CWE-79 · Cross-site Scripting (page 6)
Page 6 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-100238 | Medium | 6.1 | 2026-09-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Flow Extension al… |
CVE-2026-97711 | | 2026-09-29 | Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function value… | |
CVE-2026-49243 | Critical | 9.6 | 2026-09-29 | Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.650, Webmin users who click on a malicious link to their server are… |
CVE-2026-101270 | | 2026-09-29 | Malicious HTML content could be injected into the help texts of various fields with organizer permissions. | |
CVE-2026-84739 | High | 8.7 | 2026-09-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain c… |
CVE-2026-76719 | High | 8.2 | 2026-09-29 | A security vulnerability in HPE OneView may be exploited remotely to perform session hijacking, data theft or other unauthorized actions. |
CVE-2026-76718 | High | 8.2 | 2026-09-29 | A potential security vulnerability in HPE OneView can be exploited to allow remote session hijacking or other unauthorized actions. |
CVE-2026-102292 | Medium | 4.3 | 2026-09-29 | A flaw has been found in coolbeans1212 MateisHomePage-Website up to ea2a4226deeca27ab1fb9df0552ec76444547811. Affected by this issue is some unknown functional… |
CVE-2026-102290 | Low | 3.5 | 2026-09-29 | A vulnerability was determined in CodeCanyon Rocket LMS up to 2.2. This affects an unknown function of the component Student Profile Image Upload. Executing a… |
CVE-2026-102264 | Low | 3.5 | 2026-09-29 | A vulnerability was found in mwasikz robo-cafe-rms up to 228c44a02823f04e85db32b7137809a2856148fc. The impacted element is an unknown function of the file fron… |
CVE-2026-96326 | High | 7.2 | 2026-09-29 | The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field i… |
CVE-2026-102374 | Medium | 6.1 | 2026-09-29 | GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP OAuth connector that double-decodes MIME-encoded email subjects… |
CVE-2026-102372 | Medium | 6.1 | 2026-09-29 | GestSup versions before 3.2.61 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers to store arbitrary J… |
CVE-2026-102333 | Medium | 6.1 | 2026-09-28 | httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as clickable links in the web interface. Attackers controlling traffi… |
CVE-2026-101141 | Low | 3.5 | 2026-09-28 | A flaw has been found in Eleveo Call Recording Software 9.7.0. Affected is an unknown function of the file /callrec/audio.jsp of the component Play Audio Page… |
CVE-2026-101111 | Medium | 6.1 | 2026-09-28 | Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) < 6.4.6 - The public book-detail page template, site/views/view_book/tm… |
CVE-2026-101109 | | 2026-09-28 | Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8 - The public vehicle-detail page (task=view) echoes the titl… | |
CVE-2026-100753 | | 2026-09-28 | Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.9 - The public property-detail page’s “leave a review” fo… | |
CVE-2026-88804 | Critical | 9.6 | 2026-09-28 | An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Ra… |
CVE-2026-73641 | | 2026-09-28 | Dayforce Payroll is vulnerable to Reflected XSS in multiple endpoints. An attacker can prepare a specially crafted URL that, when opened, results in arbitrary… | |
CVE-2026-82326 | Medium | 4.1 | 2026-09-28 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Enocta Educational Technologies Inc. Enocta Platform allo… |
CVE-2026-87752 | Medium | 6.1 | 2026-09-28 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Rolantis Information Technologies Tourism Industry and Tr… |
CVE-2026-7172 | | 2026-09-28 | Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoint and parameter: * CVE-2026-7172: parameter 'Nombre Completo' in the endpoi… | |
CVE-2026-7171 | | 2026-09-28 | Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoint and parameter: * CVE-2026-7171: parameter 'Apellido 1' in the endpoint '… | |
CVE-2026-7170 | | 2026-09-28 | Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoint and parameter: * CVE-2026-7170: parameter 'vendor_store_name' in the endp… | |
CVE-2026-86507 | Medium | 6.1 | 2026-09-28 | Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted comment-author URL that can execute script in th… |
CVE-2026-82969 | Medium | 5.4 | 2026-09-28 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and… |
CVE-2026-91206 | Medium | 6.1 | 2026-09-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross… |
CVE-2026-91204 | Medium | 6.1 | 2026-09-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an anonymous remote attacker to store a comm… |
CVE-2026-82546 | Medium | 6.1 | 2026-09-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an unauthenticated remote attacker to store… |
CVE-2026-82387 | Medium | 5.4 | 2026-09-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a user with media-upload rights to store act… |
CVE-2026-82382 | Medium | 6.1 | 2026-09-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross… |
CVE-2026-82381 | Medium | 5.4 | 2026-09-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a user with authoring rights on a weblog to… |
CVE-2026-100751 | | 2026-09-28 | Joomla Extension - regularlabs.com - Privileged stored XSS via data-rlta-url attributes in Tabs & Accordions (Pro) 2.3.0 - 3.1.0 - Tabs & Accordions Pro accept… | |
CVE-2026-100904 | Low | 3.5 | 2026-09-28 | A security vulnerability has been detected in amirsanni mini-inventory-and-sales-management-system up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. Impacted is… |
CVE-2026-100882 | Low | 2.4 | 2026-09-27 | A vulnerability was detected in Krayin laravel-crm up to 2.2.5. Impacted is an unknown function of the file packages/Webkul/Admin/src/Resources/views/component… |
CVE-2026-100881 | Low | 2.6 | 2026-09-27 | A security vulnerability has been detected in zhistaredu StarTraining up to 3.8.1. This issue affects some unknown processing of the file application.yml. Such… |
CVE-2026-100880 | Low | 3.5 | 2026-09-27 | A weakness has been identified in zhistaredu StarTraining up to 3.8.1. This vulnerability affects unknown code of the file du-common/src/main/java/com/edu/comm… |
CVE-2026-100877 | Medium | 4.3 | 2026-09-27 | A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected by this vulnerability is an… |
CVE-2026-97165 | | 2026-09-27 | Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0 - The “return” parameter is base64-decoded and written to… | |
CVE-2026-97319 | Medium | 6.8 | 2026-09-27 | The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.2 does not sanitize and escape a block attribute before outputting it in a page, whic… |
CVE-2026-96899 | Medium | 6.8 | 2026-09-27 | The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it… |
CVE-2026-96895 | Medium | 6.8 | 2026-09-27 | The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when ren… |
CVE-2026-89006 | Medium | 6.8 | 2026-09-27 | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed content before storing it as post content, allowing users with th… |
CVE-2026-86609 | High | 8.8 | 2026-09-27 | The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outpu… |
CVE-2026-85002 | Medium | 6.8 | 2026-09-27 | The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, which could allow user… |
CVE-2026-100720 | High | 8.7 | 2026-09-26 | Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer (the lowest-privileged authenticated role) uploads an SSL certificat… |
CVE-2026-100695 | Medium | 6.1 | 2026-09-26 | Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTION_ID() database result is interpolated into JavaScript without proper esc… |
CVE-2026-100694 | Medium | 6.1 | 2026-09-26 | Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw H… |
CVE-2026-100691 | Medium | 5.4 | 2026-09-26 | Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the `lineAnchors` option befor… |
CVE-2026-100673 | High | 8.2 | 2026-09-26 | The Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view (admin/templates… |
CVE-2026-100645 | High | 8.0 | 2026-09-26 | SiYuan versions 3.7.0 before 3.8.4 contain a stored cross-site scripting vulnerability in gallery and kanban database renderers where field descriptions are no… |
CVE-2026-100643 | High | 8.0 | 2026-09-26 | SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject JavaSc… |
CVE-2026-100641 | High | 8.0 | 2026-09-26 | SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content returned by /… |
CVE-2026-100639 | High | 8.8 | 2026-09-26 | SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup (app/src/protyle/gutter/button.ts, assigned via innerHTML in… |
CVE-2026-100630 | Medium | 5.4 | 2026-09-26 | AVideo before 29.1.0 contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript… |
CVE-2026-100313 | Medium | 4.3 | 2026-09-26 | A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of t… |
CVE-2026-100311 | Low | 3.5 | 2026-09-26 | A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The affected element is an unknown fu… |
CVE-2026-96531 | Medium | 6.8 | 2026-09-26 | The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper e… |
CVE-2026-92411 | Medium | 6.8 | 2026-09-26 | The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it o… |
CVE-2026-85081 | High | 7.5 | 2026-09-26 | The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly… |
CVE-2026-84096 | High | 8.0 | 2026-09-26 | The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on the AJAX handler that saves its review submission forms, and th… |
CVE-2026-84095 | High | 8.0 | 2026-09-26 | The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on one of its AJAX handlers, and the nonce protecting it is genera… |
CVE-2026-16591 | High | 7.2 | 2026-09-26 | The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize and escape some of its category and location fields before outputting them in page attribu… |
CVE-2026-15273 | Medium | 6.4 | 2026-09-26 | The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI in all version 4.0.0 due to insufficient input sanitization… |
CVE-2026-100522 | Medium | 6.1 | 2026-09-26 | Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in message.php where the lng parameter is not properly escaped before output in t… |
CVE-2026-100521 | Medium | 6.1 | 2026-09-26 | Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript esca… |
CVE-2026-71483 | | 2026-09-25 | Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected by jQuery .html() in employee/templates/… | |
CVE-2026-100383 | | 2026-09-25 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extens… | |
CVE-2026-100381 | | 2026-09-25 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - UploadWizard Exte… | |
CVE-2026-100380 | | 2026-09-25 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extensio… | |
CVE-2026-100376 | | 2026-09-25 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox E… | |
CVE-2026-96878 | | 2026-09-25 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This i… | |
CVE-2026-96877 | | 2026-09-25 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This i… | |
CVE-2026-96876 | | 2026-09-25 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This i… | |
CVE-2026-96875 | | 2026-09-25 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Stored XSS. This iss… | |
CVE-2026-97897 | Low | 3.5 | 2026-09-25 | A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component Ti… |
CVE-2026-97896 | Low | 3.5 | 2026-09-25 | A vulnerability was identified in krayin laravel-crm up to 2.2.5. This vulnerability affects the function ConfigurationForm::rules of the file packages/Webkul/… |
CVE-2026-84463 | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a user with Knowledge Base editing rights for a category can embed a video… | |
CVE-2026-53610 | | 2026-09-25 | GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, an attacker can craft a URL for a dashboard that reflects attacker-controlle… | |
CVE-2026-56731 | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a low-privilege authenticated user may inject arbitrary HTML markup, includ… | |
CVE-2026-67239 | | 2026-09-25 | RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3, Stored XSS via TLS peer-certificate DN in st… | |
CVE-2026-67237 | | 2026-09-25 | RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, set_token_auth/2 inserted a bearer token from the Authorization header or acces… | |
CVE-2026-18320 | Medium | 6.1 | 2026-09-25 | Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This conf… |
CVE-2026-18312 | Medium | 6.1 | 2026-09-25 | Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The application interpolates… |
CVE-2026-18311 | Medium | 6.1 | 2026-09-25 | Readwise Reader for Android contains a cross-site scripting vulnerability due to missing HTML sanitization in its processing of imported document metadata. Att… |
CVE-2026-100237 | Medium | 6.1 | 2026-09-25 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension all… |
CVE-2026-97868 | Low | 3.5 | 2026-09-25 | A security vulnerability has been detected in sheshbabu zen up to 1.5.0. Affected by this issue is the function dangerouslySetInnerHTML of the file features/no… |
CVE-2026-96874 | | 2026-09-25 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in the Mediawiki - Cargo extension allows Stored XSS. … | |
CVE-2026-85293 | Medium | 4.8 | 2026-09-25 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2-beta-1, InvoicePlane stores client_email v… |
CVE-2026-93647 | Critical | 9.3 | 2026-09-25 | An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS… |
CVE-2026-93642 | Critical | 9.3 | 2026-09-25 | An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the at… |
CVE-2026-93641 | Critical | 9.3 | 2026-09-25 | An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the a… |
CVE-2026-100190 | | 2026-09-25 | The AIL Framework crawler splash domain page (showDomain.html) is vulnerable to stored cross-site script injection (XSS). User-supplied data originating from i… | |
CVE-2026-100176 | | 2026-09-25 | The AIL Framework's username timeline feature is vulnerable to stored cross-site scripting (XSS). Usernames imported from chats and crawled forums are stored w… | |
CVE-2026-100174 | | 2026-09-25 | The AIL Framework tag selector component (var/www/static/js/tags.js) is vulnerable to stored cross-site scripting (XSS). A user with the ability to create a cu… | |
CVE-2026-100172 | | 2026-09-25 | The AIL Framework (ail-project/ail-framework) contains a stored cross-site scripting (XSS) vulnerability in two Jinja2 templates that render popovers for match… | |
CVE-2026-88420 | Medium | 5.4 | 2026-09-25 | A reflected cross-site scripting (XSS) vulnerability in the EntryAbstract.save() component of APSL puput v1.2.1 through v2.2.0 allows authenticated attackers w… |
CVE-2026-78902 | Medium | 6.1 | 2026-09-25 | Cross Site Scripting vulnerability in Netgate pfSense 26.03.1-RELEASE allows an attacker to execute arbitrary code via the pfBlockerNG package |
CVE-2026-27867 | | 2026-09-25 | An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action is required) who has the vulnerable f… |