Export limit exceeded: 51855 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (51855 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-85303 | 2 Magepeople, Wordpress | 2 Booking & Rental Manager, Wordpress | 2026-09-07 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. Booking and Rental Manager allows Stored XSS. This issue affects Booking and Rental Manager: from n/a through 2.7.7. | ||||
| CVE-2026-19057 | 1 Gastromenum | 1 Gastromenum Ticket And Qr Menu System | 2026-09-07 | 5.4 Medium |
| Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Stored XSS. This issue affects Gastromenum Ticket and QR Menu System: before 2026.08.31. | ||||
| CVE-2026-19727 | 1 Yordam Information Technology Consulting, Training And Electronic Systems Industry And Trade Inc. | 1 Library Information And Document Automation Program | 2026-09-07 | 6.1 Medium |
| Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows XSS Targeting HTML Attributes. This issue affects Library Information and Document Automation Program: before v22.2. | ||||
| CVE-2025-15694 | 2 Wordpress, Wpjoli | 2 Wordpress, Joli Table Of Contents | 2026-09-07 | 3.5 Low |
| The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed, for example in a multisite setup. | ||||
| CVE-2026-82846 | 2 Masteriyo, Wordpress | 2 Masteriyo, Wordpress | 2026-09-07 | 6.8 Medium |
| The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape some course settings before outputting them in a page available to all visitors, allowing users with a course-author role to perform Stored Cross-Site Scripting attacks that run in the session of anyone viewing the course, including a logged-in administrator. | ||||
| CVE-2026-84931 | 2 Wordpress, Wpjoli | 2 Wordpress, Joli Table Of Contents | 2026-09-07 | 6.8 Medium |
| The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute, allowing users with the Author role and above to inject arbitrary HTML attributes and JavaScript that execute in the browser of any user who views the post, including higher-privileged users such as administrators. This crosses a privilege boundary even on multisite, where such users are not permitted to post unfiltered HTML. | ||||
| CVE-2026-84934 | 2 Jch Optimize Project, Wordpress | 2 Jch Optimize, Wordpress | 2026-09-07 | 8 High |
| The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbitrary JCH Optimize WordPress plugin before 6.0.1 settings and store a script that executes in the browser of any visitor or administrator viewing the site. | ||||
| CVE-2026-84219 | 2 Kirki, Wordpress | 2 Kirki, Wordpress | 2026-09-06 | 7.5 High |
| The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that displays it, including an administrator, and on every page of the site when its header or footer is built to show comments. | ||||
| CVE-2026-85207 | 1 Itsourcecode | 1 Online Medicine Delivery System | 2026-09-05 | 3.5 Low |
| A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an unknown function of the file /index.php?q=orderdetails. Such manipulation of the argument location leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. | ||||
| CVE-2026-85159 | 1 Wwbn | 1 Avideo | 2026-09-05 | 5.4 Medium |
| AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href attribute after isSafeRedirectURL checks protocol only, not HTML characters. Unauthenticated attackers can inject event handlers via relative URLs with embedded quotes to execute arbitrary JavaScript when users interact with the Cancel button. | ||||
| CVE-2026-84774 | 2 Veronalabs, Wordpress | 2 Wp Statistics, Wordpress | 2026-09-05 | 6.1 Medium |
| Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.11 versions. | ||||
| CVE-2026-81281 | 2 Silverks, Wordpress | 2 Graphene, Wordpress | 2026-09-05 | 6.5 Medium |
| Subscriber Cross Site Scripting (XSS) in Graphene <= 2.9.4 versions. | ||||
| CVE-2022-35499 | 1 Trimble | 1 Tm4web | 2026-09-04 | 7.1 High |
| In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended to the URL. | ||||
| CVE-2026-80180 | 1 Apache | 1 Allura | 2026-09-04 | 6.1 Medium |
| Stored XSS via markdown HTML processing in Apache Allura. This issue affects Apache Allura: from through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue. | ||||
| CVE-2026-80190 | 1 Apache | 1 Allura | 2026-09-04 | 6.1 Medium |
| Apache Allura: stored XSS via SVN code repositories. Git repositories are not known to be affected. The vulnerability is likely mitigated via default CSP headers. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue. | ||||
| CVE-2026-85577 | 1 Wwbn | 1 Avideo | 2026-09-04 | 5.4 Medium |
| AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php that allows unauthenticated attackers to inject arbitrary JavaScript by closing the script tag with </script>. Attackers can craft a malicious URL with an error parameter containing script breakout sequences to execute arbitrary JavaScript in the victim's browser context on the login page. | ||||
| CVE-2026-85382 | 1 Light0011 | 1 Cms | 2026-09-04 | 4.3 Medium |
| A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Impacted is the function htmlspecialchars_decode of the file App/Home/View/Default/Chapter/oneChapter.tpl of the component Chapter Content Output. Performing a manipulation of the argument content results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-85149 | 1 Lightstar | 1 Smartit Desktop Manager | 2026-09-04 | 5.3 Medium |
| SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SFTP service credentials of the SmartIT Agent application from the source code, thereby browsing the file system of the user's host. | ||||
| CVE-2026-85148 | 1 Lightstar | 1 Smartit Desktop Manager | 2026-09-04 | 9.8 Critical |
| SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed password to remotely access user hosts. | ||||
| CVE-2026-85146 | 1 Lightstar | 1 Smartit Desktop Manager | 2026-09-04 | 9.8 Critical |
| SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SSH service account credentials and passwords for the SmartIT Agent directly from the application source code. | ||||