Export limit exceeded: 51886 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (51886 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-103863 | 1 Apache | 1 Apache Sling Engine | 2026-11-10 | 5.4 Medium |
| Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the protectheaders / checkcontenttype enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections. This issue affects Apache Sling Engine before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue. | ||||
| CVE-2026-103935 | 2 Open-emr, Openemr | 2 Openemr, Openemr | 2026-11-10 | 8.1 High |
| OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/forms/transfer_summary/new.php and interface/forms/functional_cognitive_status/new.php render stored transfer_to, code, and codetext values with text(), which uses ENT_NOQUOTES, inside double-quoted HTML value attributes. An authenticated clinical user can store a value containing a double quote that escapes the attribute and injects event-handler markup when another clinician opens the form. Successful exploitation can expose session data and protected health information or permit patient-record actions in the victim's session. This issue is fixed in version 8.3.0. | ||||
| CVE-2026-19876 | 1 Infinitt Healthcare | 1 Infinitt Ulite | 2026-11-10 | 6.1 Medium |
| A reflected cross-site scripting (XSS) vulnerability in the login/SSO error page of INFINITT ULite 5.0.2.1_BN48_20260528 and earlier allows an unauthenticated remote attacker to execute arbitrary JavaScript in the browser of a victim who opens a crafted link. An unsanitized request parameter is reflected without output encoding. Fixed in ULite 5.0.2.1 BN50. | ||||
| CVE-2026-124552 | 1 Webmin | 1 Webmin | 2026-11-10 | 4.8 Medium |
| Webmin through 2.670 contains a stored cross-site scripting vulnerability in the Shorewall and Shorewall6 modules' list.cgi, which renders table fields and COMMENT lines unescaped. Authenticated users with table edit permission can store JavaScript via savecmt.cgi or table entries that executes when other users, including root, view the list page. | ||||
| CVE-2026-124494 | 1 Jihong88 | 1 Suneditor | 2026-11-10 | N/A |
| SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean() sanitizer's _normalizeURL() function decodes named entities like : to an empty string. Attackers can inject href values such as javascript: that pass the _isSafeURL() check but are decoded by browsers, executing JavaScript when victims click stored links. | ||||
| CVE-2026-124422 | 1 Jihong88 | 1 Suneditor | 2026-11-10 | 6.1 Medium |
| SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean() that rebuilds iframes from data-se-iframe-holder-attrs JSON without filtering srcdoc or uppercase SRC keys. Attackers can inject crafted HTML through paste, html.set, or html.insert to execute script in the host page origin when victims load or paste the content. | ||||
| CVE-2026-121822 | 1 Ly Corporation | 1 Armeria | 2026-11-10 | N/A |
| A vulnerability has been identified in armeria versions 0.80.0 through 1.42.0, where attackers who control file names can cause stored cross-site scripting (XSS) when directory listing is enabled and a user views the listing. | ||||
| CVE-2026-120212 | 2026-11-10 | N/A | ||
| Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output. HTML::Tags and XML::Tags escape a plain string value by replacing only &, ", < and > with entities. A value interpolated into a single-quoted attribute, as in <a href='$value'>, can therefore close the attribute and add new ones, such as an event handler. Double-quoted attributes are not affected. An attacker who controls a value that an application interpolates into a single-quoted attribute can inject script into the generated page. | ||||
| CVE-2026-84938 | 2026-11-10 | 7.2 High | ||
| The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Notification Dynamic-Data action_hook → Media Upload Chain (ID3 Metadata / html_attributes) in all versions up to, and including, 3.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that a Fusion Form is embedded on an admin-authored page (granting manage_options context to the Dynamic Data action hook callback), and that a Post Cards element configured to display attachment post types is present on a publicly accessible page so the planted shortcode payload is rendered. | ||||
| CVE-2026-17154 | 1 Ibm | 1 Api Connect | 2026-11-10 | 5.4 Medium |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform cross-site scripting due to improper neutralization of user-supplied input. | ||||
| CVE-2026-125392 | 1 Webmin | 1 Webmin | 2026-11-10 | 5.4 Medium |
| Webmin through 2.670 contains a stored cross-site scripting vulnerability in bind8/edit_recs.cgi that outputs raw DNS record values without HTML escaping in ALL view mode. Delegated zone users such as Virtualmin domain owners can store record values containing script that executes in an administrator's browser when viewing zone records. | ||||
| CVE-2026-125079 | 1 D-link | 1 Dcs-6501lh | 2026-11-10 | 5.3 Medium |
| A vulnerability was determined in D-Link DCS-6501LH 3.03.02. This impacts the function pf_get_onvif_user_pwd/mydlink_default_sys_info of the file /mnt/conf/SystemConfig.ini of the component Media Service. This manipulation of the argument pin_code causes hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. | ||||
| CVE-2026-16709 | 1 Ibm | 1 Api Connect | 2026-11-10 | 8.7 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary JavaScript in the victim's browser due to cross-site scripting. User-supplied input is not properly neutralized when a web page is updated, so script content could run in another user's session. | ||||
| CVE-2026-63010 | 2026-11-10 | N/A | ||
| Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.172, 25.0.108, and 26.0.33, a low-privileged user can create manual reminders containing arbitrary HTML/JavaScript and assign them to any other user (including administrators). When the victim's browser polls for pending notifications, the payload renders unsanitized as innerHTML in the ExtJS notification panel, achieving Stored Cross-Site Scripting (XSS) leading to full Account Takeover (ATO) of the victim's session. This issue has been patched in versions 6.8.172, 25.0.108, and 26.0.33. | ||||
| CVE-2026-16325 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-11-10 | 4.4 Medium |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary scripts due to improper neutralization of input in the X-Forwarded-Host header. | ||||
| CVE-2026-18195 | 1 Ibm | 1 App Connect Enterprise | 2026-11-10 | 4.2 Medium |
| IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.30 could allow a remote attacker to perform content spoofing due to improper output encoding of error messages. | ||||
| CVE-2026-18196 | 1 Ibm | 1 App Connect Enterprise | 2026-11-10 | 5.4 Medium |
| IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.30 could allow a remote attacker to inject arbitrary HTML due to improper output neutralization. | ||||
| CVE-2026-84164 | 1 Ericsson | 1 Codechecker | 2026-11-10 | N/A |
| The HTML report that plist-to-html, CodeChecker parse --export html and CodeChecker cmd diff --output html generate puts the report message, the checker name and the source file path into a script block through json.dumps. json.dumps does not escape the less-than character, so a closing script tag in any of those three fields ends the script element and what follows is parsed as HTML. The input author is whoever controls the analysed tree or a third-party result file that report-converter ingests, or who holds PRODUCT_STORE in the cmd diff flow. The viewer is somebody else: docs/jenkins_gerrit_integration.md documents writing the report into Jenkins userContent and posting its URL into a Gerrit review. One caveat worth stating up front is that Jenkins serves userContent under a restrictive CSP that would block an inline handler, so that destination is probably safe as configured. The generated report sets no CSP of its own, so the impact lands wherever it is published without one. | ||||
| CVE-2026-106143 | 1 Progress | 1 Kendo Ui For Vue | 2026-11-10 | 5.4 Medium |
| Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-vue-editor) in Progress Software Kendo UI for Vue versions 2.7.1 through 10.0.0 allows a low-privileged attacker who can supply Editor content to execute arbitrary JavaScript in another user's browser via an unsafe URL entered in the Insert Link or Insert Image dialog, which runs when the user clicks the resulting link. | ||||
| CVE-2026-92911 | 1 Adobe | 6 Adobe Commerce, Adobe Commerce B2b, Commerce and 3 more | 2026-11-10 | 8.7 High |
| Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed. | ||||