Export limit exceeded: 47648 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (47648 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-46516 | 1 Mwtcmi | 1 Frogman | 2026-07-23 | N/A |
| Frogman provides headless FreePBX control. Prior to version 1.6.6, Frogman's chat-console markdown formatter (`assets/js/chat.js`'s `formatMarkdown`) inserted regex capture groups as raw HTML in four template patterns: inline code, bold, markdown links, and download links. Tool responses that reflect user-controlled fields — extension names, ring-group descriptions, IVR names, queue descriptions, etc. — could carry an HTML/JavaScript payload that executes when another admin views the response through Frogman chat. The payload runs in the viewer's session, with the viewer's permissions. FreePBX's own admin GUI escapes these same fields via `freepbx_htmlspecialchars()` throughout its view templates. The chat formatter was the leaky side. Version 1.6.6 patches the issue. | ||||
| CVE-2026-6793 | 1 Bifra Engineering Consulting | 1 Q-smart Next Poll | 2026-07-23 | 5.4 Medium |
| Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bifra Engineering Consulting Ltd. Q-smart NexT Poll allows Stored XSS. This issue affects Q-smart NexT Poll: before 1.8.7. | ||||
| CVE-2026-45797 | 1 Heyform | 1 Heyform | 2026-07-23 | N/A |
| HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, the `/api/upload` endpoint allows unauthenticated file uploads including SVG files. Uploaded SVGs are stored in the static assets directory and served with `Content-Type: image/svg+xml` by Express's serve-static middleware, allowing an attacker to achieve stored cross-site scripting (XSS) on the heyform domain without any authentication. Version 3.0.0-rc.7 contains a patch for the issue. | ||||
| CVE-2026-35198 | 1 Heyform | 1 Heyform | 2026-07-23 | 9 Critical |
| HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (XSS) vulnerability in the form builder allows a low-privileged team member to inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through privilege escalation. Version 3.0.0-rc.7 contains a patch for the issue. | ||||
| CVE-2026-60028 | 1 Themexpert.com | 1 Quix Page Builder Pro Extension For Joomla | 2026-07-23 | N/A |
| Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated stored XSS vulnerability. Authenticated builder user could inject scripts, fires for any visitor or admin viewing the page. Unescaped output + unsanitised SVG. | ||||
| CVE-2026-60034 | 1 Themexpert.com | 1 Jmedia Extension For Joomla | 2026-07-23 | N/A |
| Joomla Extension - themexpert.com - Authenticated stored XSS in JMedia Extension < 1.6.0 - The Joomla extension JMedia is vulnerable to a stored XSS vulnerability. Unsanitised SVG uploads served without nosniff, leading to stored/reflected XSS. | ||||
| CVE-2026-60029 | 1 Themexpert.com | 1 Quix Page Builder Pro Extension For Joomla | 2026-07-23 | N/A |
| Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated stored XSS vulnerability. Authenticated builder users could break out of id/class fields that render for public users. | ||||
| CVE-2026-12900 | 2 Brainstormforce, Wordpress | 2 Spectra Legacy – Gutenberg Blocks, Wordpress | 2026-07-23 | 6.4 Medium |
| The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `uagb/image` block in all versions up to, and including, 2.19.28 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2023-37508 | 1 Hclsoftware | 1 Devops Plan | 2026-07-23 | N/A |
| HCL DevOps Plan is potentially susceptible to Cross-Site Scripting (XSS) which could allow an attacker to exploit this vulnerability if certain browser weaknesses are present. | ||||
| CVE-2026-55081 | 1 Dhis2 | 1 Dhis2-core | 2026-07-23 | N/A |
| DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2 OpenAPI HTML endpoint reflected values from the `scope` query parameter into the generated HTML document without sufficient sanitization. A crafted `scope` value could be rendered as active HTML or JavaScript in the OpenAPI documentation page. An attacker able to get a user to open a crafted OpenAPI HTML URL could execute JavaScript in that user's browser in the DHIS2 origin. Affected versions: DHIS2 2.42 and 2.43 before the 2026-06-09 security patch releases, and the development branch for DHIS2 2.44 before the fix was merged. Patched in 2.42.5.1, 2.43.0.1, the 2.42 and 2.43 line branches, and the 2.44 development branch. | ||||
| CVE-2026-63264 | 1 Joomshopping.com | 1 Joomshopping Extension For Joomla | 2026-07-23 | N/A |
| Joomla Extension - joomshopping.com - Reflective XSS in JoomShopping < 5.9.3 - The Joomla extension JoomShopping is vulnerable to an reflected XSS vulnerability in the product frontend controller. | ||||
| CVE-2026-8152 | 1 Unblu | 1 Spark | 2026-07-23 | N/A |
| Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application's cookies, DOM, and same-origin APIs — an attacker can reach all resources of the host application, not just Unblu's. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL. | ||||
| CVE-2026-64828 | 1 Froiden | 1 Tabletrack | 2026-07-23 | 6.1 Medium |
| Froiden TableTrack through 1.3.10 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary HTML and JavaScript through the order notes field without sanitization. Attackers can craft malicious payloads in customer order placement that execute in the admin's browser session when viewing order details, enabling session token theft or unauthorized administrative actions. | ||||
| CVE-2026-63281 | 1 Regularlabs.com | 4 Advanced Module Manager Extension For Joomla, Conditional Content Extension For Joomla, Content Templater Pro Extension For Joomla and 1 more | 2026-07-23 | N/A |
| Joomla Extension - regularlabs.com - XSS vulnerability in Regular Labs conditions manager - Stored condition values could also execute HTML/JavaScript in administrator summaries. | ||||
| CVE-2026-64795 | 1 Regularlabs.com | 5 Articles Anywhere Pro Extension For Joomla, Modals Extension For Joomla, Modules Anywhere Pro Extension For Joomla and 2 more | 2026-07-23 | N/A |
| Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in visitors’ browsers. | ||||
| CVE-2026-9635 | 2 Mythemeshop, Wordpress | 2 Wp Shortcode By Mythemeshop, Wordpress | 2026-07-23 | 6.4 Medium |
| The WP Shortcode by MyThemeShop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter of the [tab] shortcode in versions up to, and including, 1.4.17. This is due to insufficient input sanitization and output escaping in the mts_tabs() function, which outputs the title shortcode attribute directly into the HTML output between anchor tags without applying any escaping functions. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-15404 | 2 Niklaslindemann, Wordpress | 2 Bulk Page Generator – Lpagery, Wordpress | 2026-07-23 | 6.4 Medium |
| The Lpagery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.5.7. This is due to insufficient input sanitization and output escaping in the lpagery_add_filter_text_template_post() function, which is hooked to admin_footer and echoes the raw post_title of the post referenced by the ?lpagery_template query parameter directly inside a JavaScript single-quoted string literal, without esc_js(), esc_html(), or any other encoding. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher-privileged user (such as an administrator) accesses an admin page with the ?lpagery_template=<post_id> parameter pointing at the attacker's post. | ||||
| CVE-2026-65756 | 1 Regularlabs.com | 1 Keyboard Shortcuts Extension For Joomla | 2026-07-23 | 6.1 Medium |
| Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configuration accepted arbitrary inline JavaScript. | ||||
| CVE-2026-15394 | 2 Mahethekiller, Wordpress | 2 Header Footer Script Adder, Wordpress | 2026-07-23 | 6.4 Medium |
| The Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'asm_code' Snippet Meta in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2025-68081 | 2 Lester Chan, Wordpress | 2 Wp-polls, Wordpress | 2026-07-23 | 5.9 Medium |
| Administrator Cross Site Scripting (XSS) in WP-Polls <= 2.77.3 versions. | ||||