CWE-79 · Cross-site Scripting (page 66)
Page 66 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-23887 | Medium | 5.4 | 2026-01-22 | Group-Office is an enterprise customer relationship management and groupware tool. In versions 6.8.148 and below, and 25.0.1 through 25.0.79, the application s… |
CVE-2026-23630 | Medium | 5.4 | 2026-01-21 | Docmost is open-source collaborative wiki and documentation software. In versions 0.3.0 through 0.23.2, Mermaid code block rendering is vulnerable to stored Cr… |
CVE-2026-23960 | Medium | 5.4 | 2026-01-21 | Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.6.17 and 3.7.8, stored XSS… |
CVE-2026-23516 | Medium | 5.4 | 2026-01-21 | CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.2.0 through 2.54.0, an attacker is able to execute arbitr… |
CVE-2026-23499 | Medium | 5.4 | 2026-01-21 | Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor allowed authenticated staff users or A… |
CVE-2026-22849 | Medium | 4.8 | 2026-01-21 | Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor was allowing users to modify rich text… |
CVE-2026-22808 | Medium | 5.4 | 2026-01-21 | fleetdm/fleet is open source device management software. Prior to versions 4.78.2, 4.77.1, 4.76.2, 4.75.2, and 4.53.3, if Windows MDM is enabled, an unauthenti… |
CVE-2021-47873 | High | 7.2 | 2026-01-21 | VestaCP versions prior to 0.9.8-25 contain a cross-site scripting vulnerability in the IP interface configuration that allows attackers to inject malicious scr… |
CVE-2021-47870 | Medium | 5.4 | 2026-01-21 | GetSimple CMS My SMTP Contact Plugin 1.1.2 suffers from a Stored Cross-Site Scripting (XSS) vulnerability. The plugin attempts to sanitize user input using htm… |
CVE-2021-47858 | High | 7.2 | 2026-01-21 | Genexis Platinum-4410 P4410-V2-1.31A contains a stored cross-site scripting vulnerability in the 'start_addr' parameter of the Security Management interface. A… |
CVE-2021-47857 | High | 7.2 | 2026-01-21 | Moodle 3.10.3 contains a persistent cross-site scripting vulnerability in the calendar event subtitle field that allows attackers to inject malicious scripts… |
CVE-2021-47855 | High | 7.2 | 2026-01-21 | Openlitespeed 1.7.9 contains a stored cross-site scripting vulnerability in the dashboard's Notes parameter that allows administrators to inject malicious scri… |
CVE-2021-47817 | Medium | 5.4 | 2026-01-21 | OpenEMR 5.0.2.1 contains a cross-site scripting vulnerability in user profile parameters that authenticated attackers can chain with a file upload to achieve r… |
CVE-2026-20109 | Medium | 4.8 | 2026-01-21 | Multiple vulnerabilities in the web-based management interface of Cisco Packaged Contact Center Enterprise (Packaged CCE) and Cisco Unified Contact Center Ente… |
CVE-2026-20055 | Medium | 4.8 | 2026-01-21 | Multiple vulnerabilities in the web-based management interface of Cisco Packaged Contact Center Enterprise (Packaged CCE) and Cisco Unified Contact Center Ente… |
CVE-2025-57681 | Medium | 5.4 | 2026-01-21 | The WorklogPRO - Timesheets for Jira plugin in Jira Data Center before version 4.23.6-jira10 and before version 4.23.5-jira9 allows users and attackers to inje… |
CVE-2026-21951 | Medium | 6.1 | 2026-01-20 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker). Supported versions that are affected are… |
CVE-2026-21947 | Low | 3.1 | 2026-01-20 | Vulnerability in Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u471-b50. Difficult to exploit vulnerability al… |
CVE-2026-21946 | Medium | 6.1 | 2026-01-20 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0… |
CVE-2026-21944 | Medium | 6.5 | 2026-01-20 | Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The suppor… |
CVE-2026-21943 | Medium | 6.1 | 2026-01-20 | Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Scripting Admin). Supported versions that are affected are 12.2.3-12.2.15… |
CVE-2026-21664 | Medium | 6.1 | 2026-01-20 | HackerOne community member Huynh Pham Thanh Luc (nigh7c0r3) has reported a reflected XSS vulnerability in the afr.php delivery script of Revive Adserver. An at… |
CVE-2026-21663 | Medium | 6.1 | 2026-01-20 | HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the banner-acl.php script of Revive Adserver. An attacker can craft… |
CVE-2026-21642 | Medium | 6.1 | 2026-01-20 | HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the `banner-acl.php` and `channel-acl.php` scripts of Revive Adserv… |
CVE-2025-67263 | Medium | 6.1 | 2026-01-20 | Abacre Retail Point of Sale 14.0.0.396 is affected by a stored cross-site scripting (XSS) vulnerability in the Clients module. The application fails to properl… |
CVE-2025-67824 | Medium | 6.1 | 2026-01-20 | The WorklogPRO - Jira Timesheets plugin in the Jira Data Center before 4.24.2-jira9, 4.24.2-jira10 and 4.24.2-jira11 allows attackers to inject arbitrary HTML… |
CVE-2025-36409 | Medium | 5.4 | 2026-01-20 | IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2025-36408 | Medium | 6.4 | 2026-01-20 | IBM ApplinX 11.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI… |
CVE-2025-36396 | Medium | 5.4 | 2026-01-20 | IBM Application Gateway 23.10 through 25.09 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScrip… |
CVE-2025-36113 | Medium | 5.4 | 2026-01-20 | IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0 5.2.0.00 through 5.2.0.12 is vulnerable to cross-site scripting. This vulnerability allo… |
CVE-2025-36066 | Medium | 6.1 | 2026-01-20 | IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0 5.2.0.00 through 5.2.0.12 is vulnerable to cross-site scripting. This vulnerability allo… |
CVE-2026-0690 | Medium | 6.4 | 2026-01-20 | The FlatPM – Ad Manager, AdSense and Custom Code plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rank_math_description' custom field… |
CVE-2026-0608 | Medium | 6.4 | 2026-01-20 | The Head Meta Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'head-meta-data' post meta field in all versions up to, and includ… |
CVE-2025-58095 | Medium | 6.1 | 2026-01-20 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malic… |
CVE-2025-58094 | Medium | 6.1 | 2026-01-20 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malic… |
CVE-2025-58093 | Medium | 6.1 | 2026-01-20 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malic… |
CVE-2025-58092 | Medium | 6.1 | 2026-01-20 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malic… |
CVE-2025-58091 | Medium | 6.1 | 2026-01-20 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malic… |
CVE-2025-58090 | Medium | 6.1 | 2026-01-20 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malic… |
CVE-2025-58089 | Medium | 6.1 | 2026-01-20 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malic… |
CVE-2025-58088 | Medium | 6.1 | 2026-01-20 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malic… |
CVE-2025-58087 | Medium | 6.1 | 2026-01-20 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malic… |
CVE-2025-58080 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the modifyHL7App functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious… |
CVE-2025-57881 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the modifyEmail functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious… |
CVE-2025-57787 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the modifyRoute functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious… |
CVE-2025-57786 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the notifynewstudy functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicio… |
CVE-2025-55071 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the modifyAnonymize functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malici… |
CVE-2025-54861 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the modifyCoercion functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicio… |
CVE-2025-54853 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the modifyUser functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious U… |
CVE-2025-54852 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the modifyAeTitle functionality of MedDream PACS Premium 7.3.6.870. A specially crafted maliciou… |
CVE-2025-54817 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the autoPurge functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious ur… |
CVE-2025-54814 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the modifyAutopurgeFilter functionality of MedDream PACS Premium 7.3.6.870. A specially crafted… |
CVE-2025-54778 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the existingUser functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious… |
CVE-2025-54495 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the emailfailedjob functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicio… |
CVE-2025-54157 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the encapsulatedDoc functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malici… |
CVE-2025-53854 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the modifyHL7Route functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicio… |
CVE-2025-53707 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the modifyTranscript functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malic… |
CVE-2025-53516 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the downloadZip functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious… |
CVE-2025-46270 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the fetchPriorStudies functionality of MedDream PACS Premium 7.3.6.870. A specially crafted mali… |
CVE-2025-44000 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the sendOruReport functionality of MedDream PACS Premium 7.3.6.870. A specially crafted maliciou… |
CVE-2025-36556 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the ldapUser functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL… |
CVE-2025-15380 | High | 7.2 | 2026-01-20 | The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for Word… |
CVE-2026-1183 | | 2026-01-20 | HTML injection vulnerability in multiple Botble products such as TransP, Athena, Martfury, and Homzen, consisting of an HTML injection due to a lack of proper… | |
CVE-2025-41081 | | 2026-01-20 | Reflected Cross-Site Scripting (XSS) vulnerability in IsMyGym by Zuinq Studio. This vulnerability allows an attacker to execute JavaScript code in the victim's… | |
CVE-2025-41025 | Medium | 5.4 | 2026-01-20 | Stored Cross-Site Scripting (XSS) in Poultry Farm Management System v1.0 due to the lack of proper validation of user input by sending a POST request. The rela… |
CVE-2025-41024 | Medium | 5.4 | 2026-01-20 | Stored Cross-Site Scripting (XSS) in Poultry Farm Management System v1.0 due to the lack of proper validation of user input by sending a POST request. The rela… |
CVE-2025-40679 | | 2026-01-20 | HTML Injection vulnerability in Isshue by Bdtask, consisting os an HTML injection due to a lack os proper validation of user input by sending a POST request… | |
CVE-2025-40644 | | 2026-01-20 | Reflected Cross-Site Scripting (XSS) vulnerability in Riftzilla's QRGen. This vulnerability allows an attavker to execute JavaScript code in the victim's brows… | |
CVE-2025-41084 | | 2026-01-20 | Stored Cross-Site Scripting (XSS) vulnerability in Sesame web application, due to the fact that uploaded SVG images are not properly sanitized. This allows att… | |
CVE-2025-41768 | Medium | 5.5 | 2026-01-20 | An high privileged remote attacker can inject arbitrary content into the custom CSS field on the affected devices due to improper neutralization of input durin… |
CVE-2025-66523 | Medium | 6.1 | 2026-01-20 | URL parameters are directly embedded into JavaScript code or HTML attributes without proper encoding or sanitization. This allows attackers to inject arbitrary… |
CVE-2026-1045 | Medium | 4.4 | 2026-01-20 | The Viet contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.3.2 due to insuff… |
CVE-2026-1042 | Medium | 4.4 | 2026-01-20 | The WP Hello Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'digit_one' and 'digit_two' parameters in all versions up to, and in… |
CVE-2026-23880 | High | 7.3 | 2026-01-19 | OnboardLite is a comprehensive membership lifecycle platform built for student organizations at the University of Central Florida. Versions of the software pri… |
CVE-2026-23852 | Critical | 9.6 | 2026-01-19 | SiYuan is a personal knowledge management system. Versions prior to 3.5.4 have a stored Cross-Site Scripting (XSS) vulnerability that allows an attacker to inj… |
CVE-2026-23847 | Medium | 6.1 | 2026-01-19 | SiYuan is a personal knowledge management system. Versions prior to 3.5.4 are vulnerable to reflected cross-site scripting in /api/icon/getDynamicIcon due to u… |
CVE-2026-23841 | Critical | 9.3 | 2026-01-19 | Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripti… |
CVE-2026-23840 | Critical | 9.3 | 2026-01-19 | Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripti… |
CVE-2026-23839 | Critical | 9.3 | 2026-01-19 | Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripti… |
CVE-2026-23625 | High | 8.7 | 2026-01-19 | OpenProject is an open-source, web-based project management software. Versions 16.3.0 through 16.6.4 are affected by a stored cross-site scripting vulnerabilit… |
CVE-2026-1161 | Low | 3.5 | 2026-01-19 | A vulnerability was detected in pbrong hrms 1.0.1. The affected element is the function UpdateRecruitmentById of the file /handler/recruitment.go. The manipula… |
CVE-2026-21618 | Medium | 6.1 | 2026-01-19 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.SharedAuthoriz… |
CVE-2026-1151 | Low | 2.4 | 2026-01-19 | A weakness has been identified in technical-laohu mpay up to 1.2.4. The affected element is an unknown function of the component User Center. This manipulation… |
CVE-2026-1147 | Low | 3.5 | 2026-01-19 | A vulnerability was found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. This affects an unknown part of the file /php/api_… |
CVE-2026-1146 | Low | 3.5 | 2026-01-19 | A vulnerability has been found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected by this issue is some unknown functi… |
CVE-2026-1136 | Low | 3.5 | 2026-01-19 | A weakness has been identified in lcg0124 BootDo up to e93dd428ef6f5c881aa74d49a2099ab0cf1e0fcb. Affected is the function Save of the file /blog/bContent/save… |
CVE-2026-1135 | Medium | 4.3 | 2026-01-19 | A security flaw has been discovered in itsourcecode Society Management System 1.0. This impacts an unknown function of the file /admin/activity.php. The manipu… |
CVE-2026-1134 | Medium | 4.3 | 2026-01-19 | A vulnerability was identified in itsourcecode Society Management System 1.0. This affects an unknown function of the file /admin/expenses.php. The manipulatio… |
CVE-2026-23525 | Medium | 6.4 | 2026-01-18 | 1Panel is an open-source, web-based control panel for Linux server management. A stored Cross-Site Scripting (XSS) vulnerability exists in the 1Panel App Store… |
CVE-2026-1049 | Low | 3.5 | 2026-01-17 | A security vulnerability has been detected in LigeroSmart up to 6.1.26. The affected element is an unknown function of the file /otrs/index.pl. Such manipulati… |
CVE-2026-1048 | Low | 3.5 | 2026-01-17 | A weakness has been identified in LigeroSmart up to 6.1.26. Impacted is an unknown function of the file /otrs/index.pl?Action=AgentTicketZoom. This manipulatio… |
CVE-2026-0725 | Medium | 4.4 | 2026-01-17 | The Integrate Dynamics 365 CRM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.1… |
CVE-2025-8615 | Medium | 6.4 | 2026-01-17 | The CubeWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cubewp_shortcode_taxonomy shortcode in all versions up to, and in… |
CVE-2026-0833 | Medium | 6.4 | 2026-01-17 | The Team Section Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block in all versions up to, and including, 2.0.0 due… |
CVE-2026-0691 | Medium | 4.4 | 2026-01-17 | The CM E-Mail Blacklist – Simple email filtering for safer registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'black_email'… |
CVE-2026-0518 | Medium | 4.8 | 2026-01-17 | CVE-2026-0518 is a cross-site scripting vulnerability in versions of Secure Access prior to 14.20. An attacker with administrative privileges can interfere w… |
CVE-2025-56451 | Medium | 6.1 | 2026-01-16 | Cross site scripting vulnerability in seeyon Zhiyuan A8+ Collaborative Management Software 7.0 via the topValue parameter to the seeyon/main.do endpoint. |
CVE-2026-23643 | Medium | 5.4 | 2026-01-16 | CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string paramete… |
CVE-2019-25297 | | 2026-01-16 | Poll, Survey & Quiz Maker Plugin by Opinion Stage Wordpress plugin versions prior to 19.6.25 contain a stored cross-site scripting (XSS) vulnerability via mult… | |
CVE-2026-23725 | Medium | 5.4 | 2026-01-16 | WeGIA is a web manager for charitable institutions. Prior to 3.6.2, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the html/pet/adotantes/… |