| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. |
| Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0 - An unauthenticated attacker can store malicious JavaScript in a Joomla site's database via a single HTTP request. When an administrator opens the SP Page Builder editor, the JavaScript executes in their browser automatically.. |
| A security vulnerability has been detected in PHPGurukul Company Visitor Management System 1.0. This issue affects some unknown processing of the file /manage-newvisitors.php. The manipulation of the argument fullname leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. |
| jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. jsoup's built-in Safelists are not affected. This issue is fixed in version 1.23.1. |
| Silverstripe CMS is an open source content management system. Prior to 6.2.1, page breadcrumbs in the CMS are vulnerable to cross-site scripting when viewed using the page list view, because page titles are rendered into the breadcrumb trail without being escaped. This issue is fixed in 6.2.1. |
| OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANT_ADMIN can store `javascript:` URLs in the tenant `links` configuration (`website`, `imprint`, `privacyStatement`). These values are returned to the patient-facing landing page via `/api/public`, hydrated into the SvelteKit Button component, and rendered as `<a href="javascript:...">` elements without URL-scheme filtering. A patient who clicks any such link executes the attacker's JavaScript inside the patient browser origin, where patient form data is read before client-side encryption is applied. This breaks the project's central trust claim that the server is an untrusted relay and that administrators cannot read patient data. Patient-side encryption happens after form input, so JavaScript executing in the patient origin can read or alter the plaintext before encryption is performed. Version 1.0.2 fixes the issue. |
| The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enables remote code execution, server-side request forgery and arbitrary front-end script/content injection, giving an unauthenticated attacker full control of the affected site. |
| CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data.
An unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue expression using the application's configured [[ ... ]] delimiters. User profile names may provide an additional injection vector. Although Jinja HTML escaping is applied, the resulting value is subsequently included in a DOM region compiled by Vue.
Vue interprets the attacker-controlled value as a template expression rather than ordinary text. By accessing the JavaScript Function constructor from within the expression, an attacker can execute arbitrary JavaScript in the security context of the CTI-Transmute origin. The application's nonce-based Content Security Policy does not prevent exploitation because the Vue runtime compiler requires the unsafe-eval policy exception.
The malicious payload is stored by the application and executed whenever another user opens an affected page, such as the public conversion detail page. The victim may be a normal user or an administrator. Successful exploitation could allow the attacker to:
* Access data available to the victim through the application.
* Extract API keys, tokens, or other sensitive information exposed to the page.
* Perform authenticated actions using the victim's session.
* Modify conversions or other application data.
* Escalate the impact by targeting an administrator.
A demonstrated payload can use [].constructor.constructor(...) to obtain the JavaScript Function constructor and execute arbitrary code. The regression tests also show that a short first-stage payload could retrieve an uncapped conversion description and evaluate a larger second-stage payload.
The patch addresses the vulnerability by registering a global Jinja finalize hook that inserts a zero-width Unicode word joiner inside every Vue delimiter found in server-rendered values. This prevents Vue from recognizing the values as template expressions while preserving their visible representation. |
| AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts.
The affected templates inserted message and post identifiers directly into inline JavaScript onclick handlers:
onclick="translateMessageToPreferredLanguage('{{ message['id'] }}', '{{ mess_id_escape }}', this)"
and:
onclick="translatePostToPreferredLanguage('{{ post['id'] }}', '{{ post_id_escape }}', this)"
These values were HTML-template escaped but were not safely encoded for use as JavaScript string literals inside an HTML attribute. A specially crafted identifier containing quotation marks, escape characters, or other JavaScript syntax could therefore terminate the expected string argument and inject arbitrary JavaScript into the event handler.
Because the affected values are associated with indexed chat messages or forum posts, a malicious value may remain stored by AIL and be rendered whenever an analyst accesses the corresponding chat or forum explorer view.
Successful exploitation requires the victim to click the affected Translate to preferred language button. The injected code would then execute in the victim’s browser under the security origin of the AIL instance. |
| AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/add_tags endpoint. When an error occurred while processing a tag operation, the application returned the error value directly as an HTML response using str(res[0]).
If attacker-controlled input was included in the generated error message, a crafted request could cause arbitrary HTML or JavaScript to be reflected in the response without appropriate output encoding. An attacker could exploit the vulnerability by convincing an authenticated AIL Framework user to open a specially crafted link.
Successful exploitation could allow JavaScript to execute in the victim’s browser within the security context of the AIL Framework application. Depending on the victim’s privileges and the application’s protections, the attacker could perform actions using the victim’s session, access information available to the victim, or modify data through authenticated application requests.
The vulnerability requires user interaction because the authenticated victim must follow or open the crafted request. The attacker does not necessarily require an AIL Framework account, provided that the crafted request can be delivered to an already authenticated user. |
| AIL Framework contains a stored cross-site scripting vulnerability in the crawler domain view. Crawled URLs were embedded directly into the JavaScript onclick handler used to display a stored screenshot, without context-appropriate encoding.
An attacker who can cause a specially crafted URL to be recorded in the crawler history can inject JavaScript syntax into the stored URL value. The payload remains stored by AIL and is subsequently included in the domain view. When an authenticated analyst clicks the screenshot icon associated with the malicious URL, the injected JavaScript executes in the analyst’s browser within the security context of the AIL Framework application.
Successful exploitation could allow an attacker to access information available to the analyst’s session, modify displayed content, or perform application actions using the analyst’s privileges. Exploitation requires the victim to interact with the affected screenshot entry.
The vulnerability was corrected by serializing the crawled URL with Jinja’s tojson filter before inserting it into the JavaScript handler. This safely escapes characters that could otherwise terminate the JavaScript string and introduce executable code. |
| The ShareOpenly WordPress plugin prior to version 1.2.1 contains a Cross-Site Scripting vulnerability caused by the absence of WordPress's `esc_url()` escaping function on the `$url` variable before it is rendered into HTML content. This variable is constructed from `home_url( add_query_arg( array(), $wp->request ) )` and is concatenated directly into an HTML `href` attribute on every singular post or page where the plugin's sharing link is displayed. WordPress's security handbook mandates that every URL placed in HTML output must be passed through `esc_url()`, which both HTML-encodes special characters (converting `"`, `<`, `>` into their safe HTML entity equivalents) and strips dangerous URI schemes such as `javascript:` and `data:`. The omission of this function means that if the `$url` value ever contains HTML-special characters or a dangerous URI scheme — through a `home_url` WordPress filter applied by another plugin or theme, through certain web server or hosting configurations, or through future code changes — the unescaped content will be injected verbatim into the rendered HTML of every post or page on the site. Version 1.2.1 contains a patch for the issue. |
| Tobit Laboratories AG TeamDavid's Webbox application contains a reflected cross-site scripting (XSS)
vulnerability. By sending a specially crafted link including an
arbitrary path, an XSS payload or the parameter “EntryInfo”, and the
parameter “!templateName=entryMail”, an attacker can cause the payload
to execute in the victim’s browser when they click the link. This issue affects TeamDavid through Rollout 524. |
| Emlog CMS <= 2.6.14 contains a stored cross-site scripting (XSS) vulnerability in the article publishing module (/admin/article.php). A remote authenticated attacker can inject arbitrary JavaScript code via the article content. When an administrator reviews or previews the submitted article in the backend, the malicious script executes in the admin's browser session, allowing the attacker to perform administrative actions such as creating a backdoor administrator account. |
| A code injection vulnerability exists in the LINE Android app prior to version 26.7.2.
The profile rendering component does not adequately validate or sandbox externally supplied script content embedded in profile templates.
As a result, an attacker who is able to place crafted content in a profile could cause unintended code to execute with the application's privileges when a victim views that profile.
A server-side mitigation has been deployed that also protects existing Android clients that have not been updated to version 26.7.2. |
| DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid session cookies (including for the superadmin account), forge CSRF tokens, and forge password reset tokens, achieving full account takeover. The repository also ships with DEBUG=True as the default, causing error pages to leak database credentials, email credentials, OAuth data, and internal file paths. |
| 299Ko's public contact form (plugin/contact/controllers/ContactController.php, home()) sets raw POST field values (name, firstname, email, message) into the page template with no sanitization. The template engine's variable output function (common/Template.php, _show_var()) echoes values with no htmlspecialchars() call, and the sink template (contact.tpl) outputs these values unescaped into an HTML attribute and a textarea. An unauthenticated attacker can submit a payload such as name="><script>alert(document.domain)</script> to achieve reflected XSS against any visitor who submits or is tricked into auto-submitting the form, including a targeted administrator, enabling session token theft. |
| Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. |
| Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. |
| OpenBK7231T's CHANNEL_SetLabel() (src/cmnds/cmd_channels.c) stores channel labels received via the MQTT SetChannelLabel command using strdup() with no HTML sanitization. CHANNEL_GetLabel() returns these labels unsanitized, and they are rendered via hprintf255() at 15+ locations in src/httpserver/http_fns.c with no HTML encoding. An attacker with MQTT broker access (commonly unauthenticated in real deployments) can set a channel label containing a <script> payload that executes when any user views the device's web panel. |
