Export limit exceeded: 48642 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (48642 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-42338 | 1 Beaugunderson | 1 Ip-address | 2026-08-28 | 6.1 Medium |
| ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1. | ||||
| CVE-2026-82089 | 1 Wallabag | 1 Android-app | 2026-08-28 | N/A |
| The wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView. | ||||
| CVE-2026-18324 | 2 Wordpress, Wpmudev | 2 Wordpress, Forminator Forms – Contact Form, Payment Form & Custom Form Builder | 2026-08-28 | 7.2 High |
| The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the targeted Textarea field has the Rich-Text editor option enabled. | ||||
| CVE-2026-82090 | 1 Getpocket | 1 Pocket | 2026-08-28 | N/A |
| Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. JavaScript code can alter the application state via native bridge methods. | ||||
| CVE-2025-2610 | 1 Magnussolution | 1 Magnusbilling | 2026-08-28 | 7.6 High |
| Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling (Alarm Module modules) allows authenticated stored cross-site scripting. This vulnerability is associated with program files protected/components/MagnusLog.Php. This issue affects MagnusBilling: through 7.3.0. | ||||
| CVE-2025-2609 | 1 Magnussolution | 1 Magnusbilling | 2026-08-28 | 8.2 High |
| Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling login logging allows unauthenticated users to store HTML content in the viewable log component accessible at /mbilling/index.php/logUsers/read" cross-site scripting This vulnerability is associated with program files protected/components/MagnusLog.Php. This issue affects MagnusBilling: through 7.3.0. | ||||
| CVE-2026-78281 | 2 Codepeople, Wordpress | 2 Cp Media Player, Wordpress | 2026-08-28 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in CP Media Player <= 1.3.0 versions. | ||||
| CVE-2026-78283 | 2 Codepeople, Wordpress | 2 Music Player For Woocommerce, Wordpress | 2026-08-28 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions. | ||||
| CVE-2026-66155 | 1 Siemens | 3 Element Maps-ng V47, Element Maps-ng V48, Element Maps-ng V49 | 2026-08-28 | 7.6 High |
| A vulnerability has been identified in Element maps-ng V47 (All versions < V47.12.3), Element maps-ng V48 (All versions < V48.11.3), Element maps-ng V49 (All versions < V49.16.1). The si-map component does not properly neutralize user-controllable input of the points property that is used to render the tooltip label of map pins. This could allow an attacker to craft a malicious URL that, when loaded by a victim and the map pin is hovered over, executes arbitrary script code within the victim's browser session. | ||||
| CVE-2026-73827 | 1 Saitodev | 1 Soy Calendar | 2026-08-28 | N/A |
| SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product. | ||||
| CVE-2026-71396 | 1 Bendix | 10 Ec80esp+ 2nd Can, Ec80esp+ 6s/6m, Ec80esp+ Integrated Tpms and 7 more | 2026-08-28 | 5.4 Medium |
| Bendix EC80 Brake ECU uses hard-coded credentials, which could allow an attacker to disable automatic traction control. | ||||
| CVE-2026-77838 | 1 Saitodev | 1 Soy Calendar | 2026-08-28 | N/A |
| SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product. | ||||
| CVE-2026-78238 | 1 Saitodev | 1 Soy Gallery | 2026-08-28 | N/A |
| SOY Gallery contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product. | ||||
| CVE-2026-6128 | 2 Servmask, Wordpress | 2 All-in-one Wp Migration Unlimited Extension, Wordpress | 2026-08-28 | 6.4 Medium |
| The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wm_backups_path' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on user-supplied attributes combined with missing authorization checks on the settings() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the plugin settings page. The vulnerability was partially patched in version 2.84. | ||||
| CVE-2026-53579 | 1 Triliumnext | 1 Trilium | 2026-08-28 | N/A |
| Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the book note type, whose content is stored without sanitization and later rendered as HTML, allowing an attacker-supplied import archive to embed a payload that executes as script. A book note's content is routed through the same rendering path as text notes and injected into the page with jQuery's html method when the note is shown as a grid-view preview card, so a malicious note survives Safe import and runs as soon as the victim opens the containing note. On the desktop client the Electron renderer runs with Node integration enabled, so the injected JavaScript escalates from cross-site scripting to full remote code execution on the victim's machine. This issue is fixed in version 0.104.0. | ||||
| CVE-2026-76053 | 2 Cozmoslabs, Wordpress | 2 Translatepress – Translate Multilingual Sites With Ai Translation, Wordpress | 2026-08-28 | 7.2 High |
| The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation is possible because WordPress's comment KSES allowlist permits the payload structure — an anchor tag with href and title attributes alongside a code tag — causing the malicious comment to be stored verbatim in the database, where it is later processed by the vulnerable parser during page translation. | ||||
| CVE-2026-78071 | 2026-08-28 | N/A | ||
| Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar. | ||||
| CVE-2026-82123 | 2 Tangible, Wordpress | 2 Loops & Logic, Wordpress | 2026-08-28 | 6.5 Medium |
| Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Tangible Loops & Logic. | ||||
| CVE-2026-78195 | 1 Watchguard | 1 Dimension | 2026-08-28 | N/A |
| Rejecting as a duplicate of CVE-2026-78047 | ||||
| CVE-2026-78047 | 1 Watchguard | 1 Dimension | 2026-08-28 | N/A |
| A stored cross-site scripting (XSS) vulnerability in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to inject arbitrary HTML/JavaScript into these fields, which then executes in the browser session of any other user. | ||||