE-2026-2489 | Medium | 4.4 | 2026-02-26 | The TP2WP Importer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Watched domains' textarea on the attachment importer settings pag… |
CVE-2026-2029 | Medium | 6.4 | 2026-02-26 | The Livemesh Addons for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `[labb_pricing_item]` shortcode's `title` and… |
CVE-2026-27973 | Medium | 4.0 | 2026-02-26 | Audiobookshelf is a self-hosted audiobook and podcast server. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 0.12.0-beta of the… |
CVE-2026-27970 | Medium | 6.1 | 2026-02-26 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Versions prior to 21.2.0, 2… |
CVE-2026-27948 | Medium | 5.4 | 2026-02-26 | Copyparty is a portable file server. In versions prior to 1.20.9, an XSS allows for reflected cross-site scripting via URL-parameter `?setck=...`. Version 1.20… |
CVE-2026-27902 | Medium | 5.4 | 2026-02-26 | Svelte performance oriented web framework. Prior to version 5.53.5, errors from `transformError` were not correctly escaped prior to being embedded in the HTML… |
CVE-2026-27901 | Medium | 6.1 | 2026-02-26 | Svelte performance oriented web framework. Prior to version 5.53.5, the contents of `bind:innerText` and `bind:textContent` on `contenteditable` elements were… |
CVE-2026-27578 | Medium | 5.4 | 2026-02-25 | n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to create or modify wo… |
CVE-2026-27616 | High | 7.3 | 2026-02-25 | Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to upload SVG files as task attachments. S… |
CVE-2026-27148 | Critical | 9.6 | 2026-02-25 | Storybook is a frontend workshop for building user interface components and pages in isolation. Prior to versions 7.6.23, 8.6.17, 9.1.19, and 10.2.10, the WebS… |
CVE-2026-27116 | Medium | 6.1 | 2026-02-25 | Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, a reflected HTML injection vulnerability exists in the Projects module… |
CVE-2026-0752 | High | 8.0 | 2026-02-25 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that under certain ci… |
CVE-2026-25736 | Medium | 6.1 | 2026-02-25 | Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Version… |
CVE-2026-25735 | Medium | 6.1 | 2026-02-25 | Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Version… |
CVE-2026-25734 | Medium | 6.1 | 2026-02-25 | Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Version… |
CVE-2026-25733 | High | 7.3 | 2026-02-25 | Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Version… |
CVE-2026-25136 | High | 8.1 | 2026-02-25 | Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. A refle… |
CVE-2026-22720 | High | 8.0 | 2026-02-25 | VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks may be able to injec… |
CVE-2026-25743 | Medium | 4.8 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, users with the "Forms administ… |
CVE-2026-20091 | Medium | 4.8 | 2026-02-25 | A vulnerability in the web-based management interface of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, remote attacker to co… |
CVE-2026-2367 | Medium | 6.4 | 2026-02-25 | The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ays_block' shortcode… |
CVE-2026-3171 | Low | 3.5 | 2026-02-25 | A flaw has been found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected by this vulnerability is an unknown functiona… |
CVE-2026-3170 | Low | 2.4 | 2026-02-25 | A vulnerability was detected in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected is an unknown function of the file /pa… |
CVE-2026-1614 | Medium | 6.4 | 2026-02-25 | The Rise Blocks – A Complete Gutenberg Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘logoTag’ Site Identity block att… |
CVE-2026-27645 | Medium | 6.1 | 2026-02-25 | changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, the RSS single-watch endpoint reflects the UUID path para… |
CVE-2026-27746 | Medium | 6.1 | 2026-02-25 | The SPIP jeux plugin versions prior to 4.1.1 contain a reflected cross-site scripting (XSS) vulnerability in the pre_propre pipeline. The plugin incorporates u… |
CVE-2026-27639 | Medium | 5.4 | 2026-02-25 | Mercator is an open source web application designed to enable mapping of information systems. A stored Cross-Site Scripting (XSS) vulnerability exists in Merca… |
CVE-2026-27627 | High | 8.2 | 2026-02-25 | Karakeep is a elf-hostable bookmark-everything app. In version 0.30.0, when the Reddit metascraper plugin returns `readableContentHtml`, the HTML parsing subpr… |
CVE-2026-27822 | Critical | 9.0 | 2026-02-25 | RustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.83, a Stored Cross-Site Scripting (XSS) vulnerability in the RustFS C… |
CVE-2026-27621 | Medium | 5.4 | 2026-02-25 | TypiCMS is a multilingual content management system based on the Laravel framework. A Stored Cross-Site Scripting (XSS) vulnerability exists in the file upload… |