On this page

Atomicorp WAF Rule 333141

Rule Summary

Rule ID: 333141
Status: Active
Alert message: Atomicorp.com WAF Rules: Potential XSS Attack detected
Observed CWEs: CWE-20 (12), CWE-22 (3), CWE-73 (1), CWE-74 (4), CWE-78 (2), CWE-79 (1348), CWE-80 (16), CWE-81 (1), CWE-83 (4), CWE-87 (6), CWE-89 (5), CWE-94 (337), CWE-113 (1), CWE-116 (16), CWE-183 (1), CWE-184 (1), CWE-185 (1), CWE-200 (3), CWE-264 (1), CWE-287 (1), CWE-295 (2), CWE-306 (2), CWE-345 (3), CWE-352 (4), CWE-384 (1), CWE-434 (11), CWE-436 (1), CWE-444 (1), CWE-601 (6), CWE-610 (1), CWE-611 (2), CWE-625 (1), CWE-639 (2), CWE-665 (1), CWE-693 (1), CWE-732 (1), CWE-749 (1), CWE-798 (1), CWE-862 (1), CWE-915 (1), CWE-918 (2), CWE-1004 (2), CWE-1188 (1), CWE-1321 (2), CWE-1336 (2)
Revision: 22
Rule severity: Critical (2)
Phase: 2 (request body)
Request surfaces: Request headers, Request cookies, Request argument names, Request arguments, JSON request data, SOAP request data, XML request data
Rule action: deny
HTTP status: 403
Logging: log, auditlog

Description

This rule detects behavior identified by its current alert as “Potential XSS Attack detected” in the request headers, request cookies, request argument names, request arguments, JSON request data, SOAP request data, XML request data. It evaluates during the request body phase and denies matching traffic with HTTP status 403.

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

CVE	Vulnerability	Product	CVSS	Severity
CVE-2026-106102	Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()	quasar	10.0 (v3.1)	Critical
CVE-2026-40911	WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side	avideo	10.0 (v3.1)	Critical
CVE-2026-50551	SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content	siyuan	9.9 (v3.1)	Critical
CVE-2026-54067	SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()	siyuan	9.9 (v3.1)	Critical
CVE-2015-4664	Xceedium Xsuite - Multiple Vulnerabilities	privileged access manager	9.8 (v3.0)	Critical
CVE-2015-4667	Xceedium Xsuite - Multiple Vulnerabilities	xsuite	9.8 (v3.0)	Critical
CVE-2018-6220	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	9.8 (v3.0)	Critical
CVE-2018-6223	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	9.8 (v3.0)	Critical
CVE-2018-6228	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	9.8 (v3.0)	Critical
CVE-2018-6229	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	9.8 (v3.0)	Critical
CVE-2023-1719	Bitrix Component - Cross-Site Scripting	bitrix24	9.8 (v3.1)	Critical
CVE-2024-31026	Greek Universities Network (GUnet) Open eClass Platform v.3.15 Arbitrary Code Execution Vulnerability	-	9.8 (v3.1)	Critical
CVE-2026-104252	Vitess vttablet /twopcz reflected XSS	vitess	9.8 (v3.1)	Critical
CVE-2026-67688	ICS-Park Smart Park Management System v2.0 Arbitrary Code Execution Vulnerability	ICS-Park Smart Park Management System v2.0	9.8 (v3.1)	Critical
CVE-2023-1892	Sidekiq < 7.0.8 - Cross-Site Scripting	sidekiq	9.6 (v3.1)	Critical
CVE-2025-67744	Mermaid XSS vulnerability leads to Remote Code Execution	deepchat	9.6 (v3.1)	Critical
CVE-2026-47428	Vitest browser mode serves unsanitized otelCarrier query parameter as inline script	vitest	9.6 (v3.1)	Critical
CVE-2026-53662	immich: One-click account takeover via XSS in login page continue redirect	immich	9.6 (v3.1)	Critical
CVE-2026-54694	NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover	skills-service	9.6 (v3.1)	Critical
CVE-2026-55085	Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite	etherpad	9.6 (v3.1)	Critical
CVE-2026-88804	Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher	Rancher	9.6 (v3.1)	Critical
CVE-2026-56397	SiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and README	SiYuan	9.4 (v4.0)	Critical
CVE-2026-61876	LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting	luci	9.4 (v4.0)	Critical
CVE-2026-73043	SiYuan before v3.7.4 Remote Code Execution via Template Calculation	siyuan	9.4 (v4.0)	Critical
CVE-2026-73044	SiYuan before v3.7.4 Stored Cross-Site Scripting via Column Width	siyuan	9.4 (v4.0)	Critical
CVE-2026-73050	SiYuan before v3.7.4 Stored XSS via select option color	siyuan	9.4 (v4.0)	Critical
CVE-2026-73052	SiYuan before v3.7.4 Stored XSS via Attribute-View Field Names	siyuan	9.4 (v4.0)	Critical
CVE-2026-73053	SiYuan before v3.7.4 Cross-Site Scripting via unicode2Emoji	siyuan	9.4 (v4.0)	Critical
CVE-2024-58355	Cal.com through 4.7.15 Cross-Site Scripting via booking questions	cal.diy	9.3 (v4.0)	Critical
CVE-2026-100720	Froxlor before 2.3.12 Stored XSS via SSL certificate issuer	froxlor	9.3 (v4.0)	Critical
CVE-2026-105086	WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encoded Video Title	AVideo	9.3 (v4.0)	Critical
CVE-2026-105089	WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templates	AVideo	9.3 (v4.0)	Critical
CVE-2026-18872	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities	financial transaction manager	9.3 (v3.1)	Critical
CVE-2026-40872	mailcow: dockerized vulnerable to stored XSS in autodiscover logs email address field	mailcow-dockerized	9.3 (v4.0)	Critical
CVE-2026-42849	authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover	authentik	9.3 (v3.1)	Critical
CVE-2026-45118	MyBB: Contact page reflected XSS	mybb	9.3 (v3.1)	Critical
CVE-2026-54527	JupyterLab Git: Stored XSS leading to RCE	jupyterlab-git	9.3 (v4.0)	Critical
CVE-2026-55486	Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS	goobi-viewer-core	9.3 (v3.1)	Critical
CVE-2026-57858	Cal.com Cal.diy 6.2.0 Stored XSS via BookingPageTagManager Analytics Tracking ID	Cal.com Self-Hosted (Cal.diy)	9.3 (v4.0)	Critical
CVE-2026-58491	Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter	warpgate	9.3 (v3.1)	Critical
CVE-2026-66394	SiYuan before v3.7.3 Stored and Reflected XSS via SVG Sanitizer Bypass	siyuan	9.3 (v4.0)	Critical
CVE-2026-66396	SiYuan before v3.7.2 Stored XSS to RCE via title-img IAL	siyuan	9.3 (v4.0)	Critical
CVE-2026-66418	OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field	openclaw agent dashboard	9.3 (v4.0)	Critical
CVE-2026-74902	SiYuan before v3.7.4 XSS-to-RCE via malicious filename upload	siyuan	9.3 (v4.0)	Critical
CVE-2026-78997	UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314) Cross-Site Scripting Vulnerability	UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314)	9.3 (v3.1)	Critical
CVE-2026-88866	WWBN AVideo LoginControl Stored XSS via User-Agent Header	AVideo	9.3 (v4.0)	Critical
CVE-2026-88867	WWBN AVideo Stored XSS via Category Name and Icon Class	AVideo	9.3 (v4.0)	Critical
CVE-2026-88868	AVideo LiveLinks Stored XSS via title and description fields	AVideo	9.3 (v4.0)	Critical
CVE-2026-88869	AVideo AD_Server Stored XSS via log.php label parameter	AVideo	9.3 (v4.0)	Critical
CVE-2026-89249	AVideo YPTWallet Stored XSS via CryptoWallet Configuration	AVideo	9.3 (v4.0)	Critical
CVE-2026-89253	AVideo Stored XSS via donationLink in watch page button	AVideo	9.3 (v4.0)	Critical
CVE-2026-89254	AVideo CustomizeUser Stored XSS via field_name Parameter	AVideo	9.3 (v4.0)	Critical
CVE-2026-89255	AVideo LoginControl Stored XSS via PGP Public Key	AVideo	9.3 (v4.0)	Critical
CVE-2026-89256	AVideo Bookmark Plugin Stored XSS via Chapter Names	AVideo	9.3 (v4.0)	Critical
CVE-2026-84189	LibreNMS before 26.7.0 Stored XSS via Oxidized API	librenms	9.2 (v4.0)	Critical
CVE-2026-89243	WWBN AVideo Stored XSS via UserGroups setGroup_name	AVideo	9.2 (v4.0)	Critical
CVE-2026-41201	CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS Version 2	ci4ms	9.1 (v3.1)	Critical
CVE-2026-34448	SiYuan: Stored XSS in Attribute View gallery/kanban cover rendering allows arbitrary command execution in the desktop cl	siyuan	9.0 (v3.1)	Critical
CVE-2026-34563	CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS	ci4ms	9.0 (v3.1)	Critical
CVE-2026-35198	HeyForm vulnerable to stored XSS via form field titles	heyform	9.0 (v3.1)	Critical
CVE-2026-42556	Postiz stored XSS in public preview page	postiz	9.0 (v3.1)	Critical
CVE-2026-44977	countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context	countly-server	9.0 (v3.1)	Critical
CVE-2026-55562	Cronicle: Stored XSS in admin Activity Log via account full_name field	Cronicle	9.0 (v3.1)	Critical
CVE-2026-55570	SiYuan: Stored XSS results to Electron RCE in SiYuan marketplace via unescaped `data-obj` attribute (Bypass for CVE-2026	siyuan	9.0 (v3.1)	Critical
CVE-2026-39328	ChurchCRM has Stored XSS in Social Profile Fields	churchcrm	8.9 (v3.1)	High
CVE-2026-40873	mailcow: dockerized vulnerable to stored XSS in Quarantine attachment filenames	mailcow-dockerized	8.9 (v4.0)	High
CVE-2026-43984	Tautulli has stored XSS in logFile via guest-controlled log_js_errors input	Tautulli	8.9 (v3.1)	High
CVE-2016-8526	Aruba AirWave 8.2.3 - XML External Entity Injection / Cross-Site Scripting	airwave	8.8 (v3.0)	High
CVE-2018-1213	Dell EMC Isilon OneFS - Multiple Vulnerabilities	emc isilon onefs	8.8 (v3.0)	High
CVE-2018-6224	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	8.8 (v3.0)	High
CVE-2021-20086	Odoo Apps - Cross-Site Scripting via Prototype Pollution	jquery-bbq	8.8 (v3.1)	High
CVE-2025-56798	Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier Cross-Site Request Forgery Vulnerability	Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier	8.8 (v3.1)	High
CVE-2025-66918	edoc-doctor-appointment-system Cross-Site Scripting Vulnerability	edoc-doctor-appointment-system	8.8 (v3.1)	High
CVE-2026-12968	Product Addons – WowAddons < 1.6.15 - Unauthenticated Stored XSS via Arbitrary SVG Upload	Product Addons and Product Options With Custom Fields	8.8 (v3.1)	High
CVE-2026-41473	CyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner Endpoints	cyberpanel	8.8 (v4.0)	High
CVE-2026-42455	LinkWarden: Stored XSS via Client-Side Archive Upload (Unsanitized HTML served from same origin)	linkwarden	8.8 (v4.0)	High
CVE-2026-55237	AutoGPT SignUp Page has DOM-Based XSS and Open Redirect	AutoGPT	8.8 (v3.1)	High
CVE-2026-56840	PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous to	PraisonAI	8.8 (v3.1)	High
CVE-2026-70650	GetSimple CMS: Authenticated Stored XSS in backup viewer (backup-edit.php) via output decoding of page meta fields and c	GetSimpleCMS-CE	8.8 (v4.0)	High
CVE-2026-8071	Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.79 - Unauthenticated Stored XSS via Comment Shortcode Bypass	Anti-Spam by CleanTalk. Spam protection	8.8 (v3.1)	High
CVE-2026-84259	click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications	click5 CRM add-on to WPForms	8.8 (v3.1)	High
CVE-2025-12716	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab	gitlab	8.7 (v3.1)	High
CVE-2025-62722	LinkAce: Stored XSS Vulnerability in Link Title Field Through Social Media Sharing Feature	linkace	8.7 (v4.0)	High
CVE-2026-109960	Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value	froxlor	8.7 (v4.0)	High
CVE-2026-12496	Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server	LIP-ME20xC	8.7 (v4.0)	High
CVE-2026-13323	open vsx Cross-site Scripting Vulnerability	open vsx	8.7 (v3.1)	High
CVE-2026-15217	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab	gitlab	8.7 (v3.1)	High
CVE-2026-28737	Gitea 3D file viewer allows stored XSS through glTF extensionsRequired	Gitea Open Source Git Server	8.7 (v3.1)	High
CVE-2026-35574	ChurchCRM has a Stored XSS in Person Profile - Add a Note	churchcrm	8.7 (v3.1)	High
CVE-2026-35576	ChurchCRM has Stored Cross-Site Scripting (XSS) in Person Properties via PrintView.php	churchcrm	8.7 (v3.1)	High
CVE-2026-39332	ChurchCRM has Reflected Cross-Site Scripting (XSS) in GeoPage.php	churchcrm	8.7 (v3.1)	High
CVE-2026-39333	ChurchCRM has Reflected XSS in DateStart/DateEnd parameters in FindFundRaiser.php	churchcrm	8.7 (v3.1)	High
CVE-2026-40262	Note Mark has Stored XSS via Unrestricted Asset Upload	note-mark	8.7 (v3.1)	High
CVE-2026-41938	Vvveb < 1.0.8.2 RCE via Media Upload Handler	Vvveb	8.7 (v4.0)	High
CVE-2026-42197	RELATE Vulnerable to Stored XSS via Unprivileged User Profile	relate	8.7 (v3.1)	High
CVE-2026-44667	Faction: Stored XSS in Remediation Verification Attachment Filename Preview Rendering	faction	8.7 (v3.1)	High
CVE-2026-44669	Faction: Stored XSS in Assessment Attachment Filename Preview Rendering	faction	8.7 (v3.1)	High
CVE-2026-44729	Twenty: Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers)	twenty	8.7 (v3.1)	High
CVE-2026-45115	MyBB: Buddy/ignore list username XSS	mybb	8.7 (v3.1)	High
CVE-2026-45116	MyBB: Profile field type confusion XSS	mybb	8.7 (v3.1)	High
CVE-2026-45270	CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule	ci4ms	8.7 (v3.1)	High
CVE-2026-46518	OpenEMR: Stored XSS in prescription CSS/HTML print view via patient demographics	openemr	8.7 (v3.1)	High
CVE-2026-47665	Penpot: Stored XSS via comment content, innerHTML renders unsanitized HTML	penpot	8.7 (v3.1)	High
CVE-2026-47743	Shopper: Multiple data integrity and disclosure issues in admin Livewire components	shopper	8.7 (v3.1)	High
CVE-2026-48026	lakeFS vulnerable to stored XSS in rendered markdown previews via raw HTML	lakeFS	8.7 (v3.1)	High
CVE-2026-48527	HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint	haxcms-nodejs	8.7 (v3.1)	High
CVE-2026-53758	Emlog: Stored XSS via Parsedown Markdown Processing - Raw HTML Not Sanitized	emlog	8.7 (v4.0)	High
CVE-2026-54049	Sakai Conversations has a Stored XSS Issue	sakai	8.7 (v3.1)	High
CVE-2026-54347	Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover	froxlor	8.7 (v3.1)	High
CVE-2026-55230	Vvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass using a quoted greater-than character	Vvveb	8.7 (v3.1)	High
CVE-2026-55872	GYM One admin user list is vulnerable to stored cross-site scripting	GYM-One	8.7 (v3.1)	High
CVE-2026-61875	luci-app-upnp Stored XSS via UPnP Port Mapping Description	luci	8.7 (v4.0)	High
CVE-2026-63459	Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions	vendure	8.7 (v3.1)	High
CVE-2026-68899	Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallback	wekan	8.7 (v3.1)	High
CVE-2026-71542	GetSimple CMS: Stored Cross-Site Scripting (XSS) via the "title" parameter in admin/components.php	GetSimpleCMS-CE	8.7 (v4.0)	High
CVE-2026-84683	Automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job st	Red Hat Ansible Automation Platform 2.5 for RHEL 8	8.7 (v3.1)	High
CVE-2024-23167	GestSup - Cross-Site Scripting	gestsup	8.6	High
CVE-2025-66024	XWiki Blog Application home page vulnerable to Stored XSS via Post Title	blog application	8.6 (v4.0)	High
CVE-2026-100645	SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban	siyuan	8.6 (v4.0)	High
CVE-2026-103904	Stored XSS Vulnerability in JTL-Shop	JTL-Shop	8.6 (v4.0)	High
CVE-2026-34463	MantisBT has Stored HTML Injection/XSS via Clone Issue Form	mantisbt	8.6 (v4.0)	High
CVE-2026-39338	ChurchCRM has Blind XSS via Global Search – Administrative Cookie Session Exfiltration	churchcrm	8.6 (v4.0)	High
CVE-2026-49864	wetty vulnerable to DOM XSS via file-download filename	wetty	8.6 (v4.0)	High
CVE-2026-59239	Stored XSS in Prospero Flow CRM email body allows administrator account takeover	Prospero Flow CRM	8.6 (v4.0)	High
CVE-2026-67328	@better-auth/sso before 1.6.21 Account Takeover via SSO	sso	8.6 (v4.0)	High
CVE-2026-84803	SiYuan before v3.8.2 Stored XSS via incomplete asset blocklist	siyuan	8.6 (v4.0)	High
CVE-2026-92985	SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels	siyuan	8.6 (v4.0)	High
CVE-2026-92986	SiYuan before 3.8.4 Cross-Site Scripting via Document Title	siyuan	8.6 (v4.0)	High
CVE-2026-9585	Unauthenticated Reflected Cross-Site Scripting (XSS) in Switchvox SMB Web Portal	Switchvox SMB Edition	8.6 (v4.0)	High
CVE-2025-39663	Cross Site Scripting through compromised remote site	checkmk	8.5 (v4.0)	High
CVE-2025-62172	Home Assistant vulnerable to Stored XSS in Energy dashboard from Energy Entity Name	core	8.5 (v4.0)	High
CVE-2026-100172	Stored XSS in AIL Framework extracted-match popovers via unescaped dynamic values in HTML-enabled data-content attribute	ail framework	8.5 (v4.0)	High
CVE-2026-100176	Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltip	ail framework	8.5 (v4.0)	High
CVE-2026-100643	SiYuan before v3.8.4 Stored XSS via Attribute View textarea	siyuan	8.5 (v4.0)	High
CVE-2026-21618	Cross-site scripting (XSS) in OAuth Device Authorization screen	hexpm	8.5 (v4.0)	High
CVE-2026-34932	hoppscotch: Stored XSS via mock server responses on backend origin	hoppscotch	8.5 (v4.0)	High
CVE-2026-55665	DOM-based XSS in Grist via unsanitized links, enabling privilege escalation	grist-core	8.5 (v4.0)	High
CVE-2026-58113	Teamcenter V2412 Cross-site Scripting Vulnerability	Teamcenter V2412	8.5 (v4.0)	High
CVE-2026-63361	LimeSurvey Community Edition 7.0.5+260623 - Reflected XSS in HTML editor popup	LimeSurvey	8.5 (v4.0)	High
CVE-2026-64851	Grav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlers	grav-plugin-shortcode-core	8.5 (v4.0)	High
CVE-2026-65986	CVAT has stored XSS via annotation guide assets	cvat	8.5 (v4.0)	High
CVE-2026-71483	Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View	horilla-hr	8.5 (v4.0)	High
CVE-2026-75933	Jet Admin Stored XSS	Jet Admin	8.5 (v4.0)	High
CVE-2026-100673	Grav Data Manager before 1.4.5 Stored XSS via item-detail view	grav-plugin-datamanager	8.4 (v4.0)	High
CVE-2026-15973	LimeSurvey 7.0.5 - Stored XSS in Survey Menu Entries	LimeSurvey	8.4 (v4.0)	High
CVE-2026-5385	GLPI 11.0.0 - Stored XSS in knowledge base	glpi	8.4 (v4.0)	High
CVE-2026-77072	n8n before 1.123.69 Stored XSS via Form Completion Page	n8n	8.4 (v4.0)	High
CVE-2026-77850	Stored XSS in AshAdmin relationship typeahead via unescaped label_field content	ash admin	8.4 (v4.0)	High
CVE-2026-85613	OpenPanel Unauthenticated XSS via SVG Favicon Proxy	openpanel	8.4 (v4.0)	High
CVE-2026-87814	SiYuan before v3.8.2 Stored XSS via Asset Preview	siyuan	8.4 (v4.0)	High
CVE-2026-44203	OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)	OpenAM	8.3 (v4.0)	High
CVE-2026-46367	phpMyFAQ - Stored XSS via Utils::parseUrl() in Comment Rendering	phpmyfaq	8.3 (v4.0)	High
CVE-2017-10075	Oracle Content Server - Cross-Site Scripting	webcenter content	8.2 (v3.0)	High
CVE-2026-104450	YesWiki before 4.6.7 ACL Bypass and Stored XSS via pointimage Action	yeswiki	8.2 (v4.0)	High
CVE-2026-34375	AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page	avideo	8.2 (v3.1)	High
CVE-2026-34725	dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration	dbgate	8.2 (v3.1)	High
CVE-2026-45627	Arcane: Unauthenticated reflected XSS via SVG color parameter in /api/app-images/logo enables admin account takeover	arcane	8.2 (v3.1)	High
CVE-2026-48788	Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing	remark42	8.2 (v3.0)	High
CVE-2026-54253	TS3 Manager: Reflected XSS via /api/download port parameter steals operator session	ts3-manager	8.2 (v3.1)	High
CVE-2026-56670	ComfyUI: Stored XSS via SVG file upload on the /view endpoint	ComfyUI	8.2 (v3.1)	High
CVE-2026-56736	phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission	phpMyFAQ	8.2 (v3.1)	High
CVE-2026-63135	YOURLS: Stored XSS in referrer statistics chart via crafted Referer header	YOURLS	8.2 (v3.1)	High
CVE-2026-86016	VNote: Stored XSS via YAML Frontmatter Leading to Local File Read and Remote Exfiltration	vnote	8.2 (v3.1)	High
CVE-2016-1337	Cisco EPC 3928 - Multiple Vulnerabilities	epc3928 firmware	8.1 (v3.0)	High
CVE-2018-6221	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	8.1 (v3.0)	High
CVE-2025-62716	Plane Vulnerable to Cross-Site Scripting via Open Redirect in ?next_path Parameter	plane	8.1 (v3.1)	High
CVE-2025-68147	opensourcepos has a Cross-site Scripting vulnerability	open source point of sale	8.1 (v3.1)	High
CVE-2026-18147	Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url	Red Hat Enterprise Linux 10	8.1 (v3.1)	High
CVE-2026-33437	Stirling PDF: Stored XSS in Info Summary	Stirling-PDF	8.1 (v3.1)	High
CVE-2026-39344	Reflected XSS the login page through the 'username' parameter	churchcrm	8.1 (v3.0)	High
CVE-2026-48060	Litestar: HTML Injection Through CSRF Token	litestar	8.1 (v3.1)	High
CVE-2026-48081	OpenReception vulnerable to stored click-triggered XSS via javascript: tenant links rendered into patient-facing footer	appointment-booking-software	8.1 (v3.1)	High
CVE-2026-50758	DayuanJiang next-ai-draw-io 0.4.13 Arbitrary Code Execution Vulnerability	DayuanJiang next-ai-draw-io 0.4.13	8.1 (v3.1)	High
CVE-2025-12029	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab	gitlab	8.0 (v3.1)	High
CVE-2026-35575	ChurchCRM has Stored XSS in Group Name	churchcrm	8.0 (v3.1)	High
CVE-2026-58390	OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views	core	8.0 (v3.1)	High
CVE-2015-4669	Xceedium Xsuite - Multiple Vulnerabilities	xsuite	7.8 (v3.0)	High
CVE-2018-6222	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	7.8 (v3.0)	High
CVE-2026-55659	Grist: XSS through unsafe value interpolation in server-rendered pages	grist-core	7.7 (v3.1)	High
CVE-2026-107303	JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob	generator-jhipster	7.6 (v3.1)	High
CVE-2026-116167	SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter	siyuan	7.6 (v4.0)	High
CVE-2026-16969	DFIR-IRIS Stored XSS in Assets	iris-web	7.6 (v3.1)	High
CVE-2026-18360	DFIR-IRIS Stored XSS in Custom Attributes	iris-web	7.6 (v3.1)	High
CVE-2026-18361	DFIR-IRIS Stored XSS in Datastore Upload	iris-web	7.6 (v3.1)	High
CVE-2026-32308	OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose")	oneuptime	7.6 (v3.1)	High
CVE-2026-35534	ChurchCRM has Stored XSS in PersonView.php via Facebook Field Attribute Injection	churchcrm	7.6 (v3.1)	High
CVE-2026-40283	WeGIA has stored XSS in profile_paciente.php	wegia	7.6 (v3.1)	High
CVE-2026-54506	Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field	Vvveb	7.6 (v3.1)	High
CVE-2026-59814	Joplin: Stored XSS via inline-served note attachment on published shares	joplin	7.6 (v3.1)	High
CVE-2026-77394	OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget	cosmos	7.6 (v3.1)	High
CVE-2013-6041	Webuzo 2.1.3 - Multiple Vulnerabilities	webuzo	7.5 (v2.0)	High
CVE-2015-6401	Cisco EPC 3928 - Multiple Vulnerabilities	epc3928 docsis 3.0 8x4 wireless residential gateway with embedded digital voice adapter	7.5 (v2.0)	High
CVE-2016-1328	Cisco EPC 3928 - Multiple Vulnerabilities	epc3928 firmware	7.5 (v3.0)	High
CVE-2016-1336	Cisco EPC 3928 - Multiple Vulnerabilities	epc3928 firmware	7.5 (v3.0)	High
CVE-2026-12592	SlimStat Analytics < 5.5.0 - Unauthenticated Stored XSS via CF-IPCountry Header	SlimStat Analytics	7.5 (v3.1)	High
CVE-2026-18983	One User Avatar \| User Profile Picture <= 2.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wpua-file	One User Avatar \| User Profile Picture	7.5 (v3.1)	High
CVE-2026-40286	WeGIA has Cross-Site Scripting in Controle de Contribuição	WeGIA	7.5 (v3.1)	High
CVE-2026-44657	MantisBT: Stored XSS in File Download	mantisbt	7.5 (v4.0)	High
CVE-2026-67237	RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint	rabbitmq server	7.5 (v4.0)	High
CVE-2026-73546	Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)	envoy	7.4 (v3.1)	High
CVE-2026-7460	mailcow-dockerized 2026-03b - Stored XSS in Queue Manager via unescaped	mailcow-dockerized	7.4 (v4.0)	High
CVE-2026-87812	SiYuan before v3.8.2 Stored XSS via Bazaar iconURL	siyuan	7.4 (v4.0)	High
CVE-2026-91775	LimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS survey-import warnings	LimeSurvey	7.4 (v4.0)	High
CVE-2025-11189	kiwire Cross-Site Scripting Vulnerability	kiwire	7.3 (v3.1)	High
CVE-2025-68927	Improper Neutralization of HTML Tags in a Web Page in libredesk	libredesk	7.3 (v4.0)	High
CVE-2026-30819	Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameter	iTop	7.3 (v3.1)	High
CVE-2026-6735	XSS within PHP-FPM status endpoint	php	7.3 (v4.0)	High
CVE-2026-8203	Concrete CMS 9.5.0 and below has Stored XSS on the height parameter	concrete cms	7.3 (v4.0)	High
CVE-2025-14151	SlimStat Analytics <= 5.3.2 - Unauthenticated Stored Cross-Site Scripting	SlimStat Analytics	7.2 (v3.1)	High
CVE-2025-66921	open source point of sale Cross-Site Scripting Vulnerability	open source point of sale	7.2 (v3.1)	High
CVE-2025-66923	open source point of sale Cross-Site Scripting Vulnerability	open source point of sale	7.2 (v3.1)	High
CVE-2026-101928	Magic Tooltips For Contact Form 7 <= 1.0.34 - Unauthenticated Stored Cross-Site Scripting via 'esc_html' Filter Override	Magic Tooltips For Contact Form 7	7.2 (v3.1)	High
CVE-2026-102626	LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attribute	LimeSurvey	7.2 (v4.0)	High
CVE-2026-107764	SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Inspector hre	SiteOrigin CSS	7.2 (v3.1)	High
CVE-2026-13425	Database for CF7 <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting via Array Form Field Values	Database for CF7	7.2 (v3.1)	High
CVE-2026-15401	VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Unauthenticated Stored Cross-Site Scripting via Custom Field 'vbfX' Pa	VikBooking Hotel Booking Engine & PMS	7.2 (v3.1)	High
CVE-2026-15780	WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter	WP Statistics – Simple, privacy-friendly Google Analytics alternative	7.2 (v3.1)	High
CVE-2026-16143	VikRentItems Flexible Rental Management System <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting	VikRentItems Flexible Rental Management System	7.2 (v3.1)	High
CVE-2026-16809	LimeSurvey Community Edition 7.0.5 - Stored XSS in quota message rendering	LimeSurvey	7.2 (v4.0)	High
CVE-2026-17506	Independent Analytics <= 2.15.0 - Unauthenticated Stored Cross-Site Scripting	Independent Analytics – WordPress Analytics Plugin	7.2 (v3.1)	High
CVE-2026-18430	HumHub 1.18.4 - Stored XSS in comment-deletion notifications through unescaped administrator reason	HumHub	7.2 (v4.0)	High
CVE-2026-18756	HumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button rendering	HumHub	7.2 (v4.0)	High
CVE-2026-4267	Query Monitor <= 3.20.3 - Reflected Cross-Site Scripting via Request URI	Query Monitor	7.2 (v3.1)	High
CVE-2026-43874	WWBN AVideo: Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via	AVideo	7.2 (v3.1)	High
CVE-2026-7534	SUMO Reward Points for WooCommerce <= 32.7.0 - Unauthenticated Stored Cross-Site Scripting via 'reason' Parameter	SUMO Reward Points for WooCommerce	7.2 (v3.1)	High
CVE-2026-75528	Broken Link Checker <= 2.4.13 - Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Log	Broken Link Checker	7.2 (v3.1)	High
CVE-2026-83625	Contact Form by Supsystic <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via IP Address Header	Contact Form by Supsystic	7.2 (v3.1)	High
CVE-2026-87091	Welcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters	Welcart e-Commerce	7.2 (v3.1)	High
CVE-2026-89417	OMGF \| GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 6.3.10 - Unauthenticated Stored Cross-Site Scripting via 's'	OMGF \| GDPR/DSGVO Compliant, Faster Google Fonts. Easy.	7.2 (v3.1)	High
CVE-2026-93654	Premium Packages <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter	Premium Packages – Sell Digital Products Securely	7.2 (v3.1)	High
CVE-2026-93756	Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in A	Smash Balloon Social Post Feed – Simple Social Feeds for WordPress	7.2 (v3.1)	High
CVE-2026-93775	Podlove Podcast Publisher <= 4.5.6 - Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook	Podlove Podcast Publisher	7.2 (v3.1)	High
CVE-2026-93875	JetAppointment <= 2.5.2.1 - Unauthenticated Stored Cross-Site Scripting via 'friendlyTime' Parameter	JetAppointment	7.2 (v3.1)	High
CVE-2026-95670	No External Links <= 5.2.0 - Unauthenticated Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect	No External Links	7.2 (v3.1)	High
CVE-2026-96561	AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advi	AI Engine – The Chatbot, AI Framework & MCP for WordPress	7.2 (v3.1)	High
CVE-2026-96566	Newsletter <= 9.4.0 - Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field Parameter	Newsletter – Send awesome emails from WordPress	7.2 (v3.1)	High
CVE-2022-35499	In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint Cross-Site Scripting Vulnerability	-	7.1 (v3.1)	High
CVE-2025-11560	Team Members Showcase < 3.5.0 - Reflected XSS	Team Members Showcase	7.1 (v3.1)	High
CVE-2025-11682	Stored Cross-Site Scripting in Perx Customer Engagement & Loyalty Platform	Customer Engagement & Loyalty Platform	7.1 (v4.0)	High
CVE-2025-13072	HandL UTM Grabber / Tracker < 2.8.1 - Reflected XSS via utm_source	HandL UTM Grabber / Tracker	7.1 (v3.1)	High
CVE-2025-13073	HandL UTM Grabber / Tracker < 2.8.1 - Reflected XSS via handl_landing_page	HandL UTM Grabber / Tracker	7.1 (v3.1)	High
CVE-2025-14701	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller	crafty controller	7.1 (v3.1)	High
CVE-2026-115457	baserCMS: Unauthenticated Stored XSS via Shortcode Expansion in Blog Comments	basercms	7.1 (v3.1)	High
CVE-2026-12970	LearnPress < 4.4.1 - Reflected XSS via c_search	LearnPress	7.1 (v3.1)	High
CVE-2026-14239	Tourmaster < 5.4.8 - Stored XSS via CSRF	tourmaster	7.1 (v3.1)	High
CVE-2026-34598	YesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter"	yeswiki	7.1 (v4.0)	High
CVE-2026-41576	Ajax30/BraveCMS-2.0: Stored HTML Injection in Contact Email via nl2br() and Unescaped Blade Template	BraveCMS-2.0	7.1 (v3.1)	High
CVE-2026-6495	WordPress Ajax Load More < 7.8.4 - Reflected Cross-Site Scripting	ajax-load-more	7.1 (v3.1)	High
CVE-2026-6858	Transbank Webpay < 1.14.0 - Unauthenticated Stored XSS	Transbank Webpay	7.1 (v3.1)	High
CVE-2026-84192	LibreNMS before 26.3.1 Stored XSS via SNMP/Syslog Data	librenms	7.1 (v4.0)	High
CVE-2026-93485	WordPress Core < 7.1.1 - Unauthenticated Stored XSS via Comment (Comment2Shell)	WordPress	7.1 (v3.1)	High
CVE-2026-55746	Cotonti stored XSS via PFS folder title	Cotonti	7.0 (v4.0)	High
CVE-2026-58411	ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values	CRM	7.0 (v4.0)	High
CVE-2026-80426	FiftyOne before 1.21.0 Stored Cross-Site Scripting via Unescaped Field Description	fiftyone	7.0 (v4.0)	High
CVE-2025-11183	Cross-Site Scripting Vulnerability in QWC2	QWC2	6.9 (v4.0)	Medium
CVE-2025-11184	Cross-Site Scripting Vulnerability in QWC2 Registration GUI	qwc-registration-gui	6.9 (v4.0)	Medium
CVE-2025-11937	Stored XSS through a system message in SecurePoll	Mediawiki - SecurePoll Extension	6.9 (v4.0)	Medium
CVE-2025-43779	digital experience platform Cross-Site Scripting Vulnerability	digital experience platform	6.9 (v4.0)	Medium
CVE-2025-4388	Liferay Portal - Cross-Site Scripting	digital experience platform	6.9 (v4.0)	Medium
CVE-2025-59746	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	6.9 (v4.0)	Medium
CVE-2025-59747	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	6.9 (v4.0)	Medium
CVE-2025-59748	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	6.9 (v4.0)	Medium
CVE-2025-59749	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	6.9 (v4.0)	Medium
CVE-2025-59755	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	6.9 (v4.0)	Medium
CVE-2025-62597	WeGIA Vulnerable to Reflected Cross-Site Scripting via Endpoint 'pessoa/editar_info_pessoal.php' Parameter 'sql'	wegia	6.9 (v4.0)	Medium
CVE-2025-62598	WeGIA Vulnerable to Reflected Cross-Site Scripting via Endpoint 'pessoa/editar_info_pessoal.php' Parameter 'action'	wegia	6.9 (v4.0)	Medium
CVE-2025-62613	VDO.Ninja - DOM-Based Cross-Site Scripting	vdo.ninja	6.9 (v4.0)	Medium
CVE-2025-62662	Stored XSS through system messages in AdvancedSearch	Mediawiki - AdvancedSearch Extension	6.9 (v4.0)	Medium
CVE-2025-62663	Stored XSS through a system message in UploadWizard	Mediawiki - UploadWizard Extension	6.9 (v4.0)	Medium
CVE-2025-62664	Stored XSS through a system message in ImageRating	Mediawiki - ImageRating Extension	6.9 (v4.0)	Medium
CVE-2025-62670	Stored XSS through a system message in FlexDiagrams	Mediawiki - FlexDiagrams Extension	6.9 (v4.0)	Medium
CVE-2025-62671	Stored XSS through wikitext in Cargo	Mediawiki - Cargo Extension	6.9 (v4.0)	Medium
CVE-2025-62693	Stored XSS through system messages in LastModified	Mediawiki - LastModified Extension	6.9 (v4.0)	Medium
CVE-2025-62695	Stored XSS through system messages	Mediawiki - WikiLambda Extension	6.9 (v4.0)	Medium
CVE-2025-62698	Stored XSS through system messages in ExternalGuidance	Mediawiki - ExternalGuidance	6.9 (v4.0)	Medium
CVE-2025-62700	Stored XSS through a system message in MultiBoilerplate	Mediawiki - MultiBoilerplate Extensionmaste	6.9 (v4.0)	Medium
CVE-2026-14358	Stored XSS in Wikimedia Chart pie tooltip via Data:*.tab field title	mediawiki	6.9 (v4.0)	Medium
CVE-2026-39422	MaxKB has Stored XSS via ChatHeadersMiddleware	maxkb	6.9 (v4.0)	Medium
CVE-2026-39838	ProofreadPage improperly sanitizes multiline styles using Sanitizer::checkCSS	MediaWiki - ProofreadPage Extension	6.9 (v4.0)	Medium
CVE-2026-39936	Stored XSS in Score due to usage of non-reserved data attributes	Mediawiki - Score Extension	6.9 (v4.0)	Medium
CVE-2026-40598	MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page	mantisbt	6.9 (v4.0)	Medium
CVE-2026-42138	Dify Vulnerable to Stored XSS via SVG-file upload	dify	6.9 (v4.0)	Medium
CVE-2026-44651	SillyTavern: Reflected XSS vulnerability in the CORS proxy middleware	SillyTavern	6.9 (v4.0)	Medium
CVE-2026-59238	Stored XSS in Pentestify via unsanitized finding images and report client logo	Pentestify	6.9 (v4.0)	Medium
CVE-2026-69092	Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpoint	admidio	6.9 (v4.0)	Medium
CVE-2026-73848	Emlog: Stored XSS via Tag Name in Article Editor	emlog	6.9 (v4.0)	Medium
CVE-2026-86188	AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting	AVideo	6.9 (v4.0)	Medium
CVE-2018-6230	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	6.8 (v3.0)	Medium
CVE-2025-9978	Jeg Elementor Kit < 2.7.0 - Author+ Stored XSS	Jeg Kit for Elementor	6.8 (v3.1)	Medium
CVE-2026-13605	Photo Swipe <= 4.1.1.1 - Author+ Stored XSS via title Attribute	PhotoSwipe	6.8 (v3.1)	Medium
CVE-2026-14817	Element Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data Attributes	Element Pack Addons for Elementor	6.8 (v3.1)	Medium
CVE-2026-14827	Calendar < 1.3.18 - Contributor+ Stored XSS via event_link Parameter	Calendar	6.8 (v3.1)	Medium
CVE-2026-14833	Lightbox with PhotoSwipe < 5.9.0 - Author+ Stored XSS via data-lbwps-caption Attribute	Lightbox with PhotoSwipe	6.8 (v3.1)	Medium
CVE-2026-15047	s2Member < 260805 - Contributor+ Stored XSS via Shortcode	s2Member	6.8 (v3.1)	Medium
CVE-2026-16559	YMC Filter < 3.12.9 - Author+ Stored XSS via SVG Icon Upload	YMC Filter	6.8 (v3.1)	Medium
CVE-2026-33741	EspoCRM: Stored XSS via SVG attachment loading same-origin JavaScript	espocrm	6.8 (v3.1)	Medium
CVE-2026-39311	Trilium Notes: Stored XSS Leads to Unauthorized Remote Code Execution (RCE) via Unsanitized SVG Attachments	Trilium	6.8 (v3.1)	Medium
CVE-2026-40284	WeGIA has stored XSS in listar_despachos.php	WeGIA	6.8 (v3.1)	Medium
CVE-2026-45025	WeGIA: Stored XSS in html/atendido/etapa_processo.php	WeGIA	6.8 (v3.1)	Medium
CVE-2026-45026	WeGIA: Stored XSS in html/atendido/processo_aceitacao.php	WeGIA	6.8 (v3.1)	Medium
CVE-2026-67352	luci-app-https-dns-proxy Stored XSS via resolver_url	luci	6.8 (v4.0)	Medium
CVE-2018-1203	Dell EMC Isilon OneFS - Multiple Vulnerabilities	emc isilon onefs	6.7 (v3.0)	Medium
CVE-2018-1204	Dell EMC Isilon OneFS - Multiple Vulnerabilities	emc isilon onefs	6.7 (v3.0)	Medium
CVE-2018-6219	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	6.5 (v3.0)	Medium
CVE-2025-32430	XWiki Platform - Cross-Site Scripting	xwiki-platform	6.5 (v4.0)	Medium
CVE-2025-61224	DokuWiki <= 2025-05-14a Librarian - Reflected Cross-Site Scripting	dokuwiki	6.5 (v3.1)	Medium
CVE-2026-24128	XWiki Platform Distribution Flavor Main - Cross-Site Scripting	xwiki-platform-distribution-flavor-main	6.5 (v4.0)	Medium
CVE-2026-55549	Yamcs <=5.8.6 - Cross-Site Scripting	yamcs	6.5 (v3.1)	Medium
CVE-2026-78838	AppNitro MachForm v30 Cross-Site Scripting Vulnerability	AppNitro MachForm v30	6.5 (v3.1)	Medium
CVE-2026-88618	1024-lab SmartAdmin v3.30.0 Arbitrary Code Execution Vulnerability	1024-lab SmartAdmin v3.30.0	6.5 (v3.1)	Medium
CVE-2025-10128	Eulerpool Research Systems <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	Eulerpool Research Systems	6.4 (v3.1)	Medium
CVE-2025-10130	Layers <= 0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting	Layers	6.4 (v3.1)	Medium
CVE-2025-10139	WP BookWidgets <= 0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting	WP BookWidgets	6.4 (v3.1)	Medium
CVE-2025-10189	BP Direct Menus <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	BP Direct Menus	6.4 (v3.1)	Medium
CVE-2025-12666	Google Drive upload and download link <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	Google Drive upload and download link	6.4 (v3.1)	Medium
CVE-2025-13135	HotelRunner Booking Widget <= 5.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting	HotelRunner Booking Widget	6.4 (v3.1)	Medium
CVE-2025-14387	LearnPress – WordPress LMS Plugin <= 4.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via get_profile_soc	LearnPress – WordPress LMS Plugin for Create and Sell Online Courses	6.4 (v3.1)	Medium
CVE-2025-47828	H5P-Nodejs-library Cross-site Scripting Vulnerability	H5P-Nodejs-library	6.4 (v3.1)	Medium
CVE-2025-9130	Unify <= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via unify_checkout Shortcode	Unify	6.4 (v3.1)	Medium
CVE-2025-9206	Meks Easy Maps <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting	Meks Easy Maps	6.4 (v3.1)	Medium
CVE-2026-0552	Simple Shopping Cart <= 5.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsc_display_product' Shor	Simple Shopping Cart	6.4 (v3.1)	Medium
CVE-2026-0626	WPFunnels <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode	WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell	6.4 (v3.1)	Medium
CVE-2026-0737	Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode	WP Shortcodes Plugin — Shortcodes Ultimate	6.4 (v3.1)	Medium
CVE-2026-0738	Shortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode	WP Shortcodes Plugin — Shortcodes Ultimate	6.4 (v3.1)	Medium
CVE-2026-100106	FiboSearch <= 1.34.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'purchased_plan' Parameter	FiboSearch – Ajax Search for WooCommerce	6.4 (v3.1)	Medium
CVE-2026-101925	bbp style pack <= 6.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Author Display Name	bbp style pack	6.4 (v3.1)	Medium
CVE-2026-109983	YMC Filter <= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' Parameter	YMC Filter	6.4 (v3.1)	Medium
CVE-2026-15446	EWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Att	EWWW Image Optimizer	6.4 (v3.1)	Medium
CVE-2026-16786	Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_testimonials_output S	Live Composer – Free WordPress Website Builder	6.4 (v3.1)	Medium
CVE-2026-16788	Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_projects_output Short	Live Composer – Free WordPress Website Builder	6.4 (v3.1)	Medium
CVE-2026-18400	Slider, Gallery, and Carousel by MetaSlider <= 3.111.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'delay'	Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider	6.4 (v3.1)	Medium
CVE-2026-18488	Blocksy Companion <= 2.1.51 - Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy	Blocksy Companion	6.4 (v3.1)	Medium
CVE-2026-23758	GFI HelpDesk < 4.99.9 Stored XSS via editsubject Parameter	helpdesk	6.4 (v4.0)	Medium
CVE-2026-3885	WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_bo	Shortcodes Ultimate – Content Elements	6.4 (v3.1)	Medium
CVE-2026-42870	WeGIA: Cross-Site Scripting (XSS) Stored endpoint 'informacao_adicional.php' parameter 'descricao'	WeGIA	6.4 (v4.0)	Medium
CVE-2026-45797	HeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Upload	heyform	6.4 (v4.0)	Medium
CVE-2026-50592	Znuny Cross-Site Scripting Vulnerability	Znuny	6.4 (v3.1)	Medium
CVE-2026-52781	OpenProject: Stored XSS on openproject.example.com through /api/v3/projects/{project}/work_packages via POST parameter "	openproject	6.4 (v3.1)	Medium
CVE-2026-5391	LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	Appointment Booking Plugin – LatePoint \| Calendar & Scheduling for WordPress	6.4 (v3.1)	Medium
CVE-2026-6454	Firelight Lightbox <= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad 'href' At	Firelight Lightbox	6.4 (v3.1)	Medium
CVE-2026-6565	Style Kits – Advanced Theme Styles for Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via	Style Kits for Elementor	6.4 (v3.1)	Medium
CVE-2026-87870	Ninja Forms - Scheduled Exports <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Paramete	Ninja Forms - Scheduled Exports	6.4 (v3.1)	Medium
CVE-2026-8791	Booking System Trafft <= 1.0.17 - Authenticated (Subscriber+) Stored Cross-Site Scripting	Booking System Trafft	6.4 (v3.1)	Medium
CVE-2026-97396	Email Marketing for WordPress and WooCommerce <= 1.0.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'd	Email Marketing for WordPress and WooCommerce – Retainful	6.4 (v3.1)	Medium
CVE-2026-100190	Stored Cross-Site Scripting (XSS) via Crawler Capture Import in AIL Framework showDomain Page	ail framework	6.3 (v4.0)	Medium
CVE-2026-115513	OpenCATS before 0.12.0 Stored XSS via MRU Navigation Panel	OpenCATS	6.3 (v4.0)	Medium
CVE-2026-43980	Malla: Stored XSS via Meshtastic node names in multiple frontend pages	malla	6.3 (v3.1)	Medium
CVE-2025-34281	Stored Cross-Site Scripting (XSS) in ThingsBoard	thingsboard	6.2 (v4.0)	Medium
CVE-2025-66311	Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters	grav-plugin-admin	6.2 (v4.0)	Medium
CVE-2025-66312	Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/accounts/groups/[group]` parameter `d	grav-plugin-admin	6.2 (v4.0)	Medium
CVE-2026-44737	grav-plugin-admin: Stored Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][titl	grav-plugin-admin	6.2 (v4.0)	Medium
CVE-2026-55481	Snipe-IT: CSS Injection via `header_color` Setting	snipe-it	6.2 (v4.0)	Medium
CVE-2015-4668	Xceedium Xsuite - Multiple Vulnerabilities	xsuite	6.1 (v3.0)	Medium
CVE-2016-15041	MainWP Dashboard <= 3.1.2 - Stored Cross-Site Scripting	mainwp dashboard	6.1 (v3.1)	Medium
CVE-2016-8527	Aruba AirWave 8.2.3 - XML External Entity Injection / Cross-Site Scripting	airwave	6.1 (v3.0)	Medium
CVE-2017-12583	DokuWiki - Cross-Site Scripting	dokuwiki	6.1 (v3.0)	Medium
CVE-2017-7855	IceWarp WebMail 11.3.1.5 - Cross-Site Scripting	server	6.1 (v3.0)	Medium
CVE-2017-9140	Reflected XSS - Telerik Reporting Module	telerik reporting	6.1 (v3.0)	Medium
CVE-2018-10383	Lantronix SecureLinx Spider (SLS) 2.2+ - Cross-Site Scripting	securelinx spider firmware	6.1 (v3.0)	Medium
CVE-2018-11227	Monstra CMS <=3.0.4 - Cross-Site Scripting	monstra cms	6.1 (v3.0)	Medium
CVE-2018-13380	Fortinet FortiOS - Cross-Site Scripting	fortios	6.1 (v3.1)	Medium
CVE-2018-16833	ManageEngine Desktop Central 10.0.271 - Cross-Site Scripting	manageengine desktop central	6.1 (v3.0)	Medium
CVE-2018-19287	WordPress Ninja Forms <3.3.18 - Cross-Site Scripting	ninja forms	6.1 (v3.0)	Medium
CVE-2018-6882	zimbra collaboration suite Cross-Site Scripting Vulnerability	zimbra collaboration suite	6.1 (v3.1)	Medium
CVE-2018-7653	YzmCMS v3.6 - Cross-Site Scripting	yzmcms	6.1 (v3.0)	Medium
CVE-2019-10475	Jenkins build-metrics 1.3 - Cross-Site Scripting	build-metrics	6.1 (v3.1)	Medium
CVE-2019-11507	Pulse Secure Pulse Connect Secure - Cross-Site Scripting (Reflected)	connect secure	6.1 (v3.1)	Medium
CVE-2019-14470	WordPress UserPro 4.9.32 - Cross-Site Scripting	instagram-php-api	6.1 (v3.0)	Medium
CVE-2019-15811	DomainMOD <=4.13.0 - Cross-Site Scripting	domainmod	6.1 (v3.0)	Medium
CVE-2019-20141	WordPress Laborator Neon Theme 2.0 - Cross-Site Scripting	neon	6.1 (v3.1)	Medium
CVE-2020-1106	Microsoft Office SharePoint XSS Vulnerability	sharepoint enterprise server	6.1 (v3.1)	Medium
CVE-2020-12054	WordPress Catch Breadcrumb <1.5.4 - Cross-Site Scripting	catch breadcrumb	6.1 (v3.1)	Medium
CVE-2020-13820	Extreme Management Center 8.4.1.24 - Cross-Site Scripting	extreme management center	6.1 (v3.1)	Medium
CVE-2020-14413	NeDi 1.9C - Cross-Site Scripting	nedi	6.1 (v3.1)	Medium
CVE-2020-15500	TileServer GL <=3.0.0 - Cross-Site Scripting	tileservergl	6.1 (v3.1)	Medium
CVE-2020-15718	RosarioSIS 6.7.2 - Cross-Site Scripting	rosariosis	6.1 (v3.1)	Medium
CVE-2020-23814	XXL-JOB v2.2.0 — Stored Cross Site Scripting	xxl-job	6.1 (v3.1)	Medium
CVE-2020-27982	IceWarp WebMail 11.4.5.0 - Cross-Site Scripting	mail server	6.1 (v3.1)	Medium
CVE-2020-29164	PacsOne Server <7.1.1 - Cross-Site Scripting	pacsone server	6.1 (v3.1)	Medium
CVE-2020-29395	Wordpress EventON Calendar 3.0.5 - Cross-Site Scripting	eventon	6.1 (v3.1)	Medium
CVE-2020-3580	Cisco ASA/FTD Software - Cross-Site Scripting	firepower threat defense	6.1 (v3.1)	Medium
CVE-2020-7107	WordPress Ultimate FAQ <1.8.30 - Cross-Site Scripting	ultimate faq	6.1 (v3.1)	Medium
CVE-2020-8512	IceWarp WebMail Server <=11.4.4.1 - Cross-Site Scripting	icewarp server	6.1 (v3.1)	Medium
CVE-2021-20137	Gryphon Tower - Cross-Site Scripting	gryphon tower	6.1 (v3.1)	Medium
CVE-2021-20323	Keycloak 10.0.0 - 18.0.0 - Cross-Site Scripting	keycloak	6.1 (v3.1)	Medium
CVE-2021-21801	Advantech R-SeeNet - Cross-Site Scripting	r-seenet	6.1 (v3.1)	Medium
CVE-2021-21802	Advantech R-SeeNet - Cross-Site Scripting	r-seenet	6.1 (v3.1)	Medium
CVE-2021-21803	Advantech R-SeeNet - Cross-Site Scripting	r-seenet	6.1 (v3.1)	Medium
CVE-2021-24235	WordPress Goto Tour & Travel Theme <2.0 - Cross-Site Scripting	goto	6.1 (v3.1)	Medium
CVE-2021-24237	WordPress Realteo <=1.2.3 - Cross-Site Scripting	findeo	6.1 (v3.1)	Medium
CVE-2021-24245	WordPress Plugin Stop Spammers 2021.8 - 'log' Reflected Cross-site Scripting (XSS)	stop spammers	6.1 (v3.1)	Medium
CVE-2021-24300	WordPress WooCommerce <1.13.22 - Cross-Site Scripting	product slider for woocommerce	6.1 (v3.1)	Medium
CVE-2021-24435	WordPress Titan Framework plugin <= 1.12.1 - Cross-Site Scripting	titan framework	6.1 (v3.1)	Medium
CVE-2021-24488	WordPress Post Grid <2.1.8 - Cross-Site Scripting	post grid	6.1 (v3.1)	Medium
CVE-2021-24495	Wordpress Marmoset Viewer <1.9.3 - Cross-Site Scripting	marmoset viewer	6.1 (v3.1)	Medium
CVE-2021-24498	WordPress Calendar Event Multi View <1.4.01 - Cross-Site Scripting	calendar event multi view	6.1 (v3.1)	Medium
CVE-2021-24875	WordPress eCommerce Product Catalog <3.0.39 - Cross-Site Scripting	ecommerce product catalog	6.1 (v3.1)	Medium
CVE-2021-26947	Odoo <= 15.0 - Cross-Site Scripting	odoo	6.1 (v3.1)	Medium
CVE-2021-27519	FUDForum 3.1.0 - Cross-Site Scripting	fudforum	6.1 (v3.1)	Medium
CVE-2021-27520	FUDForum 3.1.0 - Cross-Site Scripting	fudforum	6.1 (v3.1)	Medium
CVE-2021-27695	openMAINT openMAINT 2.1-3.3-b - 'Multiple' Persistent Cross-Site Scripting	openmaint	6.1 (v3.1)	Medium
CVE-2021-3002	Seo Panel 4.8.0 - Cross-Site Scripting	seo panel	6.1 (v3.1)	Medium
CVE-2021-30134	Php-mod/curl Library <2.3.2 - Cross-Site Scripting	php curl class	6.1 (v3.1)	Medium
CVE-2021-30203	Dzzoffice 2.02.1 - Cross-Site Scripting	dzzoffice	6.1 (v3.1)	Medium
CVE-2021-3030	Cute Editor for ASP.NET 6.4 Cross-Site Scripting Vulnerability	-	6.1 (v3.1)	Medium
CVE-2021-31589	BeyondTrust Secure Remote Access Base <=6.0.1 - Cross-Site Scripting	appliance base software	6.1 (v3.1)	Medium
CVE-2021-33829	Drupal 7 CKEditor XSS	ckeditor	6.1 (v3.1)	Medium
CVE-2021-42567	Apereo CAS Cross-Site Scripting	central authentication service	6.1 (v3.1)	Medium
CVE-2021-43062	Fortinet FortiMail 7.0.1 - Cross-Site Scripting	fortimail	6.1 (v3.1)	Medium
CVE-2021-46387	Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting (XSS)	zywall 2 plus internet security appliance firmware	6.1 (v3.1)	Medium
CVE-2022-0201	WordPress Permalink Manager <2.2.15 - Cross-Site Scripting	permalink manager lite	6.1 (v3.1)	Medium
CVE-2022-0208	WordPress Plugin MapPress <2.73.4 - Cross-Site Scripting	mappress	6.1 (v3.1)	Medium
CVE-2022-0346	WordPress XML Sitemap Generator for Google <2.0.4 - Cross-Site Scripting/Remote Code Execution	xml sitemap generator	6.1 (v3.1)	Medium
CVE-2022-0533	Ditty (formerly Ditty News Ticker) < 3.0.15 - Cross-Site Scripting	ditty	6.1 (v3.1)	Medium
CVE-2022-0879	Caldera Forms < 1.9.7 - Reflected Cross-Site Scripting	caldera forms	6.1 (v3.1)	Medium
CVE-2022-1168	WordPress WP JobSearch <1.5.1 - Cross-Site Scripting	jobsearch wp job board	6.1 (v3.1)	Medium
CVE-2022-1170	JobMonster < 4.5.2.9 - Cross-Site Scripting	jobmonster	6.1 (v3.1)	Medium
CVE-2022-23397	Cedar Gate EZ-NET <= 6.8.0 - Cross-Site Scripting	ez-net portal	6.1 (v3.1)	Medium
CVE-2022-24384	SmarterTools SmarterTrack - Cross-Site Scripting	smartertrack	6.1 (v3.1)	Medium
CVE-2022-2733	Openemr < 7.0.0.1 - Cross-Site Scripting	openemr	6.1 (v3.1)	Medium
CVE-2022-27926	Zimbra Collaboration (ZCS) - Cross Site Scripting	collaboration	6.1 (v3.1)	Medium
CVE-2022-28363	Reprise License Manager 14.2 - Cross-Site Scripting	reprise license manager	6.1 (v3.1)	Medium
CVE-2022-3062	Simple File List < 4.4.12 - Cross Site Scripting	simple-file-list	6.1 (v3.1)	Medium
CVE-2022-30983	Support chatbot in Nopaperforms Niaa-Chatbot through 2022-05-17 Cross-Site Scripting Vulnerability	Support chatbot in Nopaperforms Niaa-Chatbot through 2022-05-17	6.1 (v3.1)	Medium
CVE-2022-31798	Nortek Linear eMerge E3-Series - Cross-Site Scripting	emerge e3 firmware	6.1 (v3.1)	Medium
CVE-2022-32195	Open edX <2022-06-06 - Cross-Site Scripting	open edx	6.1 (v3.1)	Medium
CVE-2022-35493	eShop 3.0.4 - Cross-Site Scripting	eshop - ecommerce / store website	6.1 (v3.1)	Medium
CVE-2022-35653	Moodle LTI module Reflected - Cross-Site Scripting	moodle	6.1 (v3.1)	Medium
CVE-2022-3766	phpMyFAQ < 3.1.8 - Cross-Site Scripting	phpmyfaq	6.1 (v3.1)	Medium
CVE-2022-38467	CRM Perks Forms < 1.1.1 - Cross Site Scripting	crm perks forms	6.1 (v3.1)	Medium
CVE-2022-45836	WordPress Download Manager <= 3.2.59 - Reflected XSS	download manager	6.1 (v3.1)	Medium
CVE-2022-46381	Linear eMerge E3-Series - Cross-Site Scripting	linear emerge e3 access control firmware	6.1 (v3.1)	Medium
CVE-2023-0099	Simple URLs < 115 - Cross Site Scripting	simple urls	6.1 (v3.1)	Medium
CVE-2023-0236	WordPress Tutor LMS <2.0.10 - Cross Site Scripting	tutor lms	6.1 (v3.1)	Medium
CVE-2023-0527	Online Security Guards Hiring System - Cross-Site Scripting	online security guards hiring system	6.1 (v3.1)	Medium
CVE-2023-1780	Companion Sitemap Generator < 4.5.3 - Cross-Site Scripting	companion sitemap generator	6.1 (v3.1)	Medium
CVE-2023-23161	Art Gallery Management System Project v1.0 - Cross-Site Scripting	art gallery management system	6.1 (v3.1)	Medium
CVE-2023-23548	XSS in business intelligence	checkmk	6.1 (v3.1)	Medium
CVE-2023-2813	Wordpress Multiple Themes - Reflected Cross-Site Scripting	connections reloaded	6.1 (v3.1)	Medium
CVE-2023-2822	Ellucian Ethos Identity CAS - Cross-Site Scripting	ethos identity	6.1 (v3.1)	Medium
CVE-2023-2949	OpenEMR < 7.0.1 - Cross-site Scripting	openemr	6.1 (v3.1)	Medium
CVE-2023-29623	Purchase Order Management v1.0 - Cross Site Scripting (Reflected)	purchase order management	6.1 (v3.1)	Medium
CVE-2023-30256	Webkul QloApps 1.5.2 - Cross-site Scripting	qloapps	6.1 (v3.1)	Medium
CVE-2023-30777	Advanced Custom Fields < 6.1.6 - Cross-Site Scripting	advanced custom fields	6.1 (v3.1)	Medium
CVE-2023-35155	XWiki - Cross-Site Scripting	xwiki	6.1 (v3.1)	Medium
CVE-2023-3521	FOSSBilling < 0.5.3 - Cross-Site Scripting	fossbilling	6.1 (v3.1)	Medium
CVE-2023-36289	Webkul QloApps 1.6.0 - Cross-site Scripting	qloapps	6.1 (v3.1)	Medium
CVE-2023-37580	Zimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site Scripting	zimbra	6.1 (v3.1)	Medium
CVE-2023-37728	IceWarp Webmail Server v10.2.1 - Cross Site Scripting	icewarp	6.1 (v3.1)	Medium
CVE-2023-38194	SuperWebMailer - Cross-Site Scripting	superwebmailer	6.1 (v3.1)	Medium
CVE-2023-38501	CopyParty v1.8.6 - Cross Site Scripting	copyparty	6.1 (v3.1)	Medium
CVE-2023-38910	CSZ CMS 1.3.0 - Stored Cross-Site Scripting ('Photo URL' and 'YouTube URL' )	csz cms	6.1 (v3.1)	Medium
CVE-2023-38964	Academy LMS 6.0 - Cross-Site Scripting	academy lms	6.1 (v3.1)	Medium
CVE-2023-39598	IceWarp Email Client - Cross Site Scripting	webclient	6.1 (v3.1)	Medium
CVE-2023-39600	IceWarp 11.4.6.0 - Cross-Site Scripting	icewarp	6.1 (v3.1)	Medium
CVE-2023-39700	IceWarp Mail Server v10.4.5 - Cross-Site Scripting	mail server	6.1 (v3.1)	Medium
CVE-2023-40750	PHPJabbers Yacht Listing Script v1.0 - Cross-Site Scripting	yacht listing script	6.1 (v3.1)	Medium
CVE-2023-40751	PHPJabbers Fundraising Script v1.0 - Cross-Site Scripting	fundraising script	6.1 (v3.1)	Medium
CVE-2023-40752	PHPJabbers Make an Offer Widget v1.0 - Cross-Site Scripting	make an offer widget	6.1 (v3.1)	Medium
CVE-2023-4174	mooSocial 3.1.6 - Reflected Cross Site Scripting	moostore	6.1 (v3.1)	Medium
CVE-2023-42343	OpenCMS - Cross-Site Scripting	opencms	6.1 (v3.1)	Medium
CVE-2023-44012	mojoPortal v.2.7.0.0 - Cross-Site Scripting	mojoportal	6.1 (v3.1)	Medium
CVE-2023-46020	Blood Bank v1.0 - Stored Cross Site Scripting (XSS)	blood bank	6.1 (v3.1)	Medium
CVE-2023-49494	DedeCMS v5.7.111 - Cross-Site Scripting	dedecms	6.1 (v3.1)	Medium
CVE-2023-51769	Frappe Cross-Site Scripting Vulnerability	Frappe	6.1 (v3.1)	Medium
CVE-2023-5758	firefox mobile Cross-Site Scripting Vulnerability	firefox mobile	6.1 (v3.1)	Medium
CVE-2023-5863	phpMyFAQ < 3.2.0 - Cross-site Scripting	phpmyfaq	6.1 (v3.1)	Medium
CVE-2024-30194	Sunshine Photo Cart <= 3.1.1 - Reflected Cross-Site Scripting	sunshine photo cart	6.1 (v3.1)	Medium
CVE-2024-34321	ProPhoenix Law RMS v2022.2403.3.101 Cross-Site Scripting Vulnerability	ProPhoenix Law RMS v2022.2403.3.101	6.1 (v3.1)	Medium
CVE-2024-34326	ProPhoenix Law RMS v2022.2403.3.101 Cross-Site Scripting Vulnerability	ProPhoenix Law RMS v2022.2403.3.101	6.1 (v3.1)	Medium
CVE-2024-35693	WordPress 12 Step Meeting List Plugin <= 3.14.33 - Cross-Site Scripting	12 step meeting list	6.1 (v3.1)	Medium
CVE-2024-55218	IceWarp Server 10.2.1 - Cross-Site Scripting	mail server	6.1 (v3.1)	Medium
CVE-2024-6892	Journyx 11.5.4 - Reflected Cross Site Scripting	journyx	6.1 (v3.1)	Medium
CVE-2025-12123	Customer Reviews Collector for WooCommerce <= 4.6.1 - Reflected Cross-Site Scripting	Customer Reviews Collector for WooCommerce	6.1 (v3.1)	Medium
CVE-2025-25296	Label Studio < 1.16.0 - Cross-Site Scripting	label studio	6.1 (v3.1)	Medium
CVE-2025-2609	MagnusBilling Login Logs - Cross-Site Scripting	magnusbilling	6.1 (v3.1)	Medium
CVE-2025-46349	YesWiki Reflected XSS via File Upload	yeswiki	6.1 (v3.1)	Medium
CVE-2025-48954	Discourse OAuth Social Login - Cross-site Scripting	discourse	6.1 (v3.1)	Medium
CVE-2025-54597	Heimdall Application Dashboard < 2.7.3 - Reflected XSS	heimdall	6.1 (v3.1)	Medium
CVE-2025-55757	Extension - virtuemart.net - XSS in VirtueMart component 1.0.0 - 4.4.10 for Joomla	Virtuemart component for Joomla	6.1 (v3.1)	Medium
CVE-2025-61583	TS3 Manager is vulnerable to unauthenticated reflected XSS attack due to insecure error handling	ts3 manager	6.1 (v3.1)	Medium
CVE-2025-62358	WeGIA Reflected XSS to Account TakeOver at /html/configuracao/configuracao_geral.php via log parameter	wegia	6.1 (v3.1)	Medium
CVE-2025-63238	limesurvey Cross-Site Scripting Vulnerability	limesurvey	6.1 (v3.1)	Medium
CVE-2025-63499	sogo Cross-Site Scripting Vulnerability	sogo	6.1 (v3.1)	Medium
CVE-2025-63607	TechStore 1.0 Cross-Site Scripting Vulnerability	-	6.1 (v3.1)	Medium
CVE-2025-63737	rockoa Cross-Site Scripting Vulnerability	rockoa	6.1 (v3.1)	Medium
CVE-2025-63949	hotel management system Cross-Site Scripting Vulnerability	hotel management system	6.1 (v3.1)	Medium
CVE-2025-65013	LibreNMS vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint `/maps/nodeimage` parameter `Image Name`	librenms	6.1 (v3.1)	Medium
CVE-2025-65019	Astro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /_image endpoint	astro	6.1 (v3.1)	Medium
CVE-2025-65233	slims Cross-Site Scripting Vulnerability	slims	6.1 (v3.1)	Medium
CVE-2025-65341	Ecommerce Fruits Bazar 1.0 Cross-Site Scripting Vulnerability	-	6.1 (v3.1)	Medium
CVE-2025-66026	REDAXO is Vulnerable to Reflected XSS in Mediapool Info Banner via args[types]	redaxo	6.1 (v3.1)	Medium
CVE-2025-66924	open source point of sale Cross-Site Scripting Vulnerability	open source point of sale	6.1 (v3.1)	Medium
CVE-2025-67443	cms Cross-Site Scripting Vulnerability	cms	6.1 (v3.1)	Medium
CVE-2025-67495	ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login	zitadel	6.1 (v3.1)	Medium
CVE-2025-67648	Shopware's inproper input validation can lead to Reflected XSS through Storefront Login Page	shopware	6.1 (v3.1)	Medium
CVE-2025-68951	phpMyFAQ has stored XSS in admin "List of users" via display_name HTML entity decoding (html_entity_decode) + Twig \|raw	phpmyfaq	6.1 (v3.1)	Medium
CVE-2025-70797	limesurvey Arbitrary Code Execution Vulnerability	limesurvey	6.1 (v3.1)	Medium
CVE-2025-9952	Trinity Audio <= 5.20.2 - Reflected Cross-Site Scripting	Trinity Audio – Text to Speech AI audio player to convert content into audio	6.1 (v3.1)	Medium
CVE-2026-0594	WordPress List Site Contributors < 1.1.8 - Reflected XSS	List Site Contributors	6.1 (v3.1)	Medium
CVE-2026-0670	Stored XSS through a system message and a user-provided parameter in ProofreadPage	proofread page	6.1 (v3.1)	Medium
CVE-2026-103888	WPC Smart Quick View for WooCommerce <= 4.4.0 - Reflected Cross-Site Scripting via 'woosq-redirect' Parameter	WPC Smart Quick View for WooCommerce	6.1 (v3.1)	Medium
CVE-2026-104140	QGIS: Stored XSS in WFS3 getFeatures HTML page via unescaped feature attribute values	QGIS	6.1 (v3.1)	Medium
CVE-2026-107393	FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header	freescout	6.1 (v3.1)	Medium
CVE-2026-113659	ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated us	apostrophe	6.1 (v3.1)	Medium
CVE-2026-11588	EONSR AEO Agent <= 3.7.9 - Unauthenticated Stored XSS via Scheduled Post Creation	EONSR AEO Agent	6.1 (v3.1)	Medium
CVE-2026-11881	Fluent Forms < 6.2.6 - Contributor+ Stored XSS via Date/Time Field	Fluent Forms	6.1 (v3.1)	Medium
CVE-2026-13330	Animation Addons for Elementor < 2.7.0 - Author+ Stored XSS via SVG Upload	Animation Addons for Elementor	6.1 (v3.1)	Medium
CVE-2026-13400	Simply Schedule Appointments < 1.6.12.4 - Unauthenticated Stored XSS via Booking Customer Information	Simply Schedule Appointments	6.1 (v3.1)	Medium
CVE-2026-14921	Ultimate Addons for WPBakery Page Builder < 3.21.5 - Contributor+ Stored XSS via ult_buttons Shortcode	Ultimate Addons for WPBakery Page Builder	6.1 (v3.1)	Medium
CVE-2026-17505	WordPress TranslatePress < 3.2.6 - Cross-Site Scripting	translatepress-multilingual	6.1 (v3.1)	Medium
CVE-2026-18843	Beaver Builder Plugin (Pro Version) <= 2.11.0.1 - Reflected Cross-Site Scripting via 'no_results_message' node_preview P	Beaver Builder Plugin (Starter Version)	6.1 (v3.1)	Medium
CVE-2026-26028	CryptPad: Sanitizer Bypass in Diffmarked.js Allows Arbitrary HTML Injection and Potential XSS	cryptpad	6.1 (v3.1)	Medium
CVE-2026-30251	zenshare suite Cross-Site Scripting Vulnerability	zenshare suite	6.1 (v3.1)	Medium
CVE-2026-30252	zencrm Cross-Site Scripting Vulnerability	zencrm	6.1 (v3.1)	Medium
CVE-2026-31013	ad phonebook Cross-Site Scripting Vulnerability	ad phonebook	6.1 (v3.1)	Medium
CVE-2026-33403	Pi-hole has a Reflected XSS / HTML injection in taillog.js	web interface	6.1 (v3.1)	Medium
CVE-2026-33436	Stirling-PDF: Reflected XSS through crafted filename in file upload functionality	stirling pdf	6.1 (v3.1)	Medium
CVE-2026-34206	Captcha Protect: Reflected XSS in challenge page via unsanitized destination rendered with text/template	captcha protect	6.1 (v3.1)	Medium
CVE-2026-34229	Emlog: Stored XSS in Comment Module via URI Scheme Validation Bypass	emlog	6.1 (v3.1)	Medium
CVE-2026-34396	AVideo: Stored XSS via Unescaped Plugin Configuration Values in Admin Panel	avideo	6.1 (v3.1)	Medium
CVE-2026-34739	AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php	avideo	6.1 (v3.1)	Medium
CVE-2026-36324	SourceCodester Doctor Appointment System 1.0 Cross-Site Scripting Vulnerability	-	6.1 (v3.1)	Medium
CVE-2026-36468	Cross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 Vulnerability	-	6.1 (v3.1)	Medium
CVE-2026-37750	School Management System by mahmoudai1 Cross-Site Scripting Vulnerability	School Management System by mahmoudai1	6.1 (v3.1)	Medium
CVE-2026-38432	erpnext Cross-Site Scripting Vulnerability	erpnext	6.1 (v3.1)	Medium
CVE-2026-38444	osTicket v1.18.3 Cross-Site Scripting Vulnerability	-	6.1 (v3.1)	Medium
CVE-2026-38446	Cross-Site Scripting	-	6.1 (v3.1)	Medium
CVE-2026-38472	forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 Cross-Site Scripting Vulnerability	forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449	6.1 (v3.1)	Medium
CVE-2026-38947	FluentCMS 1.2.3 Cross-Site Scripting Vulnerability	-	6.1 (v3.1)	Medium
CVE-2026-39038	BharatMLStack up to and including v1.3.0 Cross-Site Scripting Vulnerability	-	6.1 (v3.1)	Medium
CVE-2026-39335	ChurchCRM has Stored XSS via Unescaped data-* Attributes in Group/Family Controls	churchcrm	6.1 (v3.1)	Medium
CVE-2026-39336	ChurchCRM has Stored XSS from unescaped config values in HTML attributes	churchcrm	6.1 (v3.1)	Medium
CVE-2026-41067	Astro: XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypass	astro	6.1 (v3.1)	Medium
CVE-2026-41580	Stirling-PDF: Reflected XSS through crafted PDF metadata fields (Title and Author)	stirling pdf	6.1 (v3.1)	Medium
CVE-2026-42253	Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties	activemq	6.1 (v3.1)	Medium
CVE-2026-4246	ElementsKit Pro <= 4.10.1 - Unauthenticated Stored Cross-Site Scripting via 's' Parameter	ElementsKit Pro	6.1 (v3.1)	Medium
CVE-2026-43878	WWBN AVideo: Reflected XSS in plugin/Meet/iframe.php via Unescaped `user`/`pass` Parameters Reflected into JavaScript St	AVideo	6.1 (v3.1)	Medium
CVE-2026-44366	Vvveb: Stored XSS via Comment Author Field	Vvveb	6.1 (v3.1)	Medium
CVE-2026-44587	CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters	carrierwave	6.1 (v3.1)	Medium
CVE-2026-44767	Allowlist Bypass in setThemeRoot() Enables Cross-Origin CSS Injection	@ui5/webcomponents-base	6.1 (v3.1)	Medium
CVE-2026-49264	OAuthLib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation	oauthlib	6.1 (v3.1)	Medium
CVE-2026-50182	AVideo Has Unauthenticated Reflected XSS via $_GET['search'] in YouTubeAPI Gallery Pagination	AVideo	6.1 (v3.1)	Medium
CVE-2026-51133	za-internet GmbH C-MOR Video Surveillance <= V6.0104 Arbitrary Code Execution Vulnerability	za-internet GmbH C-MOR Video Surveillance <= V6.0104	6.1 (v3.1)	Medium
CVE-2026-51565	Modules/Docs/DocsController.php in Milk admin <=0.9.8 Cross-Site Scripting Vulnerability	Modules/Docs/DocsController.php in Milk admin <=0.9.8	6.1 (v3.1)	Medium
CVE-2026-52232	FS Inc S3150-8T2F Switch 2.2.0D Build 118101 Cross-Site Scripting Vulnerability	FS Inc S3150-8T2F Switch 2.2.0D Build 118101	6.1 (v3.1)	Medium
CVE-2026-52475	aiflowy <= 2.1.2 Cross-Site Scripting Vulnerability	aiflowy <= 2.1.2	6.1 (v3.1)	Medium
CVE-2026-52774	YesWiki Bazar Widget - Reflected XSS via 'id' Parameter	yeswiki	6.1 (v3.1)	Medium
CVE-2026-54714	Logto: XSS via unescaped RelayState in SAML auto-submit form	logto	6.1 (v3.1)	Medium
CVE-2026-55087	Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (ope	etherpad	6.1 (v3.1)	Medium
CVE-2026-5776	Email Encoder < 2.4.7 - Unauthenticated Stored XSS	Email Encoder	6.1 (v3.1)	Medium
CVE-2026-61526	AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler	http-server	6.1 (v3.1)	Medium
CVE-2026-62280	OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page	OpenAM	6.1 (v3.1)	Medium
CVE-2026-73084	Activepieces: Reflected Cross-Site Scripting in OAuth Redirect Endpoint	activepieces	6.1 (v3.1)	Medium
CVE-2026-75170	the HubCore platform (version 14.1.1) Cross-Site Scripting Vulnerability	the HubCore platform (version 14.1.1)	6.1 (v3.1)	Medium
CVE-2026-75307	zhitan-ems 1.0.0 Cross-Site Scripting Vulnerability	-	6.1 (v3.1)	Medium
CVE-2026-78742	Silverpeas Core <=6.4.6 Cross-Site Scripting Vulnerability	-	6.1 (v3.1)	Medium
CVE-2026-78902	Netgate pfSense 26.03.1-RELEASE Arbitrary Code Execution Vulnerability	Netgate pfSense 26.03.1-RELEASE	6.1 (v3.1)	Medium
CVE-2026-82382	Apache Roller: Reflected cross-site scripting in the frontpage directory parameter	Apache Roller	6.1 (v3.1)	Medium
CVE-2026-8447	Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untruste	langflow	6.1 (v3.1)	Medium
CVE-2026-84925	Avada \| Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter	Avada \| Website Builder For WordPress & WooCommerce	6.1 (v3.1)	Medium
CVE-2026-89047	Social Media Share Buttons & Social Sharing Icons <= 3.0.1 - Reflected DOM-Based Cross-Site Scripting via URL	Social Media Share Buttons & Social Sharing Icons	6.1 (v3.1)	Medium
CVE-2026-96594	Gitea repository media API stored XSS	gitea	6.1 (v3.1)	Medium
CVE-2023-6717	Keycloak: xss via assertion consumer service url in saml post-binding flow	Red Hat AMQ Broker 7	6.0 (v3.1)	Medium
CVE-2026-8245	Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection	concrete cms	6.0 (v4.0)	Medium
CVE-2026-21631	Joomla! Core - [20260303] - XSS vector in com_associations comparison view	joomla!	5.9 (v4.0)	Medium
CVE-2026-55793	Craft CMS: Stored XSS via Structure entry title in table view	cms	5.9 (v4.0)	Medium
CVE-2026-5696	Multiple vulnerabilities in the Microweber administration panel	Administration panel	5.9 (v4.0)	Medium
CVE-2025-62657	Stored XSS through system messages in PageForms	MediaWiki PageForms extension	5.8 (v4.0)	Medium
CVE-2026-36470	CuteNews v.2.1.2 Cross-Site Scripting Vulnerability	-	5.8 (v3.1)	Medium
CVE-2026-63428	HeyForm: completeSubmission persists submitter-supplied hidden fields verbatim without validating against the form's dec	heyform	5.8 (v3.1)	Medium
CVE-2026-84193	LibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP	librenms	5.8 (v4.0)	Medium
CVE-2026-44696	OpenProject: Stored CSS injection via Sanitize::Config::RELAXED[:css] enables phishing overlays and data exfiltration	openproject	5.7 (v3.1)	Medium
CVE-2026-55600	Part-DB: Stored HTML injection in BOM validation results via unescaped Part name	Part-DB-server	5.7 (v4.0)	Medium
CVE-2026-57568	Lychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery View)	Lychee	5.7 (v4.0)	Medium
CVE-2026-115425	Multiple cross-site scripting (XSS) in OPNsense	OPNsense firewall	5.6 (v4.0)	Medium
CVE-2025-62365	LibreNMS vulnerable to Reflected-XSS in `report_this` function	librenms	5.5 (v4.0)	Medium
CVE-2025-62421	DataEase vulnerable to stored cross-site scripting via file upload bypass	dataease	5.5 (v4.0)	Medium
CVE-2025-64747	Directus Vulnerable to Stored Cross-site Scripting	directus	5.5 (v3.1)	Medium
CVE-2026-88055	AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in MetaGenerator	anything-llm	5.5 (v3.1)	Medium
CVE-2018-6226	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	5.4 (v3.0)	Medium
CVE-2018-6227	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	5.4 (v3.0)	Medium
CVE-2020-11456	LimeSurvey 4.1.11 - 'Survey Groups' Persistent Cross-Site Scripting	limesurvey	5.4 (v3.1)	Medium
CVE-2020-11457	pfSense 2.4.4-P3 - 'User Manager' Persistent Cross-Site Scripting	pfsense	5.4 (v3.1)	Medium
CVE-2020-20285	ZZcms - Cross-Site Scripting	zzcms	5.4 (v3.1)	Medium
CVE-2020-24963	Best Support System 3.0.4 - 'ticket_body' Persistent XSS (Authenticated)	best support system	5.4 (v3.1)	Medium
CVE-2021-25067	Landing Page Builder < 1.4.9.6 - Cross-Site Scripting	landing page	5.4 (v3.1)	Medium
CVE-2021-35956	AKCP sensorProbe SPX476 - 'Multiple' Cross-Site Scripting (XSS)	sensorprobe2 firmware	5.4 (v3.1)	Medium
CVE-2022-0020	Palo Alto Cortex XSOAR 6.5.0 - Stored Cross-Site Scripting (XSS)	cortex xsoar	5.4 (v3.1)	Medium
CVE-2022-0378	Microweber Cross-Site Scripting	microweber	5.4 (v3.1)	Medium
CVE-2022-0928	Microweber < 1.2.12 - Stored Cross-Site Scripting	microweber	5.4 (v3.1)	Medium
CVE-2022-0954	Microweber <1.2.11 - Stored Cross-Site Scripting	microweber	5.4 (v3.1)	Medium
CVE-2022-35497	TM4WEB Cross-Site Scripting Vulnerability	TM4WEB	5.4 (v3.1)	Medium
CVE-2023-26842	ChurchCRM 4.5.3 - Cross-Site Scripting	churchcrm	5.4 (v3.1)	Medium
CVE-2023-26843	ChurchCRM 4.5.3 - Cross-Site Scripting	churchcrm	5.4 (v3.1)	Medium
CVE-2023-31548	ChurchCRM v4.5.3 - Cross-Site Scripting	churchcrm	5.4 (v3.1)	Medium
CVE-2023-38911	CSZ CMS 1.3.0 - Stored Cross-Site Scripting (Plugin 'Gallery')	csz cms	5.4 (v3.1)	Medium
CVE-2024-23176	MassMessage Cross-Site Scripting Vulnerability	MassMessage	5.4 (v3.1)	Medium
CVE-2024-31027	Greek Universities Network (GUnet) Open eClass Platform v.3.15 Arbitrary Code Execution Vulnerability	Greek Universities Network (GUnet) Open eClass Platform v.3.15	5.4 (v3.1)	Medium
CVE-2024-52763	Ganglia Web Interface (v3.7.3 - v3.7.5) - Cross-Site Scripting	ganglia-web	5.4 (v3.1)	Medium
CVE-2025-2610	MagnusBilling Alarm Module - Cross-Site Scripting	magnusbilling	5.4 (v3.1)	Medium
CVE-2025-5343	Stored XSS	manageengine exchange reporter plus	5.4 (v3.1)	Medium
CVE-2025-59788	nextcloud server Cross-Site Scripting Vulnerability	nextcloud server	5.4 (v3.1)	Medium
CVE-2025-61597	Emlog Pro is vulnerable to stored XSS attack through HTML template injection	emlog	5.4 (v3.1)	Medium
CVE-2025-62178	WeGIA Cross-Site Scripting (XSS) Reflected endpoint '/html/atendido/cadastro_atendido_parentesco_pessoa_nova.php' parame	wegia	5.4 (v3.1)	Medium
CVE-2025-62430	ClipBucket v5 stored XSS via video/photo fields	clipbucket	5.4 (v3.1)	Medium
CVE-2025-63528	blood bank management system Cross-Site Scripting Vulnerability	blood bank management system	5.4 (v3.1)	Medium
CVE-2025-63948	phpmsadmin SQL Injection Vulnerability	phpmsadmin	5.4 (v3.1)	Medium
CVE-2025-65590	nopcommerce Cross-Site Scripting Vulnerability	nopcommerce	5.4 (v3.1)	Medium
CVE-2025-67496	WeGia is Vulnerable to XSS through id_pessoa Parameter on Password Configuration Page	wegia	5.4 (v3.1)	Medium
CVE-2026-102295	Quay: quay: dom-based cross-site scripting via oauth local callback format=json parameter	Red Hat Quay 3	5.4 (v3.1)	Medium
CVE-2026-103421	WPMobile.App <= 11.84 - Unauthenticated Stored Cross-Site Scripting via '/android_json/search/<value>/0' Path Segment	WPMobile.App – Android and iOS App Builder	5.4 (v3.1)	Medium
CVE-2026-105694	Penpot: Stored XSS via Unsanitised SVG Uploads	penpot	5.4 (v3.1)	Medium
CVE-2026-106033	Ansible: ansible-ui: ansible ui dom xss in /redirect next parameter	Red Hat Ansible Automation Platform 2	5.4 (v3.1)	Medium
CVE-2026-106706	XXL-JOB through 3.5.0-SNAPSHOT Cross-Site Scripting Vulnerability	-	5.4 (v3.1)	Medium
CVE-2026-106707	XXL-JOB <=3.5.0-SNAPSHOT Cross-Site Scripting Vulnerability	XXL-JOB <=3.5.0-SNAPSHOT	5.4 (v3.1)	Medium
CVE-2026-11569	Quay: quay: stored xss via filedrop svg upload	Red Hat Quay 3	5.4 (v3.1)	Medium
CVE-2026-15245	BNE Testimonials < 2.0.8.2 - Contributor+ Stored XSS via Slider Shortcode	BNE Testimonials	5.4 (v3.1)	Medium
CVE-2026-15262	Admin Columns for ACF Fields <= 0.3.2 - Contributor+ Stored XSS via ACF Field Value Column	Admin Columns for ACF Fields	5.4 (v3.1)	Medium
CVE-2026-16063	Event Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event Timeline Content	Event Booking Manager for WooCommerce	5.4 (v3.1)	Medium
CVE-2026-16537	Slick Slider < 0.5.3 - Contributor+ Stored XSS via Gallery Shortcode	Slick Slider	5.4 (v3.1)	Medium
CVE-2026-16558	YMC Filter < 3.12.8 - Contributor+ Stored XSS via Layout Builder Schema	YMC Filter	5.4 (v3.1)	Medium
CVE-2026-18395	Child Pages Card < 1.09 - Contributor+ Stored XSS via Shortcode Attributes	Child Pages Card	5.4 (v3.1)	Medium
CVE-2026-32629	phpMyFAQ: Stored XSS via Unsanitized Email Field in Admin FAQ Editor	phpmyfaq	5.4 (v4.0)	Medium
CVE-2026-32893	Chamilo LMS has Reflected XSS via Unsanitized http_build_query() in Exercise Question List Pagination	chamilo lms	5.4 (v3.1)	Medium
CVE-2026-34848	hoppscotch: Stored XSS in team member overflow tooltip via display name	hoppscotch	5.4 (v3.1)	Medium
CVE-2026-34974	phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding leads to Stored XSS and Privilege Escalation	phpmyfaq	5.4 (v3.1)	Medium
CVE-2026-35046	Tandoor has a Stored CSS Injection via <style> Tag in Recipe Instructions (API-Level)	recipes	5.4 (v3.1)	Medium
CVE-2026-35403	LORIS has potential cross-site scripting in survey_accounts module	loris	5.4 (v3.1)	Medium
CVE-2026-35455	immich has Stored XSS via OCR Text in 360° Panorama Viewer	immich	5.4 (v3.1)	Medium
CVE-2026-36163	LiquidFiles v4.2.7 Cross-site Scripting Vulnerability	LiquidFiles v4.2.7	5.4 (v3.1)	Medium
CVE-2026-36392	FairSketch Rise CRM Version 3.9.6 Cross-Site Scripting Vulnerability	-	5.4 (v3.1)	Medium
CVE-2026-38473	the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 Cross-Site Scripting Vulnerability	the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449	5.4 (v3.1)	Medium
CVE-2026-39040	BharatMLStack up to and including 1.3.0 Cross-Site Scripting Vulnerability	-	5.4 (v3.1)	Medium
CVE-2026-39380	Open Source Point of Sale has Stored XSS in Stock Location (Configuration)	open source point of sale	5.4 (v3.1)	Medium
CVE-2026-39964	TypeBot: Stored XSS via javascript: URI in text bubble links — bot author executes JS on visitors' browsers	typebot.io	5.4 (v3.1)	Medium
CVE-2026-40483	ChurchCRM: Stored XSS in PledgeEditor.php via Donation Comment Field	CRM	5.4 (v3.1)	Medium
CVE-2026-41061	WWBN AVideo Vulnerable to stored XSS via Unanchored Duration Regex in Video Encoder Receiver	avideo	5.4 (v3.1)	Medium
CVE-2026-41063	WWBN AVideo has incomplete fix for CVE-2026-33500 (XSS)	avideo	5.4 (v3.1)	Medium
CVE-2026-41318	AnythingLLM vulnerable to stored DOM XSS in chart caption renderer - LLM-driven prompt injection produces executable HTM	anythingllm	5.4 (v3.1)	Medium
CVE-2026-42877	FacturaScripts: Stored XSS via product reference in sales/purchases	facturascripts	5.4 (v3.1)	Medium
CVE-2026-45138	CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule	ci4ms	5.4 (v3.1)	Medium
CVE-2026-45580	WWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute	avideo	5.4 (v3.1)	Medium
CVE-2026-45694	LibreNMS: Reflected XSS in the Proxmox app view via unsanitized instance/vmid parameters	librenms	5.4 (v3.1)	Medium
CVE-2026-58392	OPNsense: Stored XSS in Services: NTP GPS	core	5.4 (v3.1)	Medium
CVE-2026-59188	Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer	Part-DB-server	5.4 (v3.1)	Medium
CVE-2026-63498	Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API	snipe-it	5.4 (v3.1)	Medium
CVE-2026-70492	Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages	open webui	5.4 (v3.1)	Medium
CVE-2026-72570	cube-root directory-serve - Stored Cross-Site Scripting via Malicious Filename	directory-serve	5.4 (v3.1)	Medium
CVE-2026-72583	fastschema - Stored Cross-Site Scripting via MIME Type Bypass in File Upload	fastschema	5.4 (v3.1)	Medium
CVE-2026-78849	Netgate pfSense Plus software versions <= 26.03 pfSense CE software versions <= 2.8.1 Arbitrary Code Execution Vulnerability	Netgate pfSense Plus software versions <= 26.03 pfSense CE software versions <= 2.8.1	5.4 (v3.1)	Medium
CVE-2026-82396	Sulu: Stored XSS via media download inline-disposition override	sulu	5.4 (v3.1)	Medium
CVE-2026-91021	Trillium Notes Cross-Site Scripting Vulnerability	Trillium Notes	5.4 (v3.1)	Medium
CVE-2026-9278	Form Builder CP < 1.2.47 - Editor+ Stored XSS via form_structure	Form Builder CP	5.4 (v3.1)	Medium
CVE-2026-95166	In Bacularis v1.0.0 - 6.5.1 when adding a new pool, the LabelFormat field Cross-Site Scripting Vulnerability	-	5.4 (v3.1)	Medium
CVE-2019-25731	Zuz Music 2.1 Persistent Cross-site Scripting via zuzconsole Contact	Zuz Music	5.3 (v4.0)	Medium
CVE-2023-30943	Moodle - Cross-Site Scripting/Remote Code Execution	moodle	5.3 (v3.1)	Medium
CVE-2024-58292	XMB Forum 1.9.12.06 Persistent Cross-Site Scripting via Admin Templates	XMB Forum	5.3 (v4.0)	Medium
CVE-2024-58296	CE Phoenix v3.0.1 Stored Cross-Site Scripting via admin/currencies.php	CE Phoenix	5.3 (v4.0)	Medium
CVE-2024-58391	Frappe before 15.4.0 XSS via Printview Parameters	frappe	5.3 (v4.0)	Medium
CVE-2025-10341	HTML injection in Perfex CRM	perfex crm	5.3 (v4.0)	Medium
CVE-2025-10342	HTML injection in Perfex CRM	perfex crm	5.3 (v4.0)	Medium
CVE-2025-10343	HTML injection in Perfex CRM	perfex crm	5.3 (v4.0)	Medium
CVE-2025-10344	HTML injection in Perfex CRM	perfex crm	5.3 (v4.0)	Medium
CVE-2025-10346	HTML injection in Perfex CRM	perfex crm	5.3 (v4.0)	Medium
CVE-2025-2709	Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting	ufida erp-nc	5.3 (v4.0)	Medium
CVE-2025-2711	Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting	ufida erp-nc	5.3 (v4.0)	Medium
CVE-2025-2712	Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting	ufida erp-nc	5.3 (v4.0)	Medium
CVE-2025-34398	MailEnable < 10.54 Reflected XSS in AddressesBcc Parameter of AddressBook.aspx	mailenable	5.3 (v4.0)	Medium
CVE-2025-34400	MailEnable < 10.54 Reflected XSS in AddressesTo Parameter of AddressBook.aspx	mailenable	5.3 (v4.0)	Medium
CVE-2025-34408	MailEnable < 10.54 Reflected XSS in Added Parameter of MAI/AddRecipientsResult.aspx	mailenable	5.3 (v4.0)	Medium
CVE-2025-34425	MailEnable < 10.54 Reflected XSS in WindowContext Parameter of MAI/compose.aspx	mailenable	5.3 (v4.0)	Medium
CVE-2025-62359	WeGIA Cross-Site Scripting (XSS) Reflected endpoint id_pet	wegia	5.3 (v4.0)	Medium
CVE-2025-62800	FastMCP vulnerable to reflected XSS in client's callback page	fastmcp	5.3 (v4.0)	Medium
CVE-2025-66452	LibreChat's lack of JSON parsing error handling can lead to XSS	librechat	5.3 (v4.0)	Medium
CVE-2025-66460	Lookyloo vulnerable to XSS due to lack of escaping in HTML elements passed to Datatables	lookyloo	5.3 (v4.0)	Medium
CVE-2025-9728	givanz Vvveb login.tpl cross site scripting	vvveb	5.3 (v4.0)	Medium
CVE-2026-100381	UploadWizard Flickr collection and set titles allow DOM XSS	Mediawiki - UploadWizard Extension	5.3 (v4.0)	Medium
CVE-2026-102333	httpdbg before 2.2.1 Stored Cross-Site Scripting via javascript URL	httpdbg	5.3 (v4.0)	Medium
CVE-2026-104083	SmarterMail < Build 9777 Stored Mutation XSS via MathML Foreign Content	Smartermail	5.3 (v4.0)	Medium
CVE-2026-105114	OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page	OpenAM	5.3 (v4.0)	Medium
CVE-2026-105124	W (wcms) through 3.18.0 Unauthenticated Stored XSS via Login Username and Comments	wcms	5.3 (v4.0)	Medium
CVE-2026-107797	Jivejdon through 5.0 Reflected XSS via postThread.jsp to and tag Parameters	jivejdon	5.3 (v4.0)	Medium
CVE-2026-109328	Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via Registration Name	admidio	5.3 (v4.0)	Medium
CVE-2026-109352	LibreNMS before 26.9.0 Stored XSS via wireless sensor description	librenms	5.3 (v4.0)	Medium
CVE-2026-109355	LibreNMS before 26.9.0 Stored XSS via Tools Oxidized Node List	librenms	5.3 (v4.0)	Medium
CVE-2026-116203	YesWiki before 4.7.0 Stored XSS via filtertags Action Parameters	yeswiki	5.3 (v4.0)	Medium
CVE-2026-116206	YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax	yeswiki	5.3 (v4.0)	Medium
CVE-2026-116217	RosarioSIS before 12.9.2 Reflected XSS via menu_id in MenuReports.php	rosariosis	5.3 (v4.0)	Medium
CVE-2026-116824	YesWiki before 4.7.0 Stored XSS via Referer Header in referrers_sites Handler	yeswiki	5.3 (v4.0)	Medium
CVE-2026-25860	OpenClinic GA 5.351.19 Reflected XSS via DICOM Image Upload Handler	OpenClinic GA	5.3 (v4.0)	Medium
CVE-2026-35208	lichess.org has an Unsanitized Stream Title Injection on /streamer	lila	5.3 (v4.0)	Medium
CVE-2026-39941	ChurchCRM has an XSS vulnerability	churchcrm	5.3 (v4.0)	Medium
CVE-2026-41932	Vvveb < 1.0.8.3 Stored XSS via Signup Controller	Vvveb	5.3 (v4.0)	Medium
CVE-2026-42458	Magento LTS: Reflected XSS - Import -> Data Flow (profiles)	magento-lts	5.3 (v4.0)	Medium
CVE-2026-42554	Fiber: XSS in AutoFormat Content Negotiation	fiber	5.3 (v4.0)	Medium
CVE-2026-47096	AJA HELO Plus < 2.1.7 Stored XSS via System Name Parameter	HELO Plus	5.3 (v4.0)	Medium
CVE-2026-47119	Agent Zero < 1.15 Stored XSS via image_get API Endpoint	agent-zero	5.3 (v4.0)	Medium
CVE-2026-48094	ShareOpenly has Cross-Site Scripting (XSS) via Missing esc_url() on Shared URL in Content Output	shareopenly	5.3 (v4.0)	Medium
CVE-2026-56347	AVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item Fields	AVideo	5.3 (v4.0)	Medium
CVE-2026-5808	openstatusHQ openstatus Onboarding Endpoint client.tsx cross site scripting	openstatus	5.3 (v4.0)	Medium
CVE-2026-59232	Stored Cross-site Scripting in Prospero Flow CRM lead name field	Prospero Flow CRM	5.3 (v4.0)	Medium
CVE-2026-69116	FlyEnv < 4.18.0 Cross-Site Scripting via v-html	FlyEnv	5.3 (v4.0)	Medium
CVE-2026-73038	NodeBB < 4.15.0 Stored XSS via ActivityPub emoji tag.icon.url and tag.name	NodeBB	5.3 (v4.0)	Medium
CVE-2026-73422	Astro: Reflected XSS via unescaped View Transition animation properties	astro	5.3 (v4.0)	Medium
CVE-2026-73628	Serendipity 2.3.5 Reflected XSS via search clean-URL route	Serendipity	5.3 (v4.0)	Medium
CVE-2026-76837	Baserow before 2.3.0 Stored Cross-Site Scripting via Rich Text Mention Display Name	Baserow	5.3 (v4.0)	Medium
CVE-2026-82451	Formwork through 2.3.14 Stored XSS via Referer Header	Formwork	5.3 (v4.0)	Medium
CVE-2026-82646	WWBN AVideo Unauthenticated Reflected XSS via url2Embed.json.php	AVideo	5.3 (v4.0)	Medium
CVE-2026-84191	LibreNMS before 26.5.0 Stored XSS via SNMP VRF fields	librenms	5.3 (v4.0)	Medium
CVE-2026-85158	AVideo Reflected XSS via videoEmbeded.php link parameter	AVideo	5.3 (v4.0)	Medium
CVE-2026-85159	AVideo Reflected XSS via cancelUri in userLogin.php	AVideo	5.3 (v4.0)	Medium
CVE-2026-85577	AVideo userLogin.php Reflected XSS via error parameter	AVideo	5.3 (v4.0)	Medium
CVE-2026-89240	WWBN AVideo Reflected XSS via confirmLivePassword.php	AVideo	5.3 (v4.0)	Medium
CVE-2026-89241	WWBN AVideo Reflected XSS via confirmLivePassword.php	AVideo	5.3 (v4.0)	Medium
CVE-2026-89244	WWBN AVideo Reflected XSS via Gallery Category getBackURL	AVideo	5.3 (v4.0)	Medium
CVE-2026-90571	Exrick xmall Order Printing order-print.jsp cross site scripting	xmall	5.3 (v4.0)	Medium
CVE-2026-90848	Governikus AusweisApp StartPAOSResponse cross site scripting	AusweisApp	5.3 (v4.0)	Medium
CVE-2026-91922	Steedos Platform through 3.0.15-beta.47 Reflected XSS via page render	steedos-platform	5.3 (v4.0)	Medium
CVE-2026-92584	AVideo through 29.0 Stored Cross-Site Scripting via User-Agent Header	AVideo	5.3 (v4.0)	Medium
CVE-2026-58394	OPNsense: Stored XSS in Administration Settings via Certificate Description	core	5.2 (v3.1)	Medium
CVE-2011-10037	Nagios XI < 2011R1.9 XSS via xiwindow Variables Affecting Permalinks	nagios xi	5.1 (v4.0)	Medium
CVE-2012-20003	Custom Tables WordPress Plugin < 3.4.6 Reflected XSS via iframe.php	Custom Tables	5.1 (v4.0)	Medium
CVE-2014-125131	DedeCMS 5.6 / 5.7 Reflected XSS via adminDirHand in config.php	DedeCMS	5.1 (v4.0)	Medium
CVE-2014-125132	Blogroll Fun WordPress Plugin < 0.8.5 Reflected XSS via blogroll.php	Blogroll Fun	5.1 (v4.0)	Medium
CVE-2017-20288	QCubed 3.1.1 Reflected XSS via installer step_2.php	QCubed	5.1 (v4.0)	Medium
CVE-2017-20290	Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed	Discourse	5.1 (v4.0)	Medium
CVE-2018-25248	MyBB Downloads Plugin 2.0.3 Persistent XSS via downloads.php	mybb downloads	5.1 (v4.0)	Medium
CVE-2018-25349	userSpice 4.3.24 Cross-Site Scripting via X-Forwarded-For Header	userSpice	5.1 (v4.0)	Medium
CVE-2019-25739	GigToDo Freelance Marketplace Script 1.3 Persistent XSS	GigToDo	5.1 (v4.0)	Medium
CVE-2020-37235	WordPress Theme Wibar 1.1.8 Stored Cross-Site Scripting via Brand Component	Theme Wibar	5.1 (v4.0)	Medium
CVE-2020-37236	NewsLister Authenticated Persistent Cross-Site Scripting via Admin Panel	NewsLister	5.1 (v4.0)	Medium
CVE-2020-37284	Sickbeard build-507 Reflected XSS via testNaming pattern Parameter	Sickbeard	5.1 (v4.0)	Medium
CVE-2021-47931	Exponent CMS 2.6 Multiple Vulnerabilities Stored XSS Authentication	Exponent CMS	5.1 (v4.0)	Medium
CVE-2021-47947	Projectsend r1295 Stored Cross-Site Scripting via files-edit.php	Projectsend	5.1 (v4.0)	Medium
CVE-2022-50943	Moodle LMS 4.0 Cross-Site Scripting via course search.php	moodle	5.1 (v4.0)	Medium
CVE-2022-50948	Motopress Hotel Booking Lite 4.2.4 Stored Cross-Site Scripting	Motopress Hotel Booking Lite	5.1 (v4.0)	Medium
CVE-2022-50958	WordPress Plugin Jetpack 9.1 Cross Site Scripting via grunion-form-view.php	Jetpack	5.1 (v4.0)	Medium
CVE-2022-50959	WordPress Contact Form Builder 1.6.1 Cross-Site Scripting via code_generator.php	Contact Form Builder	5.1 (v4.0)	Medium
CVE-2022-50961	WordPress Plugin IP2Location Country Blocker 2.26.7 Stored XSS	IP2Location Country Blocker	5.1 (v4.0)	Medium
CVE-2022-50962	uBidAuction 2.0.1 myOrders Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2022-50963	uBidAuction 2.0.1 myAuctions active Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2022-50964	uBidAuction 2.0.1 myAuctions loose Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2022-50965	uBidAuction 2.0.1 posts manage Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2022-50966	uBidAuction 2.0.1 news manage Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2022-50968	uBidAuction 2.0.1 auctions manage Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2022-50969	uBidAuction 2.0.1 mailingLog manage Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2023-54358	WordPress adivaha Travel Plugin 2.3 Reflected XSS via isMobile	WordPress adivaha Travel Plugin	5.1 (v4.0)	Medium
CVE-2023-54361	Joomla iProperty Real Estate 4.1.1 Reflected XSS via filter_keyword	Joomla iProperty Real Estate	5.1 (v4.0)	Medium
CVE-2023-54362	Joomla VirtueMart Shopping-Cart 4.0.12 Reflected XSS via keyword	Cart	5.1 (v4.0)	Medium
CVE-2023-54413	WPML Multilingual CMS WordPress Plugin < 4.6.1 Reflected XSS via wp-login.php wp_lang	WPML Multilingual CMS	5.1 (v4.0)	Medium
CVE-2024-13992	Nagios XI < 2024R1.1 XSS via Missing Page / 404	nagios xi	5.1 (v4.0)	Medium
CVE-2024-58394	Retool 3.88.0 XSS via /api/imageProxy SVG Proxying	Retool	5.1 (v4.0)	Medium
CVE-2025-10354	Reflected Cross-Site Scripting (XSS) in Semantic MediaWiki	Semantic MediaWiki	5.1 (v4.0)	Medium
CVE-2025-10945	nuz007 smsboom d.php cross site scripting	smsboom	5.1 (v4.0)	Medium
CVE-2025-10946	nuz007 smsboom dy.php cross site scripting	smsboom	5.1 (v4.0)	Medium
CVE-2025-12264	Wisencode Create Support Ticket create cross site scripting	Wisencode	5.1 (v4.0)	Medium
CVE-2025-13415	icret EasyImages SVG Image upload.php cross site scripting	easyimages2.0	5.1 (v4.0)	Medium
CVE-2025-34141	ETQ Reliance - Reflected XSS via SQLConverterServlet	reliance	5.1 (v4.0)	Medium
CVE-2025-34257	Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via action/defined	wise-deviceon server	5.1 (v4.0)	Medium
CVE-2025-34258	Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devicemap/plan	wise-deviceon server	5.1 (v4.0)	Medium
CVE-2025-34259	Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devicemap/building	wise-deviceon server	5.1 (v4.0)	Medium
CVE-2025-34260	Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via action/schedule	wise-deviceon server	5.1 (v4.0)	Medium
CVE-2025-34261	Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devicegroups/	wise-deviceon server	5.1 (v4.0)	Medium
CVE-2025-34262	Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devices/name/{agent_id}	wise-deviceon server	5.1 (v4.0)	Medium
CVE-2025-34263	Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via plugin-config/dashboards/menus	wise-deviceon server	5.1 (v4.0)	Medium
CVE-2025-34264	Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via dog/{agentId}	wise-deviceon server	5.1 (v4.0)	Medium
CVE-2025-34265	Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via rule-engines	wise-deviceon server	5.1 (v4.0)	Medium
CVE-2025-34266	Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via plugin-config/addins/menus	wise-deviceon server	5.1 (v4.0)	Medium
CVE-2025-34301	IPFire < v2.29 Stored XSS via Location Group Creation	ipfire	5.1 (v4.0)	Medium
CVE-2025-34302	IPFire < v2.29 Stored XSS via Service Creation	ipfire	5.1 (v4.0)	Medium
CVE-2025-34303	IPFire < v2.29 Stored XSS via Whitelisted Host Creation	ipfire	5.1 (v4.0)	Medium
CVE-2025-34305	IPFire < v2.29 Stored XSS via Multiple Methods in cleanhtml()	ipfire	5.1 (v4.0)	Medium
CVE-2025-34306	IPFire < v2.29 Stored XSS via Default IP Search Value	ipfire	5.1 (v4.0)	Medium
CVE-2025-34307	IPFire < v2.29 Stored XSS via Default Country Search	ipfire	5.1 (v4.0)	Medium
CVE-2025-34308	IPFire < v2.29 Stored XSS via Default Time Sync	ipfire	5.1 (v4.0)	Medium
CVE-2025-34309	IPFire < v2.29 Stored XSS via Dynamic DNS Host	ipfire	5.1 (v4.0)	Medium
CVE-2025-34310	IPFire < v2.29 Stored XSS via Quality of Service (QoS) Settings	ipfire	5.1 (v4.0)	Medium
CVE-2025-34313	IPFire < v2.29 Stored XSS via User Quota Rule URL Filter	ipfire	5.1 (v4.0)	Medium
CVE-2025-34314	IPFire < v2.29 Stored XSS via Time Constraint Rule URL Filter	ipfire	5.1 (v4.0)	Medium
CVE-2025-34315	IPFire < v2.29 Stored XSS via Remote Syslog Server Address	ipfire	5.1 (v4.0)	Medium
CVE-2025-34318	IPFire < v2.29 Stored XSS via DNS Creation (proxy.cgi)	IPFire	5.1 (v4.0)	Medium
CVE-2025-40638	Reflected Cross-Site Scripting (XSS) in Eventobot	eventobot	5.1 (v4.0)	Medium
CVE-2025-40641	Stored Cross-Site Scripting (XSS) in the Multi-purpose Inventory Management System	Multi-Purpose Inventory Management System	5.1 (v4.0)	Medium
CVE-2025-40642	Reflected Cross-Site Scripting (XSS) in WebWork	WebWork PHP script	5.1 (v4.0)	Medium
CVE-2025-40643	Stored Cross-Site Scripting (XSS) in Energy CRM by Status Tracker	energy crm	5.1 (v4.0)	Medium
CVE-2025-40647	Stored Cross-Site Scripting (XSS) vulnerability in Issabel products	Issabel	5.1 (v4.0)	Medium
CVE-2025-40649	Múltiples vulnerabilidades en Negotiator de BBMRI-ERIC	Negotiator	5.1 (v4.0)	Medium
CVE-2025-40681	Cross-Site Scripting (XSS) in xCally Omnichannel	Omnichannel	5.1 (v4.0)	Medium
CVE-2025-40693	Cross Site Scripting in PHPGurukul Online Fire Reporting System	online fire reporting system	5.1 (v4.0)	Medium
CVE-2025-40700	Reflected Cross-Site Scripting (XSS) in Governalia by IDI Eikon	governalia	5.1 (v4.0)	Medium
CVE-2025-40702	Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH	openatlas	5.1 (v4.0)	Medium
CVE-2025-40703	Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH	openatlas	5.1 (v4.0)	Medium
CVE-2025-40704	Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH	openatlas	5.1 (v4.0)	Medium
CVE-2025-40705	Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH	openatlas	5.1 (v4.0)	Medium
CVE-2025-40706	Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH	openatlas	5.1 (v4.0)	Medium
CVE-2025-40707	Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH	openatlas	5.1 (v4.0)	Medium
CVE-2025-40708	Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH	openatlas	5.1 (v4.0)	Medium
CVE-2025-40725	Reflected Cross-Site Scripting (XSS) in Azon Dominator	Azon Dominator PHP script	5.1 (v4.0)	Medium
CVE-2025-40989	Stored XSS in Creativeitem Ekushey CRM	ekushey project manager crm	5.1 (v4.0)	Medium
CVE-2025-40990	Stored XSS in Creativeitem Ekushey CRM	ekushey project manager crm	5.1 (v4.0)	Medium
CVE-2025-40991	Stored XSS in Creativeitem Ekushey CRM	ekushey project manager crm	5.1 (v4.0)	Medium
CVE-2025-40992	Stored XSS in Creativeitem Sociopro	Sociopro	5.1 (v4.0)	Medium
CVE-2025-41001	Cross-Site Scripting (XSS) in SOPlanning	soplanning	5.1 (v4.0)	Medium
CVE-2025-41011	HTML injection in PHP Point Of Sale	php point of sale	5.1 (v4.0)	Medium
CVE-2025-41021	Stored Cross-Site Scripting (XSS) vulnerability in Sergestec's Exito	exito	5.1 (v4.0)	Medium
CVE-2025-41036	Stored Cross-Site Scripting vulnerability in appRain CMF	apprain	5.1 (v4.0)	Medium
CVE-2025-41044	Stored Cross-Site Scripting vulnerability in appRain CMF	apprain	5.1 (v4.0)	Medium
CVE-2025-41079	Multiple vulnerabilities in Seafile	seafile	5.1 (v4.0)	Medium
CVE-2025-41080	Multiple vulnerabilities in Seafile	seafile	5.1 (v4.0)	Medium
CVE-2025-41101	Multiple vulnerabilities in Fairsketch's RISE CRM Framework	rise ultimate project manager	5.1 (v4.0)	Medium
CVE-2025-41105	Multiple vulnerabilities in Fairsketch's RISE CRM Framework	rise ultimate project manager	5.1 (v4.0)	Medium
CVE-2025-41106	Multiple vulnerabilities in Fairsketch's RISE CRM Framework	rise ultimate project manager	5.1 (v4.0)	Medium
CVE-2025-41107	Stored XSS in Smart School	smart school	5.1 (v4.0)	Medium
CVE-2025-41349	Stored Cross-Site Scripting (XSS) in WinPlus by Informática del Este	winplus	5.1 (v4.0)	Medium
CVE-2025-41350	Stored Cross-Site Scripting (XSS) in WinPlus by Informática del Este	winplus	5.1 (v4.0)	Medium
CVE-2025-43804	digital experience platform Cross-Site Scripting Vulnerability	digital experience platform	5.1 (v4.0)	Medium
CVE-2025-59750	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	5.1 (v4.0)	Medium
CVE-2025-59756	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	5.1 (v4.0)	Medium
CVE-2025-59758	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	5.1 (v4.0)	Medium
CVE-2025-59767	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	5.1 (v4.0)	Medium
CVE-2025-59769	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	5.1 (v4.0)	Medium
CVE-2025-61599	Emlog is Vulnerable to Stored Cross-Site Scripting (XSS) in "Twitter" Feature via Markdown Input	emlog	5.1 (v4.0)	Medium
CVE-2025-64716	Anubis vulnerable to possible XSS via redir parameter when using subrequest auth mode	anubis	5.1 (v4.0)	Medium
CVE-2025-71385	Netdata < 2.3.1 - Reflected Cross-Site Scripting via love Parameter in ilove.svg Endpoint	netdata	5.1 (v4.0)	Medium
CVE-2025-71404	better-auth before 1.1.16 Reflected XSS via error parameter	better-auth	5.1 (v4.0)	Medium
CVE-2025-9655	O2OA Personal Profile person cross site scripting	o2oa	5.1 (v4.0)	Medium
CVE-2026-100174	Stored Cross-Site Scripting (XSS) in AIL Framework Tag Selector via Unescaped Tag Names	ail framework	5.1 (v4.0)	Medium
CVE-2026-100521	Cotonti through 1.0.0 Reflected XSS via search highlight parameter	Cotonti	5.1 (v4.0)	Medium
CVE-2026-100522	Cotonti through 1.0.0 Reflected XSS via message.php lng parameter	Cotonti	5.1 (v4.0)	Medium
CVE-2026-100630	AVideo Stored XSS via HTML Entity Bypass in trailer1 Field	AVideo	5.1 (v4.0)	Medium
CVE-2026-100904	amirsanni mini-inventory-and-sales-management-system Items Management Items.php cross site scripting	mini-inventory-and-sales-management-system	5.1 (v4.0)	Medium
CVE-2026-102755	DataEase Datasource/Dataset Folder Name Stored Cross-Site Scripting	dataease	5.1 (v4.0)	Medium
CVE-2026-102756	DataEase bar-horizontal Axis Label Tooltip Stored Cross-Site Scripting	dataease	5.1 (v4.0)	Medium
CVE-2026-103587	QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters	QloApps	5.1 (v4.0)	Medium
CVE-2026-103589	QloApps through 1.7.0 Reflected XSS via Room Type Editor	QloApps	5.1 (v4.0)	Medium
CVE-2026-103590	QloApps through 1.7.0 Reflected XSS via Length of Stay Fields	QloApps	5.1 (v4.0)	Medium
CVE-2026-104461	YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField	yeswiki	5.1 (v4.0)	Medium
CVE-2026-104465	YesWiki before 4.6.7 Reflected XSS via field Parameter in mail Handler	yeswiki	5.1 (v4.0)	Medium
CVE-2026-104466	YesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src Attribute	yeswiki	5.1 (v4.0)	Medium
CVE-2026-104473	YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages	yeswiki	5.1 (v4.0)	Medium
CVE-2026-105224	YesWiki before 4.6.7 Stored XSS via Bazar valeur Action	yeswiki	5.1 (v4.0)	Medium
CVE-2026-107799	Jivejdon through 5.0 Stored XSS via messageListBody.jsp Forum Message Rendering	jivejdon	5.1 (v4.0)	Medium
CVE-2026-107800	Jivejdon through 5.0 Stored XSS via Private Short Messages	jivejdon	5.1 (v4.0)	Medium
CVE-2026-108942	philz1337x clarity-upscaler Extra Networks Card Rendering ui_extra_networks.py create_html_for_item cross site scripting	clarity-upscaler	5.1 (v4.0)	Medium
CVE-2026-109300	Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds	open-webui	5.1 (v4.0)	Medium
CVE-2026-109327	Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.php	admidio	5.1 (v4.0)	Medium
CVE-2026-110101	Koillection through 1.8.4 Stored XSS via Datum File Attachment Uploads	Koillection	5.1 (v4.0)	Medium
CVE-2026-110625	ClipBucket v5 through 5.5.3-#206 Reflected XSS via type Parameter in flagged_item.php	clipbucket-v5	5.1 (v4.0)	Medium
CVE-2026-110626	ClipBucket v5 through 5.5.3-#206 Reflected XSS via edit_language in language_settings.php	clipbucket-v5	5.1 (v4.0)	Medium
CVE-2026-111168	LibreDesk before 2.9.0-rc.8 Stored XSS via SVG Upload Content-Type Parameter	libredesk	5.1 (v4.0)	Medium
CVE-2026-112097	SourceCodester Inventory System Sales Management transactions_handler.php save_sale cross site scripting	Inventory System	5.1 (v4.0)	Medium
CVE-2026-113683	VPL for Moodle before 5.0.0 Reflected XSS via similarity/diff.php filename	moodle-mod vpl	5.1 (v4.0)	Medium
CVE-2026-114407	e107 CMS before 2.3.13 Reflected XSS via search.php author Parameter	e107	5.1 (v4.0)	Medium
CVE-2026-116139	WWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown Rendering	AVideo	5.1 (v4.0)	Medium
CVE-2026-116169	SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks	siyuan	5.1 (v4.0)	Medium
CVE-2026-116202	YesWiki before 4.7.0 Stored XSS via ImageField SVG Upload	yeswiki	5.1 (v4.0)	Medium
CVE-2026-11982	Stored XSS via missing XSS safety check in Admin2 Pages API partial validation	grav-plugin-api	5.1 (v4.0)	Medium
CVE-2026-1630	Reflected XSS in WEBCON BPS	WEBCON BPS	5.1 (v4.0)	Medium
CVE-2026-19434	Stored Cross-site Scripting in Pentestify finding severity field	Pentestify	5.1 (v4.0)	Medium
CVE-2026-19716	Stored Cross-site Scripting in Pentestify user account deletion via unescaped username	Pentestify	5.1 (v4.0)	Medium
CVE-2026-22675	OCS Inventory NG Server Stored XSS via User-Agent	ocs inventory server	5.1 (v4.0)	Medium
CVE-2026-25557	Evoluted PHP Directory Listing Script 4.0.5 Reflected XSS via dir parameter	PHP Directory Listing Script	5.1 (v4.0)	Medium
CVE-2026-27176	MajorDoMo - Cross-Site Scripting	majordomo	5.1 (v4.0)	Medium
CVE-2026-32856	Ellucian Banner Self-Service Reflected XSS via dateConverter	Banner Self-Service	5.1 (v4.0)	Medium
CVE-2026-3317	Reflected Cross-Site Scripting in Navigate CMS application	Navigate CMS	5.1 (v4.0)	Medium
CVE-2026-34416	OSCAL-GUI Reflected XSS via project parameter in oscal.php	OSCAL-GUI	5.1 (v4.0)	Medium
CVE-2026-34417	OSCAL-GUI Reflected XSS via project parameter in oscal-forms.php	OSCAL-GUI	5.1 (v4.0)	Medium
CVE-2026-34429	Vvveb < 1.0.8.1 Stored XSS via Media Upload and Rename	Vvveb	5.1 (v4.0)	Medium
CVE-2026-34798	Endian Firewall /cgi-bin/routing.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34799	Endian Firewall /manage/dnsmasq/hosts/ remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34800	Endian Firewall /cgi-bin/uplinkeditor.cgi NAME Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34801	Endian Firewall /manage/dhcp/fixed_leases/ remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34802	Endian Firewall /cgi-bin/salearn.cgi remark user ham spam Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34803	Endian Firewall /manage/qos/classes/ name Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34804	Endian Firewall /manage/qos/rules/ dscp Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34805	Endian Firewall /cgi-bin/dnat.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34806	Endian Firewall /cgi-bin/snat.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34807	Endian Firewall /cgi-bin/incoming.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34808	Endian Firewall /cgi-bin/outgoingfw.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34809	Endian Firewall /cgi-bin/zonefw.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34810	Endian Firewall /cgi-bin/vpnfw.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34811	Endian Firewall /cgi-bin/xtaccess.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34812	Endian Firewall /cgi-bin/proxypolicy.cgi mimetypes Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34813	Endian Firewall /cgi-bin/proxyuser.cgi user Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34814	Endian Firewall /cgi-bin/proxygroup.cgi group Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34815	Endian Firewall /cgi-bin/smtpdomains.cgi DOMAIN Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34816	Endian Firewall /manage/smtpscan/domainrouting/ domain Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34817	Endian Firewall /cgi-bin/smtprouting.cgi ADDRESS BCC Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34818	Endian Firewall /manage/dnsmasq/localdomains/ remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34819	Endian Firewall /cgi-bin/openvpnclient.cgi REMARK Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34820	Endian Firewall /manage/ipsec/ remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34821	Endian Firewall /manage/vpnauthentication/user/ remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34822	Endian Firewall /manage/ca/certificate/ new_cert_name Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34823	Endian Firewall /manage/password/web/ remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34951	Reflected XSS in footer.php in Workbench Allows Attackers to Hijack Authenticated Sessions	workbench	5.1 (v4.0)	Medium
CVE-2026-35007	Open ISES Tickets < 3.44.2 Reflected XSS via single_unit.php id Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35008	Open ISES Tickets < 3.44.2 Reflected XSS via single.php ticket_id Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35009	Open ISES Tickets < 3.44.2 Reflected XSS via add_note.php ticket_id Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35010	Open ISES Tickets < 3.44.2 Reflected XSS via patient_JF.php ticket_id Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35011	Open ISES Tickets < 3.44.2 Reflected XSS via opena.php frm_call Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35012	Open ISES Tickets < 3.44.2 Reflected XSS via add_facnote.php ticket_id Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35014	Open ISES Tickets < 3.44.2 Reflected XSS via routes_nm.php ticket_id Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35015	Open ISES Tickets < 3.44.2 Reflected XSS via do_unit_mail.php the_ticket Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35016	Open ISES Tickets < 3.44.2 Reflected XSS via search.php frm_query Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-40507	OpenEMR < 8.3.0 Reflected XSS via templateHtml Parameter in Patient Portal	openemr	5.1 (v4.0)	Medium
CVE-2026-40508	OpenEMR < 8.3.0 Stored XSS via Patient Portal Template Import Handler	openemr	5.1 (v4.0)	Medium
CVE-2026-4093	Stored XSS in Drupal 7 Term Reference Tree module (token display templates and term labels)	taxonomy term reference tree widget	5.1 (v4.0)	Medium
CVE-2026-41929	Vvveb < 1.0.8.2 Unauthenticated Reflected XSS via Visual Editor	Vvveb	5.1 (v4.0)	Medium
CVE-2026-42840	ERPNext 16.16.0 - Stored XSS in POS customer section via unescaped template literals	ERPNext	5.1 (v4.0)	Medium
CVE-2026-4316	Reflected Cross-Site Scripting in software IsMyGym by Zuinq Studio	IsMyGym	5.1 (v4.0)	Medium
CVE-2026-45228	Quark Drive (quark-auto-save) < 0.8.5 Stored XSS via System Configuration	quark-auto-save	5.1 (v4.0)	Medium
CVE-2026-45381	Tautulli: Reflected XSS in `/search` endpoint	Tautulli	5.1 (v4.0)	Medium
CVE-2026-45551	Group-Office: Authenticated Stored XSS in Administrator Context via Arbitrary Cross-User Setting Write	groupoffice	5.1 (v4.0)	Medium
CVE-2026-45616	Vvveb: Stored XSS in Posts allows privilege escalation via post editor	Vvveb	5.1 (v4.0)	Medium
CVE-2026-46363	phpMyFAQ - Stored XSS in FAQ Question/Answer via Encode-Decode Bypass	phpmyfaq	5.1 (v4.0)	Medium
CVE-2026-47106	Ellucian Banner Self-Service Stored XSS via getFacultyMeetingTimes API	Banner Self-Service	5.1 (v4.0)	Medium
CVE-2026-48214	Open ISES Tickets < 3.44.2 Reflected XSS via add_nm.php ticket_id Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48215	Open ISES Tickets < 3.44.2 Reflected XSS via circle.php frm_id Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48218	Open ISES Tickets < 3.44.2 Reflected XSS via icons/buttons/landb.php frm_name and frm_id Parameters	Tickets	5.1 (v4.0)	Medium
CVE-2026-48219	Open ISES Tickets < 3.44.2 Reflected XSS via ics202.php frm_add_str Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48220	Open ISES Tickets < 3.44.2 Reflected XSS via ics205.php frm_add_str Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48221	Open ISES Tickets < 3.44.2 Reflected XSS via ics205a.php frm_add_str Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48222	Open ISES Tickets < 3.44.2 Reflected XSS via ics213.php frm_add_str Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48223	Open ISES Tickets < 3.44.2 Reflected XSS via ics213rr.php frm_add_str Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48224	Open ISES Tickets < 3.44.2 Reflected XSS via ics214.php frm_add_str Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48225	Open ISES Tickets < 3.44.2 Reflected XSS via landb.php _type Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48226	Open ISES Tickets < 3.44.2 Reflected XSS via os_watch.php ref and mode_orig Parameters	Tickets	5.1 (v4.0)	Medium
CVE-2026-48227	Open ISES Tickets < 3.44.2 Reflected XSS via patient.php id and ticket_id Parameters	Tickets	5.1 (v4.0)	Medium
CVE-2026-48228	Open ISES Tickets < 3.44.2 Reflected XSS via patient_w.php id and ticket_id Parameters	Tickets	5.1 (v4.0)	Medium
CVE-2026-48229	Open ISES Tickets < 3.44.2 Reflected XSS via routes_i.php ticket_id Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48530	GFI Archiver < 15.13 Stored XSS via CategorizationPolicyWizard.aspx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48531	GFI Archiver < 15.13 Stored XSS via RetentionPolicyWizard.aspx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48532	GFI Archiver < 15.13 Stored XSS via FAARetentionPolicyWizard.aspx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48534	GFI Archiver < 15.13 Stored XSS via ImapServerWizard.aspx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48535	GFI Archiver < 15.13 Stored XSS via CallHomeSettingsWizard.aspx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48536	GFI Archiver < 15.13 Stored XSS via GeneralSettingsWizard.aspx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48537	GFI Archiver < 15.13 Stored XSS via FileArchiveAssistantWizard.aspx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48538	GFI Archiver < 15.13 Stored XSS via ImportSettingsWizard.ashx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48539	GFI Archiver < 15.13 Stored XSS via MailInsights.aspx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48540	Krayin CRM 2.2.6 Stored Template Injection XSS via Lead Title	laravel-crm	5.1 (v4.0)	Medium
CVE-2026-48559	Lightweight Music Server 3.76.0 Stored XSS via Media File Metadata Tags	lms	5.1 (v4.0)	Medium
CVE-2026-49131	OPNsense < 26.1.9 Stored XSS via Firewall Rule Description Field	OPNsense	5.1 (v4.0)	Medium
CVE-2026-49132	OPNsense < 26.1.9 Stored XSS via Certificate Description Field	OPNsense	5.1 (v4.0)	Medium
CVE-2026-5010	Reflected Cross-Site Scripting (XSS) in Sanoma’s Clickedu	Clickedu	5.1 (v4.0)	Medium
CVE-2026-50701	Frappe Framework 17.0.0-dev - Reflected DOM XSS in dashboard-view breadcrumb rendering	Frappe Framework	5.1 (v4.0)	Medium
CVE-2026-53555	Stored XSS via SVG Upload	SQLBot	5.1 (v4.0)	Medium
CVE-2026-53992	Reflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date Parameters	ProjectSend	5.1 (v4.0)	Medium
CVE-2026-54386	marimo < 0.23.9 XSS via file Query Parameter in assets.py	marimo	5.1 (v4.0)	Medium
CVE-2026-56126	pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php	pfSense Plus	5.1 (v4.0)	Medium
CVE-2026-56127	pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php	pfSense Plus	5.1 (v4.0)	Medium
CVE-2026-56128	pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php	pfSense Plus	5.1 (v4.0)	Medium
CVE-2026-57857	Flow Payment Plugin for WordPress Reflected Cross-Site Scripting via error_message Parameter	Flow Payment	5.1 (v4.0)	Medium
CVE-2026-57958	Mixpost 2.6.0 - Reflected XSS via OAuth Callback Error Parameter	mixpost	5.1 (v4.0)	Medium
CVE-2026-58579	RAGFlow < 0.26.3 - Stored Cross-Site Scripting via Agent Pipeline Node Name	ragflow	5.1 (v4.0)	Medium
CVE-2026-60092	AVideo - Stored Cross-Site Scripting via Unescaped User-Agent in Participants Panel	AVideo	5.1 (v4.0)	Medium
CVE-2026-6082	Stored Cross-Site Scripting in StockAgile by Novadigits technologies	StockAgile	5.1 (v4.0)	Medium
CVE-2026-6083	Stored Cross-Site Scripting in StockAgile by Novadigits technologies	StockAgile	5.1 (v4.0)	Medium
CVE-2026-6084	Stored Cross-Site Scripting in StockAgile by Novadigits technologies	StockAgile	5.1 (v4.0)	Medium
CVE-2026-6085	Stored Cross-Site Scripting in StockAgile by Novadigits technologies	StockAgile	5.1 (v4.0)	Medium
CVE-2026-6086	Stored Cross-Site Scripting in StockAgile by Novadigits technologies	StockAgile	5.1 (v4.0)	Medium
CVE-2026-6087	Stored Cross-Site Scripting in StockAgile by Novadigits technologies	StockAgile	5.1 (v4.0)	Medium
CVE-2026-6088	Stored Cross-Site Scripting in StockAgile by Novadigits technologies	StockAgile	5.1 (v4.0)	Medium
CVE-2026-61453	Grav before 2.0.1 XSS via Twig String Concatenation	grav	5.1 (v4.0)	Medium
CVE-2026-61504	Rejetto HFS < 3.2.1 Stored XSS via File Names in Basic Web Listing	hfs	5.1 (v4.0)	Medium
CVE-2026-64628	Grav Stored Cross-Site Scripting via Shortcode Attribute Handlers	grav	5.1 (v4.0)	Medium
CVE-2026-65697	Fathom Lite 1.3.1 Stored XSS via /collect Endpoint	fathom	5.1 (v4.0)	Medium
CVE-2026-66296	Reflected XSS in oaskit's default HTML error handler	oaskit	5.1 (v4.0)	Medium
CVE-2026-67333	better-auth before 1.6.13 Stored XSS via javascript redirect_uri	better-auth	5.1 (v4.0)	Medium
CVE-2026-68583	luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name	luci	5.1 (v4.0)	Medium
CVE-2026-6954	Multiple vulnerabilities in Intermark IT's WebControl CMS	WebControl CMS	5.1 (v4.0)	Medium
CVE-2026-71503	Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template	dolibarr	5.1 (v4.0)	Medium
CVE-2026-72743	SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html	SQLBot	5.1 (v4.0)	Medium
CVE-2026-72747	AVideo Stored Cross-Site Scripting via Unauthenticated Registration	AVideo	5.1 (v4.0)	Medium
CVE-2026-72821	Grav Form Plugin before 9.1.15 Stored XSS via Radio Toggle	grav	5.1 (v4.0)	Medium
CVE-2026-72832	Grav before 2.0.12 Stored XSS via quoted-attribute bypass	grav	5.1 (v4.0)	Medium
CVE-2026-73319	XenForo < 2.3.13 XSS via Dynamic Redirect Handler	xenforo	5.1 (v4.0)	Medium
CVE-2026-75831	Grav before 2.0.15 Stored XSS via audio/video source URL	grav	5.1 (v4.0)	Medium
CVE-2026-84477	AVideo Stored XSS via Live Schedule Title Description	AVideo	5.1 (v4.0)	Medium
CVE-2026-85593	phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode	phpMyFAQ	5.1 (v4.0)	Medium
CVE-2026-85600	Grav Admin before 2.0.21 Stored XSS via username	grav-plugin-admin2	5.1 (v4.0)	Medium
CVE-2026-86197	Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox	grav	5.1 (v4.0)	Medium
CVE-2026-90528	TDuckApp tduck-platform Form Write View index.vue cross site scripting	tduck-platform	5.1 (v4.0)	Medium
CVE-2026-90563	maliangnansheng bbs-springboot ArticleController.java utils.toToc cross site scripting	bbs-springboot	5.1 (v4.0)	Medium
CVE-2026-90567	quequnlong shiyi-blog Search index.vue highlightKeyword cross site scripting	shiyi-blog	5.1 (v4.0)	Medium
CVE-2026-90568	moxi624 Mogu Blog v2 blogSort Endpoint info.ftl BlogSortServiceImpl.addBlogSort cross site scripting	Mogu Blog v2	5.1 (v4.0)	Medium
CVE-2026-90602	Anil-matcha Open-Generative-AI Studio Components ImageStudio.js renderHistory cross site scripting	Open-Generative-AI	5.1 (v4.0)	Medium
CVE-2026-90931	LaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG Upload	laradashboard	5.1 (v4.0)	Medium
CVE-2026-91944	crawl4ai before 0.9.3 DOM-based XSS via Playground UI	crawl4ai	5.1 (v4.0)	Medium
CVE-2026-96535	Cross-Site Scripting in the YouMind web application	YouMind web application	5.1 (v4.0)	Medium
CVE-2013-6043	Webuzo 2.1.3 - Multiple Vulnerabilities	webuzo	5.0 (v2.0)	Medium
CVE-2015-4666	Xceedium Xsuite - Multiple Vulnerabilities	xsuite	5.0 (v2.0)	Medium
CVE-2026-43979	Local Deep Research: HTML Injection via Unescaped User Input in PDF Export (`pdf_service.py:_markdown_to_html`)	local-deep-research	5.0 (v3.1)	Medium
CVE-2026-107757	Gallery Custom Links <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Author Display Name	Gallery Custom Links	4.9 (v3.1)	Medium
CVE-2017-14651	WSO2 Data Analytics Server 3.1.0 - Cross-Site Scripting	api manager	4.8 (v3.1)	Medium
CVE-2018-1186	Dell EMC Isilon OneFS - Multiple Vulnerabilities	emc isilon	4.8 (v3.0)	Medium
CVE-2018-1187	Dell EMC Isilon OneFS - Multiple Vulnerabilities	emc isilon	4.8 (v3.0)	Medium
CVE-2018-1188	Dell EMC Isilon OneFS - Multiple Vulnerabilities	emc isilon	4.8 (v3.0)	Medium
CVE-2018-1189	Dell EMC Isilon OneFS - Multiple Vulnerabilities	emc isilon	4.8 (v3.0)	Medium
CVE-2018-1201	Dell EMC Isilon OneFS - Multiple Vulnerabilities	emc isilon	4.8 (v3.0)	Medium
CVE-2018-1202	Dell EMC Isilon OneFS - Multiple Vulnerabilities	emc isilon	4.8 (v3.0)	Medium
CVE-2020-29240	LEPTON CMS 4.7.0 - 'URL' Persistent Cross-Site Scripting	leptoncms	4.8 (v3.1)	Medium
CVE-2024-3822	Base64 Encoder/Decoder <= 0.9.2 - Reflected XSS	base64 encoderdecoder	4.8 (v3.1)	Medium
CVE-2025-15669	Bit Form < 3.1.4 - Admin+ Stored XSS via Conversational Form Progress Label	Bit Form	4.8 (v3.1)	Medium
CVE-2025-40648	Stored Cross-Site Scripting (XSS) vulnerability in Issabel products	Issabel	4.8 (v4.0)	Medium
CVE-2025-43817	digital experience platform Cross-Site Scripting Vulnerability	digital experience platform	4.8 (v4.0)	Medium
CVE-2025-61996	OPEXUS FOIAXpress stored XSS via annual report template	foiaxpress	4.8 (v4.0)	Medium
CVE-2025-62248	digital experience platform Cross-Site Scripting Vulnerability	digital experience platform	4.8 (v4.0)	Medium
CVE-2025-62263	digital experience platform Cross-Site Scripting Vulnerability	digital experience platform	4.8 (v4.0)	Medium
CVE-2025-62411	Stored XSS in Alert Transport name field in LibreNMS	librenms	4.8 (v3.1)	Medium
CVE-2025-62414	bagisto - Cross Site Scripting (XSS) in Create New Customer	bagisto	4.8 (v3.1)	Medium
CVE-2025-9823	Reflected XSS in lead:addLeadTags - Quick Add	Mautic	4.8 (v4.0)	Medium
CVE-2026-100376	TemplateSandbox can be abused for XSS by asking another user to preview a page with a certain sandbox prefix	Mediawiki - TemplateSandbox Extension	4.8 (v4.0)	Medium
CVE-2026-111232	Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color	pfsense	4.8 (v4.0)	Medium
CVE-2026-113712	Cachet has Stored XSS in Incident Component	cachet	4.8 (v4.0)	Medium
CVE-2026-22674	Hashgraph Guardian Stored XSS via branding companyName field	guardian	4.8 (v4.0)	Medium
CVE-2026-26211	Ekushey Project Manager CRM 5.0 Stored XSS via System Name Field	Ekushey Project Manager CRM	4.8 (v4.0)	Medium
CVE-2026-34096	Guardian Language-System XSS via name Parameter in designer.php	language-system	4.8 (v4.0)	Medium
CVE-2026-34097	Guardian Language-System XSS via id Parameter in text_file.php	language-system	4.8 (v4.0)	Medium
CVE-2026-34098	Guardian Language-System XSS via id Parameter in media.php	language-system	4.8 (v4.0)	Medium
CVE-2026-34246	CtrlPanel: Stored XSS in Admin Role Management via Unescaped DataTable HTML Output	panel	4.8 (v3.1)	Medium
CVE-2026-34729	phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes()	phpmyfaq	4.8 (v3.1)	Medium
CVE-2026-39390	CI4MS has Stored XSS via srcdoc attribute bypass in Google Maps iframe setting	ci4ms	4.8 (v3.1)	Medium
CVE-2026-39392	CI4MS has Stored XSS in Pages Content Due to Missing html_purify Sanitization	ci4ms	4.8 (v3.1)	Medium
CVE-2026-40230	Helpy 2.8.0 - Stored XSS in knowledgebase Doc body rendering	helpy	4.8 (v4.0)	Medium
CVE-2026-50708	Frappe Framework 17.0.0-dev - Stored XSS in Multi Select Dialog result rendering	Frappe Framework	4.8 (v4.0)	Medium
CVE-2026-54645	CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass	v6	4.8 (v3.1)	Medium
CVE-2026-56283	Capgo - HTML Injection Leading to Open Redirection in Organization Settings	Capgo	4.8 (v4.0)	Medium
CVE-2026-58657	Grav - Stored CSS Injection via Markdown Image resize() Action	Grav	4.8 (v4.0)	Medium
CVE-2026-59659	Multiple vulnerabilities in the Repasat application	Repasat application	4.8 (v4.0)	Medium
CVE-2026-59660	Multiple vulnerabilities in the Repasat application	Repasat application	4.8 (v4.0)	Medium
CVE-2026-59661	Multiple vulnerabilities in the Repasat application	Repasat application	4.8 (v4.0)	Medium
CVE-2026-59662	Multiple vulnerabilities in the Repasat application	Repasat application	4.8 (v4.0)	Medium
CVE-2026-59663	Multiple vulnerabilities in the Repasat application	Repasat application	4.8 (v4.0)	Medium
CVE-2026-59664	Multiple vulnerabilities in the Repasat application	Repasat application	4.8 (v4.0)	Medium
CVE-2026-59665	Multiple vulnerabilities in the Repasat application	Repasat application	4.8 (v4.0)	Medium
CVE-2026-59666	Multiple vulnerabilities in the Repasat application	Repasat application	4.8 (v4.0)	Medium
CVE-2026-59667	Multiple vulnerabilities in the Repasat application	Repasat application	4.8 (v4.0)	Medium
CVE-2026-59668	Multiple vulnerabilities in the Repasat application	Repasat application	4.8 (v4.0)	Medium
CVE-2026-59669	Multiple vulnerabilities in the Repasat application	Repasat application	4.8 (v4.0)	Medium
CVE-2026-59670	Multiple vulnerabilities in the Repasat application	Repasat application	4.8 (v4.0)	Medium
CVE-2026-59672	Multiple vulnerabilities in the Repasat application	Repasat application	4.8 (v4.0)	Medium
CVE-2026-59673	Multiple vulnerabilities in the Repasat application	Repasat application	4.8 (v4.0)	Medium
CVE-2026-63001	REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`	redaxo	4.8 (v3.1)	Medium
CVE-2026-63002	REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames	redaxo	4.8 (v3.1)	Medium
CVE-2026-65930	LimeSurvey Community Edition 7.0.5 - Stored XSS in replacement-fields	LimeSurvey	4.8 (v4.0)	Medium
CVE-2026-6623	BichitroGan ISP Billing Software Profile users-view cross site scripting	ISP Billing Software	4.8 (v4.0)	Medium
CVE-2026-67612	OpenEMR 8.2.0 Stored XSS via import_template.php Template Management	openemr	4.8 (v4.0)	Medium
CVE-2026-67617	Microweber CMS 2.0.20 Stored XSS via tag_names Parameter	microweber	4.8 (v4.0)	Medium
CVE-2026-70560	Ultimate POS Stored XSS via First Name Field in Leave Notifications	Ultimate POS (Stock Management & Point of Sale)	4.8 (v4.0)	Medium
CVE-2026-7173	Multiple vulnerabilities in Entradium by Crocantickets	Entradium	4.8 (v4.0)	Medium
CVE-2026-7174	Multiple vulnerabilities in Entradium by Crocantickets	Entradium	4.8 (v4.0)	Medium
CVE-2026-7175	Multiple vulnerabilities in Entradium by Crocantickets	Entradium	4.8 (v4.0)	Medium
CVE-2026-7176	Multiple vulnerabilities in Entradium by Crocantickets	Entradium	4.8 (v4.0)	Medium
CVE-2026-79663	Ech0 before 4.7.3 Stored XSS via RSS feed tag names	Ech0	4.8 (v4.0)	Medium
CVE-2026-79670	Ech0 before 4.4.3 Stored XSS via SVG Upload	Ech0	4.8 (v4.0)	Medium
CVE-2026-84188	librenms before 26.7.0 Stored XSS via graph_descr settings	librenms	4.8 (v4.0)	Medium
CVE-2026-85293	InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer Forms	InvoicePlane	4.8 (v3.1)	Medium
CVE-2026-90569	linlinjava litemall Admin Topic index.vue AdminTopicController.validate cross site scripting	litemall	4.8 (v4.0)	Medium
CVE-2026-90570	linlinjava litemall Product Detail index.vue AdminGoodsService.validate cross site scripting	litemall	4.8 (v4.0)	Medium
CVE-2026-95662	Multiple vulnerabilities in the Repasat application	Repasat application	4.8 (v4.0)	Medium
CVE-2026-3093	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab	gitlab	4.7 (v3.1)	Medium
CVE-2025-61074	mitarbeiter portal Cross-Site Scripting Vulnerability	mitarbeiter portal	4.6 (v3.1)	Medium
CVE-2025-65229	lyrion music server Cross-Site Scripting Vulnerability	lyrion music server	4.6 (v3.1)	Medium
CVE-2025-67342	ruoyi Cross-Site Scripting Vulnerability	ruoyi	4.6 (v3.1)	Medium
CVE-2025-67344	jsherp Cross-Site Scripting Vulnerability	jsherp	4.6 (v3.1)	Medium
CVE-2026-16273	Narrative Publisher <= 1.0.7 - Contributor+ Stored XSS via narrative_post_script Post Meta	Narrative Publisher	4.6 (v3.1)	Medium
CVE-2026-50698	Frappe Framework 17.0.0-dev - Stored XSS in Audit Trail template rendering	Frappe Framework	4.6 (v4.0)	Medium
CVE-2026-50700	Frappe Framework 17.0.0-dev - Stored XSS in frappe.get_avatar image rendering	Frappe Framework	4.6 (v4.0)	Medium
CVE-2026-50710	Frappe Framework 17.0.0-dev - Stored XSS via eval in Number Card filters_config	Frappe Framework	4.6 (v4.0)	Medium
CVE-2026-53468	Typemill has Stored HTML Attribute Injection in Metadata Fields	typemill	4.6 (v3.1)	Medium
CVE-2026-56381	Craft CMS - Stored XSS via User Group Name in User Permissions Page	cms	4.6 (v4.0)	Medium
CVE-2026-56393	Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options	cms	4.6 (v4.0)	Medium
CVE-2026-75331	tamguo 1.5.3 Cross-Site Scripting Vulnerability	-	4.6 (v3.1)	Medium
CVE-2026-10100	Simple Custom Login Page <= 1.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting	Simple Custom Login Page	4.4 (v3.1)	Medium
CVE-2008-2398	AppServ Open Project <=2.5.10 - Cross-Site Scripting	appserv	4.3 (v2.0)	Medium
CVE-2008-6465	Parallels H-Sphere 3.0.0 P9/3.1 P1 - Cross-Site Scripting	h-sphere	4.3 (v2.0)	Medium
CVE-2013-6042	Webuzo 2.1.3 - Multiple Vulnerabilities	webuzo	4.3 (v2.0)	Medium
CVE-2014-100004	Sitecore CMS - Cross-Site Scripting	sitecore.net	4.3 (v2.0)	Medium
CVE-2014-3110	Honeywell XL Web Controller - Cross-Site Scripting	falcon xlweb linux controller	4.3 (v2.0)	Medium
CVE-2015-1389	Aruba ClearPass Policy Manager - Persistent Cross-Site Scripting	clearpass policy manager	4.3 (v2.0)	Medium
CVE-2015-4665	Xceedium Xsuite - Multiple Vulnerabilities	xsuite	4.3 (v2.0)	Medium
CVE-2015-6402	Cisco EPC 3928 - Multiple Vulnerabilities	epc3928 docsis 3.0 8x4 wireless residential gateway with embedded digital voice adapter	4.3 (v2.0)	Medium
CVE-2018-6225	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	4.3 (v3.0)	Medium
CVE-2020-7318	McAfee ePolicy Orchestrator <5.10.9 Update 9 - Cross-Site Scripting	epolicy orchestrator	4.3 (v3.1)	Medium
CVE-2024-34061	Changedetection.io <=v0.45.21 - Cross-Site Scripting	changedetection.io	4.3 (v3.1)	Medium
CVE-2025-9703	Ultimate Addons for Elementor Lite < 2.5.0 - Author+ Stored XSS	Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder)	4.3 (v3.1)	Medium
CVE-2026-12724	Kirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-password	Kirki	4.3 (v3.1)	Medium
CVE-2026-32250	NamelessMC has Reflected Cross-Site Scripting (XSS) in id parameter of /index.php?route=/queries/user/	Nameless	4.3 (v3.1)	Medium
CVE-2026-55566	Yamcs: DOM XSS in Extension Routing	yamcs	4.3 (v3.1)	Medium
CVE-2026-102576	Quay: quay: dom-based cross-site scripting via unvalidated redirect_url on signin page	Red Hat Quay 3	4.2 (v3.1)	Medium
CVE-2026-17011	Nexter Blocks < 5.0.2 - Contributor+ Stored CSS Injection	Nexter Blocks	3.8 (v3.1)	Low
CVE-2026-113657	ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)	apostrophe	3.7 (v3.1)	Low
CVE-2025-66040	Spotipy has a XSS vulnerability in OAuth callback server	spotipy	3.6 (v3.1)	Low
CVE-2026-10827	Spectra (Ultimate Addons for Gutenberg) < 2.20.0 - Contributor+ Stored CSS Injection via Block Attributes	Spectra Legacy	3.5 (v3.1)	Low
CVE-2026-13393	ElementsKit Lite < 3.10.01 - Subsite Administrator+ Stored XSS via Megamenu Menu-Item Settings (Multisite)	ElementsKit Elementor Addons	3.5 (v3.1)	Low
CVE-2026-27937	October: Reflected XSS via DataTable Form Widget	october	3.1 (v3.1)	Low
CVE-2026-52838	Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS	easyappointments	2.6 (v3.1)	Low
CVE-2026-91165	Warpgate: Markup injection in SSO form_post return page via unencoded redirect/error values	warpgate	2.4 (v3.1)	Low
CVE-2026-114127	Astro: Arbitrary CSS injection in Astro View Transitions	astro	2.3 (v4.0)	Low
CVE-2026-42794	Reflected XSS via backslash bypass in GraphiQL js_escape in absinthe_plug	absinthe.plug	2.3 (v4.0)	Low
CVE-2026-66300	SNOMED International Snowstorm reflected XSS	Snowstorm	2.3 (v4.0)	Low
CVE-2025-10063	itsourcecode POS Point of Sale System deferred_table.php cross site scripting	point of sale system	2.1 (v4.0)	Low
CVE-2025-10067	itsourcecode POS Point of Sale System empty_table.php cross site scripting	point of sale system	2.1 (v4.0)	Low
CVE-2025-10590	Portabilis i-Educar educar_usuario_det.php cross site scripting	i-educar	2.1 (v4.0)	Low
CVE-2025-10605	Portabilis i-Educar agenda_preferencias.php cross site scripting	i-educar	2.1 (v4.0)	Low
CVE-2025-10614	itsourcecode E-Logbook with Health Monitoring System for COVID-19 print_reports_prev.php cross site scripting	e-logbook with health monitoring system for covid-19	2.1 (v4.0)	Low
CVE-2025-10710	07FLYCMS/07FLY-CMS/07FlyCRM index.php cross site scripting	07FLYCMS	2.1 (v4.0)	Low
CVE-2025-10711	07FLYCMS/07FLY-CMS/07FlyCRM Login cross site scripting	07FLYCMS	2.1 (v4.0)	Low
CVE-2025-10827	PHPJabbers Restaurant Menu Maker preview.php cross site scripting	restaurant menu maker	2.1 (v4.0)	Low
CVE-2025-11112	PHPGurukul Employee Record Management System myprofile.php cross site scripting	employee record management system	2.1 (v4.0)	Low
CVE-2025-11119	itsourcecode Hostel Management System POST Request index.php cross site scripting	hostel management system	2.1 (v4.0)	Low
CVE-2025-11306	qianfox FoxCMS Search cross site scripting	foxcms	2.1 (v4.0)	Low
CVE-2025-11512	code-projects Voting System voters_add.php cross site scripting	voting system	2.1 (v4.0)	Low
CVE-2025-12244	code-projects Simple E-Banking System register.php cross site scripting	simple e-banking system	2.1 (v4.0)	Low
CVE-2025-12289	Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 1001 cross site scripting	Suishang Enterprise-Level B2B2C Multi-User Mall System	2.1 (v4.0)	Low
CVE-2025-12290	Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 359 cross site scripting	Suishang Enterprise-Level B2B2C Multi-User Mall System	2.1 (v4.0)	Low
CVE-2025-12298	code-projects Simple Food Ordering System editcategory.php cross site scripting	simple food ordering system	2.1 (v4.0)	Low
CVE-2025-12299	code-projects Simple Food Ordering System addproduct.php cross site scripting	simple food ordering system	2.1 (v4.0)	Low
CVE-2025-12300	code-projects Simple Food Ordering System addcategory.php cross site scripting	simple food ordering system	2.1 (v4.0)	Low
CVE-2025-12302	code-projects Simple Food Ordering System editproduct.php cross site scripting	simple food ordering system	2.1 (v4.0)	Low
CVE-2025-13244	code-projects Student Information System register.php cross site scripting	student information system	2.1 (v4.0)	Low
CVE-2025-14962	code-projects Simple Stock System chatuser.php cross site scripting	simple stock system	2.1 (v4.0)	Low
CVE-2025-15093	sunkaifei FlyCMS Admin Login IndexAdminController.java cross site scripting	flycms	2.1 (v4.0)	Low
CVE-2025-15094	sunkaifei FlyCMS User Login UserController.java userLogin cross site scripting	flycms	2.1 (v4.0)	Low
CVE-2025-15144	dayrui XunRuiCMS JSONP Callback Init.php dr_exit_msg cross site scripting	xunruicms	2.1 (v4.0)	Low
CVE-2025-15220	SohuTV CacheCloud LoginController.java init cross site scripting	cachecloud	2.1 (v4.0)	Low
CVE-2025-9647	mtons mblog list cross site scripting	mblog	2.1 (v4.0)	Low
CVE-2025-9656	PHPGurukul Directory Management System add-directory.php cross site scripting	directory management system	2.1 (v4.0)	Low
CVE-2025-9755	Khanakag-17 Library Management System index.php cross site scripting	library management system	2.1 (v4.0)	Low
CVE-2025-9773	RemoteClinic edit.php cross site scripting	remote clinic	2.1 (v4.0)	Low
CVE-2026-0586	code-projects Online Product Reservation System prod.php cross site scripting	online product reservation system	2.1 (v4.0)	Low
CVE-2026-100313	mathurvishal CloudClassroom-PHP-Project updatequery.php cross site scripting	CloudClassroom-PHP-Project	2.1 (v4.0)	Low
CVE-2026-100877	mathurvishal CloudClassroom-PHP-Project registrationform.php cross site scripting	CloudClassroom-PHP-Project	2.1 (v4.0)	Low
CVE-2026-10153	westboy CicadasCMS AbstractCacheManager.java search cross site scripting	CicadasCMS	2.1 (v4.0)	Low
CVE-2026-10173	Orthanc Explorer 2 URL StudyList.vue cross site scripting	Explorer 2	2.1 (v4.0)	Low
CVE-2026-102366	mall4j through 4.0 Unrestricted File Upload in Admin File Endpoints	mall4j	2.1 (v4.0)	Low
CVE-2026-10289	code-projects Hotel and Tourism Reservation System tour.php cross site scripting	Hotel and Tourism Reservation System	2.1 (v4.0)	Low
CVE-2026-10301	itsourcecode Fees Management System index.php cross site scripting	Fees Management System	2.1 (v4.0)	Low
CVE-2026-105288	feelec-yishu feelcrm-os Crm Endpoint functions.php index cross site scripting	feelcrm-os	2.1 (v4.0)	Low
CVE-2026-105291	feelec-yishu feelcrm-os Department Search Endpoint GroupController.class.php index cross site scripting	feelcrm-os	2.1 (v4.0)	Low
CVE-2026-105708	imgproxy SVG svg.go sanitizeElement cross site scripting	imgproxy	2.1 (v4.0)	Low
CVE-2026-105809	SourceCodester Simple Student Information System Profile Field register.php cross site scripting	Simple Student Information System	2.1 (v4.0)	Low
CVE-2026-10810	itsourcecode Fees Management System navbar.php cross site scripting	Fees Management System	2.1 (v4.0)	Low
CVE-2026-108931	Netcore NR268 DHCP dhcp_dynamicip_show.cgi eval cross site scripting	NR268	2.1 (v4.0)	Low
CVE-2026-108932	Netcore NR268 DHCP Hostname filter_hosts_dump.cgi eval cross site scripting	NR268	2.1 (v4.0)	Low
CVE-2026-110627	ClipBucket v5 through 5.5.3-#206 Reflected XSS via add_todo val Parameter	clipbucket-v5	2.1 (v4.0)	Low
CVE-2026-111877	dext34-morgan Books4Cash search.php cross site scripting	Books4Cash	2.1 (v4.0)	Low
CVE-2026-111942	hrisikeshpal Blood_Bank_Management_System abs.php cross site scripting	Blood Bank Management System	2.1 (v4.0)	Low
CVE-2026-111984	AUTOMATIC1111 stable-diffusion-webui Card Builder ui_extra_networks.py create_item_html cross site scripting	stable-diffusion-webui	2.1 (v4.0)	Low
CVE-2026-112093	subhajitkhan online-clinic-management-system feedback.php cross site scripting	online-clinic-management-system	2.1 (v4.0)	Low
CVE-2026-11337	tittuvarghese CollegeManagementSystem fetch.php cross site scripting	CollegeManagementSystem	2.1 (v4.0)	Low
CVE-2026-113741	itsourcecode Online Cake Ordering System 404.php cross site scripting	Online Cake Ordering System	2.1 (v4.0)	Low
CVE-2026-11436	Mage AI Sign-in Flow index.tsx useMutation cross site scripting	Mage AI	2.1 (v4.0)	Low
CVE-2026-11512	itsourcecode Hospital Management System billing.php cross site scripting	Hospital Management System	2.1 (v4.0)	Low
CVE-2026-11518	SourceCodester Inventory System User Management users.php cross site scripting	Inventory System	2.1 (v4.0)	Low
CVE-2026-115534	gedelumbung HospitalManagement Contact Form contact.php kirim cross site scripting	HospitalManagement	2.1 (v4.0)	Low
CVE-2026-115982	phpIPAM Rack Link Creation show-rack-popup.php create_rack_link cross site scripting	phpIPAM	2.1 (v4.0)	Low
CVE-2026-116047	Privoce Vocechat Query Parameter widget.html cross site scripting	Vocechat	2.1 (v4.0)	Low
CVE-2026-116097	CloudClassroom-PHP-Project addnewstudent.php cross site scripting	CloudClassroom-PHP-Project	2.1 (v4.0)	Low
CVE-2026-13499	yashpokharna2555 restaurent-management-system Registration login_register.php cross site scripting	restaurent-management-system	2.1 (v4.0)	Low
CVE-2026-13554	itsourcecode Online Hotel Management System POST Request controller.php add cross site scripting	Online Hotel Management System	2.1 (v4.0)	Low
CVE-2026-13556	itsourcecode Online Hotel Management System POST Request controller.php edit cross site scripting	Online Hotel Management System	2.1 (v4.0)	Low
CVE-2026-13557	itsourcecode Online Hotel Management System POST Request controller.php add cross site scripting	Online Hotel Management System	2.1 (v4.0)	Low
CVE-2026-13567	code-projects Online Music Site POST Request Feedback.php cross site scripting	Online Music Site	2.1 (v4.0)	Low
CVE-2026-14634	kirilkirkov Ecommerce-CodeIgniter-Bootstrap Subscribed Emails Admin MY_Controller.php checkForPostRequests cross site sc	Ecommerce-CodeIgniter-Bootstrap	2.1 (v4.0)	Low
CVE-2026-14656	code-projects Assessment Management remove-user.php cross site scripting	Assessment Management	2.1 (v4.0)	Low
CVE-2026-14704	stephen-kruger bluebox cross site scripting	bluebox	2.1 (v4.0)	Low
CVE-2026-15595	SourceCodester Class and Exam Timetabling System forsubject.php cross site scripting	Class and Exam Timetabling System	2.1 (v4.0)	Low
CVE-2026-15596	SourceCodester Class and Exam Timetabling System subject.php cross site scripting	Class and Exam Timetabling System	2.1 (v4.0)	Low
CVE-2026-15715	SourceCodester Class and Exam Timetabling System exam.php cross site scripting	Class and Exam Timetabling System	2.1 (v4.0)	Low
CVE-2026-16220	code-projects Online Examination System account.php cross site scripting	Online Examination System	2.1 (v4.0)	Low
CVE-2026-16229	itsourcecode Courier Management System index.php cross site scripting	Courier Management System	2.1 (v4.0)	Low
CVE-2026-16485	SourceCodester Class and Exam Timetabling System class.php cross site scripting	Class and Exam Timetabling System	2.1 (v4.0)	Low
CVE-2026-16486	SourceCodester Class and Exam Timetabling System BSIS.php cross site scripting	Class and Exam Timetabling System	2.1 (v4.0)	Low
CVE-2026-18968	ttttonyhe OBlog tags.php cross site scripting	OBlog	2.1 (v4.0)	Low
CVE-2026-19378	code-projects Task Management System CommentSave.php cross site scripting	Task Management System	2.1 (v4.0)	Low
CVE-2026-19998	code-projects Online Shopping System offersmail.php cross site scripting	Online Shopping System	2.1 (v4.0)	Low
CVE-2026-5255	code-projects Simple Laundry System Parameter delstaffinfo.php cross site scripting	simple laundry system	2.1 (v4.0)	Low
CVE-2026-5319	itsourcecode Payroll Management System navbar.php cross site scripting	Payroll Management System	2.1 (v4.0)	Low
CVE-2026-5825	code-projects Simple Laundry System delmemberinfo.php cross site scripting	Simple Laundry System	2.1 (v4.0)	Low
CVE-2026-5826	code-projects Simple IT Discussion Forum edit-category.php cross site scripting	Simple IT Discussion Forum	2.1 (v4.0)	Low
CVE-2026-59727	Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands	astro	2.1 (v4.0)	Low
CVE-2026-6032	code-projects Simple Laundry System checkcheckout.php cross site scripting	Simple Laundry System	2.1 (v4.0)	Low
CVE-2026-6035	code-projects Vehicle Showroom Management System ServiceAndSalesReport.php cross site scripting	Vehicle Showroom Management System	2.1 (v4.0)	Low
CVE-2026-6150	code-projects Simple Laundry System checkupdatestatus.php cross site scripting	Simple Laundry System	2.1 (v4.0)	Low
CVE-2026-6159	code-projects Simple ChatBox Endpoint insert.php cross site scripting	Simple ChatBox	2.1 (v4.0)	Low
CVE-2026-66882	Reflected XSS in AshAuthentication confirmation and magic link interaction forms	ash authentication	2.1 (v4.0)	Low
CVE-2026-7089	code-projects Home Service System Appointment Booking booking.php cross site scripting	Home Service System	2.1 (v4.0)	Low
CVE-2026-7116	code-projects Employee Management System mark.php cross site scripting	Employee Management System	2.1 (v4.0)	Low
CVE-2026-7129	SourceCodester Pharmacy Sales and Inventory System index.php cross site scripting	Pharmacy Sales and Inventory System	2.1 (v4.0)	Low
CVE-2026-7401	SourceCodester CET Automated Grading System with AI Predictive Analytics Registration index.php register cross site scri	CET Automated Grading System with AI Predictive Analytics	2.1 (v4.0)	Low
CVE-2026-75077	SourceCodester Class and Exam Timetabling System BSCE2.php cross site scripting	Class and Exam Timetabling System	2.1 (v4.0)	Low
CVE-2026-75078	SourceCodester Class and Exam Timetabling System BSHRM1.php cross site scripting	Class and Exam Timetabling System	2.1 (v4.0)	Low
CVE-2026-78054	SourceCodester Class and Exam Timetabling System BSIS1.php cross site scripting	Class and Exam Timetabling System	2.1 (v4.0)	Low
CVE-2026-78055	SourceCodester Class and Exam Timetabling System BSIT2.php cross site scripting	Class and Exam Timetabling System	2.1 (v4.0)	Low
CVE-2026-78059	SourceCodester Stock Management System printOrder.php cross site scripting	Stock Management System	2.1 (v4.0)	Low
CVE-2026-78060	SourceCodester Stock Management System getOrderReport.php cross site scripting	Stock Management System	2.1 (v4.0)	Low
CVE-2026-79793	code-projects Online Shopping System sumit_form.php cross site scripting	Online Shopping System	2.1 (v4.0)	Low
CVE-2026-82601	SeaCMS err.php cross site scripting	SeaCMS	2.1 (v4.0)	Low
CVE-2026-82625	code-projects Simple Inventory System User Registration register.php cross site scripting	Simple Inventory System	2.1 (v4.0)	Low
CVE-2026-82664	yaojingang GEOFlow JSON-LD Theme HomeController.php cross site scripting	GEOFlow	2.1 (v4.0)	Low
CVE-2026-82700	code-projects Online Shopping System Newsletter Subscription offersmail.php cross site scripting	Online Shopping System	2.1 (v4.0)	Low
CVE-2026-85021	langgenius dify Splash Layout splash.tsx router.replace cross site scripting	dify	2.1 (v4.0)	Low
CVE-2026-85382	light0011 cms Chapter Content Output oneChapter.tpl htmlspecialchars_decode cross site scripting	cms	2.1 (v4.0)	Low
CVE-2026-86216	code-projects Hotel and Tourism Reservation in PHP details.php cross site scripting	Hotel and Tourism Reservation in PHP	2.1 (v4.0)	Low
CVE-2026-86244	FastAdmin User Controller User.php login cross site scripting	FastAdmin	2.1 (v4.0)	Low
CVE-2026-86278	SourceCodester Syllabus-Aligned Learning Management & Examination System manage_subjects.php cross site scripting	Syllabus-Aligned Learning Management & Examination System	2.1 (v4.0)	Low
CVE-2026-86294	SourceCodester Simple Traffic Offense System Settings Update Endpoint save-settings.php cross site scripting	Simple Traffic Offense System	2.1 (v4.0)	Low
CVE-2026-86668	aircheng-org iWebShop-5 pic.php uploadFile cross site scripting	iWebShop-5	2.1 (v4.0)	Low
CVE-2026-87926	Rizwan17 inventory-management-system Login Page index.php cross site scripting	inventory-management-system	2.1 (v4.0)	Low
CVE-2026-90615	SourceCodester Class and Exam Timetabling System subject1.php cross site scripting	Class and Exam Timetabling System	2.1 (v4.0)	Low
CVE-2026-90795	itsourcecode Loan Management System navbar.php cross site scripting	Loan Management System	2.1 (v4.0)	Low
CVE-2026-91854	code-projects Record Management System reg.php cross site scripting	Record Management System	2.1 (v4.0)	Low
CVE-2026-94035	SourceCodester Drug Recommendation System index.php cross site scripting	Drug Recommendation System	2.1 (v4.0)	Low
CVE-2026-9415	code-projects Employee Management System eloginwel.php cross site scripting	Employee Management System	2.1 (v4.0)	Low
CVE-2026-9416	code-projects Employee Management System myprofile.php cross site scripting	Employee Management System	2.1 (v4.0)	Low
CVE-2026-9417	code-projects Employee Management System myprofileup.php cross site scripting	Employee Management System	2.1 (v4.0)	Low
CVE-2026-9418	code-projects Employee Management System changepassemp.php cross site scripting	Employee Management System	2.1 (v4.0)	Low
CVE-2026-9419	code-projects Employee Management System empproject.php cross site scripting	Employee Management System	2.1 (v4.0)	Low
CVE-2026-9448	code-projects Employee Management System applyleave.php cross site scripting	Employee Management System	2.1 (v4.0)	Low
CVE-2026-9518	hemant6488 CodeIgniter-StudentManagementSystem Students Controller view_students.php addStudent cross site scripting	CodeIgniter-StudentManagementSystem	2.1 (v4.0)	Low
CVE-2026-9519	stonith404 pingvin-share Sign-in Auto-Redirect signIn.tsx getServerSideProps cross site scripting	pingvin-share	2.1 (v4.0)	Low
CVE-2026-9520	blitz-js blitz Sign-in LoginForm.tsx cross site scripting	blitz	2.1 (v4.0)	Low
CVE-2026-9527	itsourcecode Electronic Judging System judges.php cross site scripting	Electronic Judging System	2.1 (v4.0)	Low
CVE-2026-9566	teableio teable Sign-up LoginPage.tsx cross site scripting	teable	2.1 (v4.0)	Low
CVE-2025-10074	Portabilis i-Educar tipos cross site scripting	i-educar	2.0 (v4.0)	Low
CVE-2025-10117	SourceCodester Simple To-Do List System Add New Task fetch_tasks.php cross site scripting	simple to-do list system	2.0 (v4.0)	Low
CVE-2025-10584	Portabilis i-Educar educar_calendario_anotacao_cad.php cross site scripting	i-educar	2.0 (v4.0)	Low
CVE-2025-10591	Portabilis i-Educar Editar Função educar_funcao_cad.php cross site scripting	i-educar	2.0 (v4.0)	Low
CVE-2025-10837	code-projects Simple Food Ordering System order.php cross site scripting	simple food ordering system	2.0 (v4.0)	Low
CVE-2025-11124	code-projects Project Monitoring System postjob.php cross site scripting	project monitoring system	2.0 (v4.0)	Low
CVE-2025-11308	Vanderlande Baggage 360 messages cross site scripting	Baggage 360	2.0 (v4.0)	Low
CVE-2025-11332	CmsEasy URL view.php cross site scripting	cmseasy	2.0 (v4.0)	Low
CVE-2025-11421	code-projects Voting System candidates_edit.php cross site scripting	voting system	2.0 (v4.0)	Low
CVE-2025-11433	itsourcecode Leave Management System Query Parameter controller.php redirect cross site scripting	leave management system	2.0 (v4.0)	Low
CVE-2025-11851	Apeman ID71 set_alias.cgi cross site scripting	ID71	2.0 (v4.0)	Low
CVE-2025-11946	LogicalDOC Community Edition Add Contact frontend.jsp cross site scripting	logicaldoc	2.0 (v4.0)	Low
CVE-2025-12224	Iqbolshoh php-business-website contact.php cross site scripting	php-business-website	2.0 (v4.0)	Low
CVE-2025-12227	projectworlds Gate Pass Management System add-pass.php cross site scripting	gate pass management system	2.0 (v4.0)	Low
CVE-2025-12546	LogicalDOC Community Edition API Key creation UI cross site scripting	logicaldoc	2.0 (v4.0)	Low
CVE-2025-13178	Bdtask/CodeCanyon SalesERP User Profile edit_profile cross site scripting	saleserp	2.0 (v4.0)	Low
CVE-2025-13180	Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System edit_profile cross site scripting	wholesale	2.0 (v4.0)	Low
CVE-2025-13181	pojoin h3blog add cross site scripting	h3blog	2.0 (v4.0)	Low
CVE-2025-13182	pojoin h3blog addtitle cross site scripting	h3blog	2.0 (v4.0)	Low
CVE-2025-13245	code-projects Student Information System editprofile.php cross site scripting	student information system	2.0 (v4.0)	Low
CVE-2025-13343	SourceCodester Interview Management System editQuestion.php cross site scripting	interview management system	2.0 (v4.0)	Low
CVE-2025-13450	SourceCodester Online Shop Project register.php cross site scripting	online shop project	2.0 (v4.0)	Low
CVE-2025-14006	dayrui XunRuiCMS Add Data Validation admind45f74adbd95.php cross site scripting	xunruicms	2.0 (v4.0)	Low
CVE-2025-14194	code-projects Employee Profile Management System view_personnel.php cross site scripting	employee profile management system	2.0 (v4.0)	Low
CVE-2025-14538	yangshare warehouseManager 仓库管理系统 CustomerManageHandler.java addCustomer cross site scripting	warehouseManager 仓库管理系统	2.0 (v4.0)	Low
CVE-2025-15052	code-projects Student Information System profile.php cross site scripting	student information system	2.0 (v4.0)	Low
CVE-2025-15134	yourmaileyes MOOC Submission MainController.java subreview cross site scripting	MOOC	2.0 (v4.0)	Low
CVE-2025-15171	SohuTV CacheCloud ServerController.java index cross site scripting	cachecloud	2.0 (v4.0)	Low
CVE-2025-15172	SohuTV CacheCloud RedisConfigTemplateController.java preview cross site scripting	cachecloud	2.0 (v4.0)	Low
CVE-2025-15173	SohuTV CacheCloud InstanceController.java advancedAnalysis cross site scripting	cachecloud	2.0 (v4.0)	Low
CVE-2025-15174	SohuTV CacheCloud AppManageController.java doAppAuditList cross site scripting	cachecloud	2.0 (v4.0)	Low
CVE-2025-15175	SohuTV CacheCloud AppController.java appCommandAnalysis cross site scripting	cachecloud	2.0 (v4.0)	Low
CVE-2025-15201	SohuTV CacheCloud WebResourceController.java redirectNoPower cross site scripting	cachecloud	2.0 (v4.0)	Low
CVE-2025-15219	SohuTV CacheCloud MachineManageController.java doPodList cross site scripting	cachecloud	2.0 (v4.0)	Low
CVE-2025-15221	SohuTV CacheCloud AppDataMigrateController.java index cross site scripting	cachecloud	2.0 (v4.0)	Low
CVE-2025-32785	Pi-hole Admin Interface vulnerable to persistent XSS on Subscribed lists group management (Adress Field)	web interface	2.0 (v4.0)	Low
CVE-2025-62653	Stored XSS through system messages in PollNY	MediaWiki PollNY extension	2.0 (v4.0)	Low
CVE-2025-7871	Portabilis i-Diario conteudos cross site scripting	i-diario	2.0 (v4.0)	Low
CVE-2025-7872	Portabilis i-Diario justificativas-de-falta cross site scripting	i-diario	2.0 (v4.0)	Low
CVE-2025-8511	Portabilis i-Diario Observações diario-de-observacoes cross site scripting	i-diario	2.0 (v4.0)	Low
CVE-2025-8786	Portabilis i-Diario Registro das atividades registros-de-conteudos-por-areas-de-conhecimento cross site scripting	i-diario	2.0 (v4.0)	Low
CVE-2025-8787	Portabilis i-Diario Registro das atividades registros-de-conteudos-por-disciplina cross site scripting	i-diario	2.0 (v4.0)	Low
CVE-2025-9646	O2OA calendarConfig cross site scripting	o2oa	2.0 (v4.0)	Low
CVE-2025-9652	Portabilis i-Educar Cadastrar tipo de transferência educar_transferencia_tipo_cad.php cross site scripting	i-educar	2.0 (v4.0)	Low
CVE-2025-9653	Portabilis i-Educar Cadastrar projeto educar_projeto_cad.php cross site scripting	i-educar	2.0 (v4.0)	Low
CVE-2025-9657	O2OA Personal Profile script cross site scripting	o2oa	2.0 (v4.0)	Low
CVE-2025-9658	O2OA Personal Profile dict cross site scripting	o2oa	2.0 (v4.0)	Low
CVE-2025-9659	O2OA Personal Profile widget cross site scripting	o2oa	2.0 (v4.0)	Low
CVE-2025-9680	O2OA Personal Profile page cross site scripting	o2oa	2.0 (v4.0)	Low
CVE-2025-9681	O2OA Personal Profile agent cross site scripting	o2oa	2.0 (v4.0)	Low
CVE-2025-9682	O2OA Personal Profile appdict cross site scripting	o2oa	2.0 (v4.0)	Low
CVE-2025-9683	O2OA Personal Profile form cross site scripting	o2oa	2.0 (v4.0)	Low
CVE-2025-9715	O2OA Personal Profile script cross site scripting	o2oa	2.0 (v4.0)	Low
CVE-2025-9716	O2OA Personal Profile form cross site scripting	o2oa	2.0 (v4.0)	Low
CVE-2025-9717	O2OA Personal Profile unit cross site scripting	o2oa	2.0 (v4.0)	Low
CVE-2025-9718	O2OA Personal Profile process cross site scripting	o2oa	2.0 (v4.0)	Low
CVE-2025-9719	O2OA Personal Profile script cross site scripting	o2oa	2.0 (v4.0)	Low
CVE-2025-9721	Portabilis i-Educar edit cross site scripting	i-educar	2.0 (v4.0)	Low
CVE-2025-9722	Portabilis i-Educar educar_tipo_ocorrencia_disciplinar_cad.php cross site scripting	i-educar	2.0 (v4.0)	Low
CVE-2025-9723	Portabilis i-Educar educar_tipo_regime_cad.php cross site scripting	i-educar	2.0 (v4.0)	Low
CVE-2025-9734	O2OA Personal Profile stat cross site scripting	o2oa	2.0 (v4.0)	Low
CVE-2025-9735	O2OA Personal Profile table cross site scripting	o2oa	2.0 (v4.0)	Low
CVE-2025-9736	O2OA Personal Profile statement cross site scripting	o2oa	2.0 (v4.0)	Low
CVE-2025-9737	O2OA Personal Profile importmodel cross site scripting	o2oa	2.0 (v4.0)	Low
CVE-2025-9738	Portabilis i-Educar educar_tipo_ensino_cad.php cross site scripting	i-educar	2.0 (v4.0)	Low
CVE-2026-0588	Xinhu Rainrock RockOA API rockfun.php cross site scripting	rockoa	2.0 (v4.0)	Low
CVE-2026-100880	zhistaredu StarTraining Upload Endpoint MimeTypeUtils.java cross site scripting	StarTraining	2.0 (v4.0)	Low
CVE-2026-101141	Eleveo Call Recording Software Play Audio audio.jsp cross site scripting	Call Recording Software	2.0 (v4.0)	Low
CVE-2026-102264	mwasikz robo-cafe-rms Edit Profile Feature update-account.php cross site scripting	robo-cafe-rms	2.0 (v4.0)	Low
CVE-2026-10228	raisulislamg4 student_management_system_by_php admission_form_check.php cross site scripting	student management system by php	2.0 (v4.0)	Low
CVE-2026-10234	Mettle sendportal Campaign webview cross site scripting	sendportal	2.0 (v4.0)	Low
CVE-2026-10244	SourceCodester Pharmacy Sales and Inventory System main create_medicine_name cross site scripting	Pharmacy Sales and Inventory System	2.0 (v4.0)	Low
CVE-2026-10245	SourceCodester Pharmacy Sales and Inventory System main create_supplier cross site scripting	Pharmacy Sales and Inventory System	2.0 (v4.0)	Low
CVE-2026-10246	SourceCodester Pharmacy Sales and Inventory System main create_medicine_presentation cross site scripting	Pharmacy Sales and Inventory System	2.0 (v4.0)	Low
CVE-2026-10247	SourceCodester Pharmacy Sales and Inventory System main create_generic_name cross site scripting	Pharmacy Sales and Inventory System	2.0 (v4.0)	Low
CVE-2026-10567	1Panel-dev CordysCRM ModuleFormController ModuleFormService.java save cross site scripting	CordysCRM	2.0 (v4.0)	Low
CVE-2026-105808	SourceCodester Simple Student Information System searchresults.php clean cross site scripting	Simple Student Information System	2.0 (v4.0)	Low
CVE-2026-112042	diem-project diem dmWidget dmBaseLinkTag.php text cross site scripting	diem	2.0 (v4.0)	Low
CVE-2026-112095	SourceCodester Inventory System Product Management products_handler.php save cross site scripting	Inventory System	2.0 (v4.0)	Low
CVE-2026-112096	SourceCodester Inventory System Purchase Records transactions_handler.php save_purchase cross site scripting	Inventory System	2.0 (v4.0)	Low
CVE-2026-116385	Bdtask Garage 24 Garage Management Software Profile edit_profile cross site scripting	Garage 24 Garage Management Software	2.0 (v4.0)	Low
CVE-2026-116482	subhajitkhan online-clinic-management-system patientregistration.php cross site scripting	online-clinic-management-system	2.0 (v4.0)	Low
CVE-2026-116639	MD-MAFUJUL-HASAN Online-Payroll-Management-System chat.php cross site scripting	Online-Payroll-Management-System	2.0 (v4.0)	Low
CVE-2026-116640	Saruf-Ratul HR-Payroll-Management-System chat.php cross site scripting	HR-Payroll-Management-System	2.0 (v4.0)	Low
CVE-2026-13504	code-projects Project Management System Mail Compose mail.php cross site scripting	Project Management System	2.0 (v4.0)	Low
CVE-2026-14791	crater-invoice-inc crater Invoice Note InvoicesRequest.php getFormattedString cross site scripting	crater	2.0 (v4.0)	Low
CVE-2026-15678	code-projects Online Job Portal DetailJob.php cross site scripting	Online Job Portal	2.0 (v4.0)	Low
CVE-2026-16155	SourceCodester Class and Exam Timetabling System schoolyr.php cross site scripting	Class and Exam Timetabling System	2.0 (v4.0)	Low
CVE-2026-16156	SourceCodester Class and Exam Timetabling System forexam.php cross site scripting	Class and Exam Timetabling System	2.0 (v4.0)	Low
CVE-2026-16202	SourceCodester Class and Exam Timetabling System CYS.php cross site scripting	Class and Exam Timetabling System	2.0 (v4.0)	Low
CVE-2026-16203	SourceCodester Class and Exam Timetabling System forCYS.php cross site scripting	Class and Exam Timetabling System	2.0 (v4.0)	Low
CVE-2026-19209	SourceCodester Photo Share Website index.php home cross site scripting	Photo Share Website	2.0 (v4.0)	Low
CVE-2026-19922	code-projects Online Shopping System checkout.php cross site scripting	Online Shopping System	2.0 (v4.0)	Low
CVE-2026-5806	code-projects Easy Blog Site update.php cross site scripting	Easy Blog Site	2.0 (v4.0)	Low
CVE-2026-5810	SourceCodester Sales and Inventory System GET Parameter delete.php cross site scripting	Sales and Inventory System	2.0 (v4.0)	Low
CVE-2026-6162	PHPGurukul Company Visitor Management System bwdates-reports-details.php cross site scripting	Company Visitor Management System	2.0 (v4.0)	Low
CVE-2026-6493	lukevella rallly Reset Password reset-password-form.tsx cross site scripting	rallly	2.0 (v4.0)	Low
CVE-2026-7222	code-projects Coaching Management System Complaint Form complaint.php cross site scripting	Coaching Management System	2.0 (v4.0)	Low
CVE-2026-7390	SourceCodester Pharmacy Sales and Inventory System index.php customer cross site scripting	Pharmacy Sales and Inventory System	2.0 (v4.0)	Low
CVE-2026-8139	Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName	concrete cms	2.0 (v4.0)	Low
CVE-2026-82483	coppermine-gallery Coppermine Photo Gallery Hidden Album Update Endpoint db_input.php cross site scripting	Coppermine Photo Gallery	2.0 (v4.0)	Low
CVE-2026-82488	Beetel 450TC3 User Management cross site scripting	450TC3	2.0 (v4.0)	Low
CVE-2026-82622	code-projects Employee Leave Managing System Employee Profile Update editaction.php cross site scripting	Employee Leave Managing System	2.0 (v4.0)	Low
CVE-2026-82665	yaojingang GEOFlow Image Library Cleanup ImageLibraryController.php unlink path traversal	GEOFlow	2.0 (v4.0)	Low
CVE-2026-82666	yaojingang GEOFlow Superadmin Theme Editor SiteThemeEditorController.php preview code injection	GEOFlow	2.0 (v4.0)	Low
CVE-2026-82667	yaojingang GEOFlow GenericHttpEndpointResolver.php DistributionController.isValidHttpEndpoint server-side request forger	GEOFlow	2.0 (v4.0)	Low
CVE-2026-84437	OpenCart Autocomplete Workflow address.php cross site scripting	OpenCart	2.0 (v4.0)	Low
CVE-2026-84438	OpenCart Autocomplete Workflow edit.php cross site scripting	OpenCart	2.0 (v4.0)	Low
CVE-2026-85022	langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting	dify	2.0 (v4.0)	Low
CVE-2026-85207	itsourcecode Online Medicine Delivery System index.php cross site scripting	Online Medicine Delivery System	2.0 (v4.0)	Low
CVE-2026-86181	code-projects Task Management System User Profile Update UpdateUserProfile.php cross site scripting	Task Management System	2.0 (v4.0)	Low
CVE-2026-86301	code-projects Hospital Information System Patient Management editPatient.php cross site scripting	Hospital Information System	2.0 (v4.0)	Low
CVE-2026-86644	star7th showdoc API Page Save Endpoint editormd.js cross site scripting	showdoc	2.0 (v4.0)	Low
CVE-2026-90489	Xuxueli xxl-job insert cross site scripting	xxl-job	2.0 (v4.0)	Low
CVE-2026-90695	SourceCodester Inventory Management System Vendor Management vendors_handler.php cross site scripting	Inventory Management System	2.0 (v4.0)	Low
CVE-2026-90696	SourceCodester Inventory Management System Product Management products_handler.php cross site scripting	Inventory Management System	2.0 (v4.0)	Low
CVE-2026-90845	PHPGurukul Daily Expense Tracker System sidebar.php cross site scripting	Daily Expense Tracker System	2.0 (v4.0)	Low
CVE-2026-93956	olivier-ls PHP-FTS Search SearchEngine.php buildHighlights cross site scripting	PHP-FTS	2.0 (v4.0)	Low
CVE-2026-93977	code-projects Assessment Management add-single-mark.php cross site scripting	Assessment Management	2.0 (v4.0)	Low
CVE-2026-94145	xuxueli xxl-job Task Management JobInfoController.java cross site scripting	xxl-job	2.0 (v4.0)	Low
CVE-2026-94426	xuxueli xxl-job insert cross site scripting	xxl-job	2.0 (v4.0)	Low
CVE-2026-96810	huanzi-qch base-admin Add User CommonController.java save cross site scripting	base-admin	2.0 (v4.0)	Low
CVE-2026-97896	krayin laravel-crm Upload Functionality ConfigurationForm.php rules cross site scripting	laravel-crm	2.0 (v4.0)	Low
CVE-2025-10099	Portabilis i-Educar Editar usuário educar_usuario_cad.php cross site scripting	i-educar	1.9 (v4.0)	Low
CVE-2025-10234	Scada-LTS Data Point Edit data_point_edit.shtm cross site scripting	scada-lts	1.9 (v4.0)	Low
CVE-2025-10235	Scada-LTS Reports reports.shtm cross site scripting	scada-lts	1.9 (v4.0)	Low
CVE-2025-10434	IbuyuCMS Add Article article.php cross site scripting	IbuyuCMS	1.9 (v4.0)	Low
CVE-2025-11027	givanz Vvveb SVG File cross site scripting	vvveb	1.9 (v4.0)	Low
CVE-2025-11068	westboy CicadasCMS save cross site scripting	cicadascms	1.9 (v4.0)	Low
CVE-2025-11069	westboy CicadasCMS Add Department save cross site scripting	cicadascms	1.9 (v4.0)	Low
CVE-2025-11289	westboy CicadasCMS Template Management TemplateFileServiceImpl.java save cross site scripting	cicadascms	1.9 (v4.0)	Low
CVE-2025-11425	projectworlds Advanced Library Management System edit_admin.php cross site scripting	advanced library management system	1.9 (v4.0)	Low
CVE-2025-12228	projectworlds Expense Management System Users Page create cross site scripting	expense management system	1.9 (v4.0)	Low
CVE-2025-12229	projectworlds Expense Management System Roles Page create cross site scripting	expense management system	1.9 (v4.0)	Low
CVE-2025-12230	projectworlds Expense Management System Currency create cross site scripting	expense management system	1.9 (v4.0)	Low
CVE-2025-12231	projectworlds Expense Management System Expense Categories create cross site scripting	expense management system	1.9 (v4.0)	Low
CVE-2025-12303	PHPGurukul Curfew e-Pass Management System admin-profile.php cross site scripting	curfew e-pass management system	1.9 (v4.0)	Low
CVE-2025-12311	PHPGurukul Curfew e-Pass Management System edit-category-detail.php cross site scripting	curfew e-pass management system	1.9 (v4.0)	Low
CVE-2025-12312	PHPGurukul Curfew e-Pass Management System view-pass-detail.php cross site scripting	curfew e-pass management system	1.9 (v4.0)	Low
CVE-2025-12920	qianfox FoxCMS Product.php edit cross site scripting	foxcms	1.9 (v4.0)	Low
CVE-2025-13186	Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution manage_customer cross site scripting	isshue	1.9 (v4.0)	Low
CVE-2025-13412	Campcodes Retro Basketball Shoes Online Store admin_running.php cross site scripting	retro basketball shoes online store	1.9 (v4.0)	Low
CVE-2025-14991	Campcodes Complete Online Beauty Parlor Management System bwdates-reports-details.php cross site scripting	complete online beauty parlor management system	1.9 (v4.0)	Low
CVE-2025-15145	SohuTV CacheCloud TotalManageController.java doTotalList cross site scripting	cachecloud	1.9 (v4.0)	Low
CVE-2025-15146	SohuTV CacheCloud UserManageController.java doUserList cross site scripting	cachecloud	1.9 (v4.0)	Low
CVE-2025-15149	rawchen ecms Add New Product updateProductServlet.java updateProductServlet cross site scripting	ecms	1.9 (v4.0)	Low
CVE-2025-15188	Campcodes Complete Online Beauty Parlor Management System search-invoices.php cross site scripting	online beauty parlor management system	1.9 (v4.0)	Low
CVE-2025-15200	SohuTV CacheCloud AppClientDataShowController.java doIndex cross site scripting	cachecloud	1.9 (v4.0)	Low
CVE-2025-15202	SohuTV CacheCloud TaskController.java taskQueueList cross site scripting	cachecloud	1.9 (v4.0)	Low
CVE-2025-15203	SohuTV CacheCloud ResourceController.java index cross site scripting	cachecloud	1.9 (v4.0)	Low
CVE-2025-15214	Campcodes Park Ticketing System admin_class.php save_pricing cross site scripting	park ticketing system	1.9 (v4.0)	Low
CVE-2025-15416	xnx3 wangmarket Add Global Variable save.do cross site scripting	wangmarket	1.9 (v4.0)	Low
CVE-2025-15451	xnx3 wangmarket System Variables variableSave.do cross site scripting	wangmarket	1.9 (v4.0)	Low
CVE-2025-15452	xnx3 wangmarket Backend Variable Search variableList.do variableList cross site scripting	wangmarket	1.9 (v4.0)	Low
CVE-2025-8538	Portabilis i-Educar novo cross site scripting	i-educar	1.9 (v4.0)	Low
CVE-2025-8539	Portabilis i-Educar public_distrito_cad.php cross site scripting	i-educar	1.9 (v4.0)	Low
CVE-2025-9591	ZrLog Theme Configuration Form config cross site scripting	ZrLog	1.9 (v4.0)	Low
CVE-2026-0642	projectworlds House Rental and Property Listing complaint.php cross site scripting	house rental and property listing project	1.9 (v4.0)	Low
CVE-2026-100882	Krayin laravel-crm Admin Settings Endpoint index.blade.php cross site scripting	laravel-crm	1.9 (v4.0)	Low
CVE-2026-10112	sambitraj STUDENT-MANAGEMENT-SYSTEM Dashboard cross site scripting	STUDENT-MANAGEMENT-SYSTEM	1.9 (v4.0)	Low
CVE-2026-10529	westboy CicadasCMS Task Scheduling Management ScheduleJobController.java cross site scripting	CicadasCMS	1.9 (v4.0)	Low
CVE-2026-108908	Netcore NR268 Web UI l7_call_board_user_set.cgi eval cross site scripting	NR268	1.9 (v4.0)	Low
CVE-2026-11434	FluentCMS Blocks Plugin blocks cross site scripting	FluentCMS	1.9 (v4.0)	Low
CVE-2026-11468	SourceCodester Hospitals Patient Records Management System page room_types cross site scripting	Hospitals Patient Records Management System	1.9 (v4.0)	Low
CVE-2026-115535	gedelumbung HospitalManagement Settings sistem.php simpan cross site scripting	HospitalManagement	1.9 (v4.0)	Low
CVE-2026-115981	phpIPAM index.php cross site scripting	phpIPAM	1.9 (v4.0)	Low
CVE-2026-116100	gougucms User Level Level.php add cross site scripting	gougucms	1.9 (v4.0)	Low
CVE-2026-14655	code-projects Assessment Management view-users.php cross site scripting	Assessment Management	1.9 (v4.0)	Low
CVE-2026-16205	Pluck CMS Albums albums.admin.php htmlspecialchars_decode cross site scripting	CMS	1.9 (v4.0)	Low
CVE-2026-19110	DataGear Chart Name HtmlTplDashboardWidgetHtmlRenderer.java HtmlTplDashboardWidgetHtmlRenderer cross site scripting	DataGear	1.9 (v4.0)	Low
CVE-2026-19207	PHPGurukul Company Visitor Management System manage-newvisitors.php cross site scripting	Company Visitor Management System	1.9 (v4.0)	Low
CVE-2026-4972	code-projects Online Reviewer System btn_functions.php cross site scripting	Online Reviewer System	1.9 (v4.0)	Low
CVE-2026-5647	code-projects Online Shoe Store Add Product admin_feature.php cross site scripting	Online Shoe Store	1.9 (v4.0)	Low
CVE-2026-5834	code-projects Online Shoe Store admin_running.php cross site scripting	Online Shoe Store	1.9 (v4.0)	Low
CVE-2026-5835	code-projects Online Shoe Store admin_football.php cross site scripting	Online Shoe Store	1.9 (v4.0)	Low
CVE-2026-5836	code-projects Online Shoe Store admin_product.php cross site scripting	Online Shoe Store	1.9 (v4.0)	Low
CVE-2026-6184	code-projects Simple Content Management System welcome.php cross site scripting	Simple Content Management System	1.9 (v4.0)	Low
CVE-2026-6624	BichitroGan ISP Billing Software Pool List add cross site scripting	ISP Billing Software	1.9 (v4.0)	Low
CVE-2026-6995	BDCOM P3310D New User index.asp cross site scripting	P3310D	1.9 (v4.0)	Low
CVE-2026-7090	code-projects Chat System send_message.php cross site scripting	Chat System	1.9 (v4.0)	Low
CVE-2026-7269	SourceCodester Pharmacy Sales and Inventory System index.php cross site scripting	Pharmacy Sales and Inventory System	1.9 (v4.0)	Low
CVE-2026-7281	SourceCodester Pharmacy Sales and Inventory System index.php supplier cross site scripting	Pharmacy Sales and Inventory System	1.9 (v4.0)	Low
CVE-2026-8136	SourceCodester Pharmacy Sales and Inventory System index.php users cross site scripting	Pharmacy Sales and Inventory System	1.9 (v4.0)	Low
CVE-2026-90850	PHPGurukul Hostel Management System manage-students.php cross site scripting	Hostel Management System	1.9 (v4.0)	Low
CVE-2026-93975	code-projects Assessment Management User Editing edit-user.php cross site scripting	Assessment Management	1.9 (v4.0)	Low
CVE-2026-93976	code-projects Assessment Management add-user.php cross site scripting	Assessment Management	1.9 (v4.0)	Low
CVE-2026-94150	Omega Solution HRM OS SVG File Upload view cross site scripting	HRM OS	1.9 (v4.0)	Low
CVE-2026-9564	SourceCodester/oretnom23 Hospitals Patient Records Management System view_patient cross site scripting	Hospitals Patient Records Management System	1.9 (v4.0)	Low
CVE-2025-15454	zhanglun lettura RSS ContentRender.tsx cross site scripting	lettura	1.3 (v4.0)	Low
CVE-2026-78187	Piwigo Public Authentication cross site scripting	Piwigo	1.3 (v4.0)	Low
CVE-2025-14007	dayrui XunRuiCMS Domain Name Binding admin79f2ec220c7e.php cross site scripting	xunruicms	1.1 (v4.0)	Low
CVE-2022-38322	Temenos Transact - Cross-Site Scripting	-	N/A	N/A
CVE-2026-58038	Stored XSS through javascript URLs in SVGs generated by EasyTimeline	mediawiki	0.0 (v4.0)	None

Observed CWEs

These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.

CWE	Related Published CVEs
CWE-20	CVE-2015-4664 , CVE-2026-54694 , CVE-2025-66918 , CVE-2016-1328 , CVE-2016-1336 , CVE-2025-66921 , CVE-2025-66923 , CVE-2025-61583 , CVE-2026-33436 , CVE-2026-63428 , CVE-2025-64747 , CVE-2026-32629
CWE-22	CVE-2018-1204 , CVE-2015-4666 , CVE-2026-82665
CWE-73	CVE-2023-30943
CWE-74	CVE-2018-6220 , CVE-2025-13178 , CVE-2025-13180 , CVE-2026-82666
CWE-78	CVE-2018-6222 , CVE-2013-6041
CWE-79	CVE-2026-106102 , CVE-2026-50551 , CVE-2026-54067 , CVE-2026-104252 , CVE-2023-1892 , CVE-2026-47428 , CVE-2026-53662 , CVE-2026-54694 , CVE-2026-55085 , CVE-2026-88804 , CVE-2026-56397 , CVE-2026-61876 , CVE-2026-73043 , CVE-2026-73044 , CVE-2026-73050 , CVE-2026-73052 , CVE-2026-73053 , CVE-2026-100720 , CVE-2026-105086 , CVE-2026-105089 , CVE-2026-18872 , CVE-2026-40872 , CVE-2026-42849 , CVE-2026-54527 , CVE-2026-55486 , CVE-2026-57858 , CVE-2026-58491 , CVE-2026-66394 , CVE-2026-66396 , CVE-2026-66418 , CVE-2026-74902 , CVE-2026-78997 , CVE-2026-88866 , CVE-2026-88867 , CVE-2026-88868 , CVE-2026-88869 , CVE-2026-89249 , CVE-2026-89253 , CVE-2026-89254 , CVE-2026-89255 , CVE-2026-89256 , CVE-2026-84189 , CVE-2026-89243 , CVE-2026-41201 , CVE-2026-34448 , CVE-2026-34563 , CVE-2026-35198 , CVE-2026-42556 , CVE-2026-44977 , CVE-2026-55562 , CVE-2026-55570 , CVE-2026-39328 , CVE-2026-40873 , CVE-2026-43984 , CVE-2025-66918 , CVE-2026-12968 , CVE-2026-42455 , CVE-2026-56840 , CVE-2026-70650 , CVE-2026-8071 , CVE-2026-84259 , CVE-2025-12716 , CVE-2025-62722 , CVE-2026-109960 , CVE-2026-12496 , CVE-2026-13323 , CVE-2026-15217 , CVE-2026-28737 , CVE-2026-35574 , CVE-2026-35576 , CVE-2026-39332 , CVE-2026-39333 , CVE-2026-40262 , CVE-2026-42197 , CVE-2026-44667 , CVE-2026-44669 , CVE-2026-44729 , CVE-2026-45115 , CVE-2026-45116 , CVE-2026-45270 , CVE-2026-46518 , CVE-2026-47665 , CVE-2026-47743 , CVE-2026-48026 , CVE-2026-48527 , CVE-2026-53758 , CVE-2026-54049 , CVE-2026-54347 , CVE-2026-55230 , CVE-2026-55872 , CVE-2026-61875 , CVE-2026-63459 , CVE-2026-71542 , CVE-2026-84683 , CVE-2025-66024 , CVE-2026-100645 , CVE-2026-103904 , CVE-2026-34463 , CVE-2026-39338 , CVE-2026-49864 , CVE-2026-59239 , CVE-2026-67328 , CVE-2026-84803 , CVE-2026-92985 , CVE-2026-92986 , CVE-2026-9585 , CVE-2025-39663 , CVE-2025-62172 , CVE-2026-100172 , CVE-2026-100176 , CVE-2026-100643 , CVE-2026-21618 , CVE-2026-34932 , CVE-2026-55665 , CVE-2026-58113 , CVE-2026-63361 , CVE-2026-64851 , CVE-2026-65986 , CVE-2026-71483 , CVE-2026-75933 , CVE-2026-100673 , CVE-2026-15973 , CVE-2026-5385 , CVE-2026-77072 , CVE-2026-77850 , CVE-2026-85613 , CVE-2026-87814 , CVE-2026-44203 , CVE-2026-46367 , CVE-2026-104450 , CVE-2026-34375 , CVE-2026-34725 , CVE-2026-45627 , CVE-2026-48788 , CVE-2026-54253 , CVE-2026-56670 , CVE-2026-56736 , CVE-2026-63135 , CVE-2026-86016 , CVE-2025-62716 , CVE-2025-68147 , CVE-2026-18147 , CVE-2026-33437 , CVE-2026-39344 , CVE-2026-48060 , CVE-2026-48081 , CVE-2026-50758 , CVE-2025-12029 , CVE-2026-35575 , CVE-2026-58390 , CVE-2026-55659 , CVE-2026-107303 , CVE-2026-116167 , CVE-2026-16969 , CVE-2026-18360 , CVE-2026-18361 , CVE-2026-32308 , CVE-2026-35534 , CVE-2026-40283 , CVE-2026-54506 , CVE-2026-59814 , CVE-2026-77394 , CVE-2026-12592 , CVE-2026-40286 , CVE-2026-44657 , CVE-2026-67237 , CVE-2026-73546 , CVE-2026-7460 , CVE-2026-87812 , CVE-2026-91775 , CVE-2025-11189 , CVE-2025-68927 , CVE-2026-30819 , CVE-2026-6735 , CVE-2026-8203 , CVE-2025-14151 , CVE-2025-66921 , CVE-2025-66923 , CVE-2026-101928 , CVE-2026-102626 , CVE-2026-107764 , CVE-2026-13425 , CVE-2026-15401 , CVE-2026-15780 , CVE-2026-16143 , CVE-2026-16809 , CVE-2026-17506 , CVE-2026-18430 , CVE-2026-18756 , CVE-2026-4267 , CVE-2026-7534 , CVE-2026-75528 , CVE-2026-83625 , CVE-2026-87091 , CVE-2026-89417 , CVE-2026-93654 , CVE-2026-93756 , CVE-2026-93775 , CVE-2026-93875 , CVE-2026-95670 , CVE-2026-96561 , CVE-2026-96566 , CVE-2022-35499 , CVE-2025-11682 , CVE-2025-14701 , CVE-2026-115457 , CVE-2026-12970 , CVE-2026-14239 , CVE-2026-34598 , CVE-2026-41576 , CVE-2026-6495 , CVE-2026-6858 , CVE-2026-84192 , CVE-2026-93485 , CVE-2026-55746 , CVE-2026-58411 , CVE-2026-80426 , CVE-2025-11183 , CVE-2025-11184 , CVE-2025-11937 , CVE-2025-43779 , CVE-2025-4388 , CVE-2025-59746 , CVE-2025-59747 , CVE-2025-59748 , CVE-2025-59749 , CVE-2025-59755 , CVE-2025-62597 , CVE-2025-62598 , CVE-2025-62613 , CVE-2025-62662 , CVE-2025-62663 , CVE-2025-62664 , CVE-2025-62670 , CVE-2025-62671 , CVE-2025-62693 , CVE-2025-62695 , CVE-2025-62698 , CVE-2025-62700 , CVE-2026-14358 , CVE-2026-39422 , CVE-2026-39838 , CVE-2026-39936 , CVE-2026-40598 , CVE-2026-42138 , CVE-2026-44651 , CVE-2026-59238 , CVE-2026-69092 , CVE-2026-73848 , CVE-2026-86188 , CVE-2025-9978 , CVE-2026-13605 , CVE-2026-14817 , CVE-2026-14827 , CVE-2026-14833 , CVE-2026-15047 , CVE-2026-16559 , CVE-2026-33741 , CVE-2026-39311 , CVE-2026-40284 , CVE-2026-45025 , CVE-2026-45026 , CVE-2026-67352 , CVE-2025-32430 , CVE-2025-61224 , CVE-2026-24128 , CVE-2026-55549 , CVE-2026-78838 , CVE-2026-88618 , CVE-2025-10130 , CVE-2025-10139 , CVE-2025-10189 , CVE-2025-12666 , CVE-2025-13135 , CVE-2025-14387 , CVE-2025-47828 , CVE-2025-9130 , CVE-2025-9206 , CVE-2026-0552 , CVE-2026-0626 , CVE-2026-0737 , CVE-2026-0738 , CVE-2026-100106 , CVE-2026-101925 , CVE-2026-109983 , CVE-2026-15446 , CVE-2026-16786 , CVE-2026-16788 , CVE-2026-18400 , CVE-2026-18488 , CVE-2026-23758 , CVE-2026-3885 , CVE-2026-42870 , CVE-2026-45797 , CVE-2026-50592 , CVE-2026-52781 , CVE-2026-5391 , CVE-2026-6454 , CVE-2026-6565 , CVE-2026-87870 , CVE-2026-8791 , CVE-2026-97396 , CVE-2026-100190 , CVE-2026-115513 , CVE-2026-43980 , CVE-2025-34281 , CVE-2025-66311 , CVE-2025-66312 , CVE-2026-44737 , CVE-2026-55481 , CVE-2016-15041 , CVE-2016-8527 , CVE-2017-12583 , CVE-2017-7855 , CVE-2017-9140 , CVE-2018-10383 , CVE-2018-11227 , CVE-2018-13380 , CVE-2018-16833 , CVE-2018-19287 , CVE-2018-6882 , CVE-2018-7653 , CVE-2019-10475 , CVE-2019-11507 , CVE-2019-14470 , CVE-2019-15811 , CVE-2019-20141 , CVE-2020-1106 , CVE-2020-12054 , CVE-2020-13820 , CVE-2020-14413 , CVE-2020-15500 , CVE-2020-15718 , CVE-2020-23814 , CVE-2020-27982 , CVE-2020-29164 , CVE-2020-29395 , CVE-2020-3580 , CVE-2020-7107 , CVE-2020-8512 , CVE-2021-20137 , CVE-2021-20323 , CVE-2021-21801 , CVE-2021-21802 , CVE-2021-21803 , CVE-2021-24235 , CVE-2021-24237 , CVE-2021-24245 , CVE-2021-24300 , CVE-2021-24435 , CVE-2021-24488 , CVE-2021-24495 , CVE-2021-24498 , CVE-2021-24875 , CVE-2021-26947 , CVE-2021-27519 , CVE-2021-27520 , CVE-2021-27695 , CVE-2021-3002 , CVE-2021-30134 , CVE-2021-30203 , CVE-2021-3030 , CVE-2021-31589 , CVE-2021-33829 , CVE-2021-42567 , CVE-2021-43062 , CVE-2021-46387 , CVE-2022-0201 , CVE-2022-0208 , CVE-2022-0346 , CVE-2022-0533 , CVE-2022-0879 , CVE-2022-1168 , CVE-2022-1170 , CVE-2022-23397 , CVE-2022-24384 , CVE-2022-2733 , CVE-2022-27926 , CVE-2022-28363 , CVE-2022-3062 , CVE-2022-30983 , CVE-2022-32195 , CVE-2022-35493 , CVE-2022-35653 , CVE-2022-3766 , CVE-2022-38467 , CVE-2022-45836 , CVE-2022-46381 , CVE-2023-0527 , CVE-2023-1780 , CVE-2023-23161 , CVE-2023-23548 , CVE-2023-2822 , CVE-2023-2949 , CVE-2023-29623 , CVE-2023-30256 , CVE-2023-30777 , CVE-2023-35155 , CVE-2023-3521 , CVE-2023-36289 , CVE-2023-37580 , CVE-2023-37728 , CVE-2023-38194 , CVE-2023-38501 , CVE-2023-38910 , CVE-2023-38964 , CVE-2023-39598 , CVE-2023-39600 , CVE-2023-39700 , CVE-2023-40750 , CVE-2023-40751 , CVE-2023-40752 , CVE-2023-4174 , CVE-2023-42343 , CVE-2023-44012 , CVE-2023-46020 , CVE-2023-49494 , CVE-2023-51769 , CVE-2023-5758 , CVE-2023-5863 , CVE-2024-30194 , CVE-2024-34321 , CVE-2024-34326 , CVE-2024-35693 , CVE-2024-55218 , CVE-2024-6892 , CVE-2025-12123 , CVE-2025-25296 , CVE-2025-2609 , CVE-2025-46349 , CVE-2025-48954 , CVE-2025-54597 , CVE-2025-55757 , CVE-2025-62358 , CVE-2025-63238 , CVE-2025-63499 , CVE-2025-63607 , CVE-2025-63737 , CVE-2025-63949 , CVE-2025-65013 , CVE-2025-65019 , CVE-2025-65233 , CVE-2025-65341 , CVE-2025-66026 , CVE-2025-66924 , CVE-2025-67443 , CVE-2025-67495 , CVE-2025-67648 , CVE-2025-68951 , CVE-2025-70797 , CVE-2025-9952 , CVE-2026-0594 , CVE-2026-0670 , CVE-2026-103888 , CVE-2026-104140 , CVE-2026-107393 , CVE-2026-113659 , CVE-2026-11588 , CVE-2026-11881 , CVE-2026-13330 , CVE-2026-13400 , CVE-2026-14921 , CVE-2026-17505 , CVE-2026-18843 , CVE-2026-26028 , CVE-2026-30251 , CVE-2026-30252 , CVE-2026-31013 , CVE-2026-33403 , CVE-2026-33436 , CVE-2026-34206 , CVE-2026-34229 , CVE-2026-34396 , CVE-2026-34739 , CVE-2026-36324 , CVE-2026-36468 , CVE-2026-37750 , CVE-2026-38432 , CVE-2026-38444 , CVE-2026-38446 , CVE-2026-38472 , CVE-2026-38947 , CVE-2026-39038 , CVE-2026-39335 , CVE-2026-39336 , CVE-2026-41067 , CVE-2026-41580 , CVE-2026-42253 , CVE-2026-4246 , CVE-2026-43878 , CVE-2026-44366 , CVE-2026-44587 , CVE-2026-44767 , CVE-2026-49264 , CVE-2026-50182 , CVE-2026-51133 , CVE-2026-51565 , CVE-2026-52232 , CVE-2026-52475 , CVE-2026-54714 , CVE-2026-55087 , CVE-2026-61526 , CVE-2026-62280 , CVE-2026-73084 , CVE-2026-75170 , CVE-2026-75307 , CVE-2026-78742 , CVE-2026-78902 , CVE-2026-82382 , CVE-2026-8447 , CVE-2026-84925 , CVE-2026-89047 , CVE-2026-96594 , CVE-2023-6717 , CVE-2026-21631 , CVE-2026-55793 , CVE-2026-5696 , CVE-2025-62657 , CVE-2026-36470 , CVE-2026-84193 , CVE-2026-44696 , CVE-2026-55600 , CVE-2026-57568 , CVE-2026-115425 , CVE-2025-62365 , CVE-2025-62421 , CVE-2025-64747 , CVE-2026-88055 , CVE-2018-6226 , CVE-2018-6227 , CVE-2020-11456 , CVE-2020-11457 , CVE-2020-20285 , CVE-2020-24963 , CVE-2021-25067 , CVE-2021-35956 , CVE-2022-0020 , CVE-2022-0378 , CVE-2022-0928 , CVE-2022-0954 , CVE-2022-35497 , CVE-2023-26842 , CVE-2023-26843 , CVE-2023-31548 , CVE-2023-38911 , CVE-2024-23176 , CVE-2024-31027 , CVE-2024-52763 , CVE-2025-2610 , CVE-2025-5343 , CVE-2025-59788 , CVE-2025-61597 , CVE-2025-62178 , CVE-2025-62430 , CVE-2025-63528 , CVE-2025-65590 , CVE-2025-67496 , CVE-2026-102295 , CVE-2026-103421 , CVE-2026-105694 , CVE-2026-106033 , CVE-2026-106706 , CVE-2026-106707 , CVE-2026-11569 , CVE-2026-15245 , CVE-2026-15262 , CVE-2026-16063 , CVE-2026-16537 , CVE-2026-16558 , CVE-2026-18395 , CVE-2026-32629 , CVE-2026-32893 , CVE-2026-34848 , CVE-2026-34974 , CVE-2026-35046 , CVE-2026-35403 , CVE-2026-35455 , CVE-2026-36163 , CVE-2026-36392 , CVE-2026-38473 , CVE-2026-39040 , CVE-2026-39380 , CVE-2026-39964 , CVE-2026-40483 , CVE-2026-41061 , CVE-2026-41063 , CVE-2026-41318 , CVE-2026-42877 , CVE-2026-45138 , CVE-2026-45580 , CVE-2026-45694 , CVE-2026-58392 , CVE-2026-59188 , CVE-2026-63498 , CVE-2026-70492 , CVE-2026-72570 , CVE-2026-72583 , CVE-2026-78849 , CVE-2026-82396 , CVE-2026-91021 , CVE-2026-95166 , CVE-2019-25731 , CVE-2024-58292 , CVE-2024-58296 , CVE-2024-58391 , CVE-2025-10341 , CVE-2025-10342 , CVE-2025-10343 , CVE-2025-10344 , CVE-2025-10346 , CVE-2025-2709 , CVE-2025-2711 , CVE-2025-2712 , CVE-2025-34398 , CVE-2025-34400 , CVE-2025-34408 , CVE-2025-34425 , CVE-2025-62359 , CVE-2025-62800 , CVE-2025-66452 , CVE-2025-66460 , CVE-2025-9728 , CVE-2026-100381 , CVE-2026-102333 , CVE-2026-104083 , CVE-2026-105114 , CVE-2026-105124 , CVE-2026-107797 , CVE-2026-109328 , CVE-2026-109352 , CVE-2026-109355 , CVE-2026-116203 , CVE-2026-116206 , CVE-2026-116217 , CVE-2026-116824 , CVE-2026-25860 , CVE-2026-35208 , CVE-2026-39941 , CVE-2026-41932 , CVE-2026-42554 , CVE-2026-47096 , CVE-2026-47119 , CVE-2026-48094 , CVE-2026-56347 , CVE-2026-5808 , CVE-2026-59232 , CVE-2026-69116 , CVE-2026-73038 , CVE-2026-73422 , CVE-2026-73628 , CVE-2026-76837 , CVE-2026-82451 , CVE-2026-82646 , CVE-2026-84191 , CVE-2026-85158 , CVE-2026-85159 , CVE-2026-85577 , CVE-2026-89240 , CVE-2026-89241 , CVE-2026-89244 , CVE-2026-90571 , CVE-2026-90848 , CVE-2026-91922 , CVE-2026-92584 , CVE-2026-58394 , CVE-2011-10037 , CVE-2012-20003 , CVE-2014-125131 , CVE-2014-125132 , CVE-2017-20288 , CVE-2017-20290 , CVE-2018-25248 , CVE-2018-25349 , CVE-2019-25739 , CVE-2020-37235 , CVE-2020-37236 , CVE-2020-37284 , CVE-2021-47931 , CVE-2021-47947 , CVE-2022-50943 , CVE-2022-50948 , CVE-2022-50958 , CVE-2022-50959 , CVE-2022-50961 , CVE-2022-50962 , CVE-2022-50963 , CVE-2022-50964 , CVE-2022-50965 , CVE-2022-50966 , CVE-2022-50968 , CVE-2022-50969 , CVE-2023-54358 , CVE-2023-54361 , CVE-2023-54362 , CVE-2023-54413 , CVE-2024-13992 , CVE-2024-58394 , CVE-2025-10354 , CVE-2025-10945 , CVE-2025-10946 , CVE-2025-12264 , CVE-2025-13415 , CVE-2025-34141 , CVE-2025-34257 , CVE-2025-34258 , CVE-2025-34259 , CVE-2025-34260 , CVE-2025-34261 , CVE-2025-34262 , CVE-2025-34263 , CVE-2025-34264 , CVE-2025-34265 , CVE-2025-34266 , CVE-2025-34301 , CVE-2025-34302 , CVE-2025-34303 , CVE-2025-34305 , CVE-2025-34306 , CVE-2025-34307 , CVE-2025-34308 , CVE-2025-34309 , CVE-2025-34310 , CVE-2025-34313 , CVE-2025-34314 , CVE-2025-34315 , CVE-2025-34318 , CVE-2025-40638 , CVE-2025-40641 , CVE-2025-40642 , CVE-2025-40643 , CVE-2025-40647 , CVE-2025-40649 , CVE-2025-40681 , CVE-2025-40693 , CVE-2025-40700 , CVE-2025-40702 , CVE-2025-40703 , CVE-2025-40704 , CVE-2025-40705 , CVE-2025-40706 , CVE-2025-40707 , CVE-2025-40708 , CVE-2025-40725 , CVE-2025-40989 , CVE-2025-40990 , CVE-2025-40991 , CVE-2025-40992 , CVE-2025-41001 , CVE-2025-41011 , CVE-2025-41021 , CVE-2025-41036 , CVE-2025-41044 , CVE-2025-41079 , CVE-2025-41080 , CVE-2025-41101 , CVE-2025-41105 , CVE-2025-41106 , CVE-2025-41107 , CVE-2025-41349 , CVE-2025-41350 , CVE-2025-43804 , CVE-2025-59750 , CVE-2025-59756 , CVE-2025-59758 , CVE-2025-59767 , CVE-2025-59769 , CVE-2025-61599 , CVE-2025-64716 , CVE-2025-71385 , CVE-2025-71404 , CVE-2025-9655 , CVE-2026-100174 , CVE-2026-100521 , CVE-2026-100522 , CVE-2026-100630 , CVE-2026-100904 , CVE-2026-102755 , CVE-2026-102756 , CVE-2026-103587 , CVE-2026-103589 , CVE-2026-103590 , CVE-2026-104461 , CVE-2026-104465 , CVE-2026-104466 , CVE-2026-104473 , CVE-2026-105224 , CVE-2026-107799 , CVE-2026-107800 , CVE-2026-108942 , CVE-2026-109300 , CVE-2026-109327 , CVE-2026-110101 , CVE-2026-110625 , CVE-2026-110626 , CVE-2026-111168 , CVE-2026-112097 , CVE-2026-113683 , CVE-2026-114407 , CVE-2026-116139 , CVE-2026-116169 , CVE-2026-116202 , CVE-2026-11982 , CVE-2026-1630 , CVE-2026-19434 , CVE-2026-19716 , CVE-2026-22675 , CVE-2026-25557 , CVE-2026-27176 , CVE-2026-32856 , CVE-2026-3317 , CVE-2026-34416 , CVE-2026-34417 , CVE-2026-34429 , CVE-2026-34798 , CVE-2026-34799 , CVE-2026-34800 , CVE-2026-34801 , CVE-2026-34802 , CVE-2026-34803 , CVE-2026-34804 , CVE-2026-34805 , CVE-2026-34806 , CVE-2026-34807 , CVE-2026-34808 , CVE-2026-34809 , CVE-2026-34810 , CVE-2026-34811 , CVE-2026-34812 , CVE-2026-34813 , CVE-2026-34814 , CVE-2026-34815 , CVE-2026-34816 , CVE-2026-34817 , CVE-2026-34818 , CVE-2026-34819 , CVE-2026-34820 , CVE-2026-34821 , CVE-2026-34822 , CVE-2026-34823 , CVE-2026-34951 , CVE-2026-35007 , CVE-2026-35008 , CVE-2026-35009 , CVE-2026-35010 , CVE-2026-35011 , CVE-2026-35012 , CVE-2026-35014 , CVE-2026-35015 , CVE-2026-35016 , CVE-2026-40507 , CVE-2026-40508 , CVE-2026-4093 , CVE-2026-41929 , CVE-2026-42840 , CVE-2026-4316 , CVE-2026-45228 , CVE-2026-45381 , CVE-2026-45551 , CVE-2026-45616 , CVE-2026-46363 , CVE-2026-47106 , CVE-2026-48214 , CVE-2026-48215 , CVE-2026-48218 , CVE-2026-48219 , CVE-2026-48220 , CVE-2026-48221 , CVE-2026-48222 , CVE-2026-48223 , CVE-2026-48224 , CVE-2026-48225 , CVE-2026-48226 , CVE-2026-48227 , CVE-2026-48228 , CVE-2026-48229 , CVE-2026-48530 , CVE-2026-48531 , CVE-2026-48532 , CVE-2026-48534 , CVE-2026-48535 , CVE-2026-48536 , CVE-2026-48537 , CVE-2026-48538 , CVE-2026-48539 , CVE-2026-48540 , CVE-2026-48559 , CVE-2026-49131 , CVE-2026-49132 , CVE-2026-5010 , CVE-2026-50701 , CVE-2026-53555 , CVE-2026-53992 , CVE-2026-54386 , CVE-2026-56126 , CVE-2026-56127 , CVE-2026-56128 , CVE-2026-57857 , CVE-2026-57958 , CVE-2026-58579 , CVE-2026-60092 , CVE-2026-6082 , CVE-2026-6083 , CVE-2026-6084 , CVE-2026-6085 , CVE-2026-6086 , CVE-2026-6087 , CVE-2026-6088 , CVE-2026-61453 , CVE-2026-61504 , CVE-2026-64628 , CVE-2026-65697 , CVE-2026-66296 , CVE-2026-67333 , CVE-2026-68583 , CVE-2026-6954 , CVE-2026-71503 , CVE-2026-72743 , CVE-2026-72747 , CVE-2026-72821 , CVE-2026-72832 , CVE-2026-73319 , CVE-2026-75831 , CVE-2026-84477 , CVE-2026-85593 , CVE-2026-85600 , CVE-2026-86197 , CVE-2026-90528 , CVE-2026-90563 , CVE-2026-90567 , CVE-2026-90568 , CVE-2026-90602 , CVE-2026-90931 , CVE-2026-91944 , CVE-2026-96535 , CVE-2026-43979 , CVE-2026-107757 , CVE-2017-14651 , CVE-2018-1186 , CVE-2018-1187 , CVE-2018-1188 , CVE-2018-1189 , CVE-2018-1201 , CVE-2018-1202 , CVE-2020-29240 , CVE-2024-3822 , CVE-2025-15669 , CVE-2025-40648 , CVE-2025-43817 , CVE-2025-61996 , CVE-2025-62248 , CVE-2025-62263 , CVE-2025-62411 , CVE-2025-62414 , CVE-2025-9823 , CVE-2026-100376 , CVE-2026-111232 , CVE-2026-113712 , CVE-2026-22674 , CVE-2026-26211 , CVE-2026-34096 , CVE-2026-34097 , CVE-2026-34098 , CVE-2026-34729 , CVE-2026-39390 , CVE-2026-39392 , CVE-2026-40230 , CVE-2026-50708 , CVE-2026-54645 , CVE-2026-56283 , CVE-2026-58657 , CVE-2026-59659 , CVE-2026-59660 , CVE-2026-59661 , CVE-2026-59662 , CVE-2026-59663 , CVE-2026-59664 , CVE-2026-59665 , CVE-2026-59666 , CVE-2026-59667 , CVE-2026-59668 , CVE-2026-59669 , CVE-2026-59670 , CVE-2026-59672 , CVE-2026-59673 , CVE-2026-63001 , CVE-2026-63002 , CVE-2026-65930 , CVE-2026-6623 , CVE-2026-67612 , CVE-2026-67617 , CVE-2026-70560 , CVE-2026-7173 , CVE-2026-7174 , CVE-2026-7175 , CVE-2026-7176 , CVE-2026-79663 , CVE-2026-84188 , CVE-2026-85293 , CVE-2026-90569 , CVE-2026-90570 , CVE-2026-95662 , CVE-2026-3093 , CVE-2025-61074 , CVE-2025-65229 , CVE-2025-67342 , CVE-2025-67344 , CVE-2026-16273 , CVE-2026-50698 , CVE-2026-50700 , CVE-2026-50710 , CVE-2026-53468 , CVE-2026-56381 , CVE-2026-56393 , CVE-2026-10100 , CVE-2008-2398 , CVE-2008-6465 , CVE-2013-6042 , CVE-2014-100004 , CVE-2014-3110 , CVE-2015-1389 , CVE-2015-4665 , CVE-2015-6402 , CVE-2020-7318 , CVE-2024-34061 , CVE-2026-32250 , CVE-2026-55566 , CVE-2026-102576 , CVE-2026-113657 , CVE-2025-66040 , CVE-2026-13393 , CVE-2026-27937 , CVE-2026-52838 , CVE-2026-91165 , CVE-2026-114127 , CVE-2026-42794 , CVE-2026-66300 , CVE-2025-10063 , CVE-2025-10067 , CVE-2025-10590 , CVE-2025-10605 , CVE-2025-10614 , CVE-2025-10710 , CVE-2025-10711 , CVE-2025-10827 , CVE-2025-11112 , CVE-2025-11119 , CVE-2025-11306 , CVE-2025-11512 , CVE-2025-12244 , CVE-2025-12289 , CVE-2025-12290 , CVE-2025-12298 , CVE-2025-12299 , CVE-2025-12300 , CVE-2025-12302 , CVE-2025-13244 , CVE-2025-14962 , CVE-2025-15093 , CVE-2025-15094 , CVE-2025-15144 , CVE-2025-15220 , CVE-2025-9647 , CVE-2025-9656 , CVE-2025-9755 , CVE-2025-9773 , CVE-2026-0586 , CVE-2026-100313 , CVE-2026-100877 , CVE-2026-10153 , CVE-2026-10173 , CVE-2026-10289 , CVE-2026-10301 , CVE-2026-105288 , CVE-2026-105291 , CVE-2026-105708 , CVE-2026-105809 , CVE-2026-10810 , CVE-2026-108931 , CVE-2026-108932 , CVE-2026-110627 , CVE-2026-111877 , CVE-2026-111942 , CVE-2026-111984 , CVE-2026-112093 , CVE-2026-11337 , CVE-2026-113741 , CVE-2026-11436 , CVE-2026-11512 , CVE-2026-11518 , CVE-2026-115534 , CVE-2026-115982 , CVE-2026-116047 , CVE-2026-116097 , CVE-2026-13499 , CVE-2026-13554 , CVE-2026-13556 , CVE-2026-13557 , CVE-2026-13567 , CVE-2026-14634 , CVE-2026-14656 , CVE-2026-14704 , CVE-2026-15595 , CVE-2026-15596 , CVE-2026-15715 , CVE-2026-16220 , CVE-2026-16229 , CVE-2026-16485 , CVE-2026-16486 , CVE-2026-18968 , CVE-2026-19378 , CVE-2026-19998 , CVE-2026-5255 , CVE-2026-5319 , CVE-2026-5825 , CVE-2026-5826 , CVE-2026-59727 , CVE-2026-6032 , CVE-2026-6035 , CVE-2026-6150 , CVE-2026-6159 , CVE-2026-66882 , CVE-2026-7089 , CVE-2026-7116 , CVE-2026-7129 , CVE-2026-7401 , CVE-2026-75077 , CVE-2026-75078 , CVE-2026-78054 , CVE-2026-78055 , CVE-2026-78059 , CVE-2026-78060 , CVE-2026-79793 , CVE-2026-82601 , CVE-2026-82625 , CVE-2026-82664 , CVE-2026-82700 , CVE-2026-85021 , CVE-2026-85382 , CVE-2026-86216 , CVE-2026-86244 , CVE-2026-86278 , CVE-2026-86294 , CVE-2026-86668 , CVE-2026-87926 , CVE-2026-90615 , CVE-2026-90795 , CVE-2026-91854 , CVE-2026-94035 , CVE-2026-9415 , CVE-2026-9416 , CVE-2026-9417 , CVE-2026-9418 , CVE-2026-9419 , CVE-2026-9448 , CVE-2026-9518 , CVE-2026-9519 , CVE-2026-9520 , CVE-2026-9527 , CVE-2026-9566 , CVE-2025-10074 , CVE-2025-10117 , CVE-2025-10584 , CVE-2025-10591 , CVE-2025-10837 , CVE-2025-11124 , CVE-2025-11308 , CVE-2025-11332 , CVE-2025-11421 , CVE-2025-11433 , CVE-2025-11851 , CVE-2025-11946 , CVE-2025-12224 , CVE-2025-12227 , CVE-2025-12546 , CVE-2025-13178 , CVE-2025-13180 , CVE-2025-13181 , CVE-2025-13182 , CVE-2025-13245 , CVE-2025-13343 , CVE-2025-13450 , CVE-2025-14006 , CVE-2025-14194 , CVE-2025-14538 , CVE-2025-15052 , CVE-2025-15134 , CVE-2025-15171 , CVE-2025-15172 , CVE-2025-15173 , CVE-2025-15174 , CVE-2025-15175 , CVE-2025-15201 , CVE-2025-15219 , CVE-2025-15221 , CVE-2025-32785 , CVE-2025-62653 , CVE-2025-7871 , CVE-2025-7872 , CVE-2025-8511 , CVE-2025-8786 , CVE-2025-8787 , CVE-2025-9646 , CVE-2025-9652 , CVE-2025-9653 , CVE-2025-9657 , CVE-2025-9658 , CVE-2025-9659 , CVE-2025-9680 , CVE-2025-9681 , CVE-2025-9682 , CVE-2025-9683 , CVE-2025-9715 , CVE-2025-9716 , CVE-2025-9717 , CVE-2025-9718 , CVE-2025-9719 , CVE-2025-9721 , CVE-2025-9722 , CVE-2025-9723 , CVE-2025-9734 , CVE-2025-9735 , CVE-2025-9736 , CVE-2025-9737 , CVE-2025-9738 , CVE-2026-0588 , CVE-2026-100880 , CVE-2026-101141 , CVE-2026-102264 , CVE-2026-10228 , CVE-2026-10234 , CVE-2026-10244 , CVE-2026-10245 , CVE-2026-10246 , CVE-2026-10247 , CVE-2026-10567 , CVE-2026-105808 , CVE-2026-112042 , CVE-2026-112095 , CVE-2026-112096 , CVE-2026-116385 , CVE-2026-116482 , CVE-2026-116639 , CVE-2026-116640 , CVE-2026-13504 , CVE-2026-14791 , CVE-2026-15678 , CVE-2026-16155 , CVE-2026-16156 , CVE-2026-16202 , CVE-2026-16203 , CVE-2026-19209 , CVE-2026-19922 , CVE-2026-5806 , CVE-2026-5810 , CVE-2026-6162 , CVE-2026-6493 , CVE-2026-7222 , CVE-2026-7390 , CVE-2026-8139 , CVE-2026-82483 , CVE-2026-82488 , CVE-2026-82622 , CVE-2026-84437 , CVE-2026-84438 , CVE-2026-85022 , CVE-2026-85207 , CVE-2026-86181 , CVE-2026-86301 , CVE-2026-86644 , CVE-2026-90489 , CVE-2026-90695 , CVE-2026-90696 , CVE-2026-90845 , CVE-2026-93956 , CVE-2026-93977 , CVE-2026-94145 , CVE-2026-94426 , CVE-2026-96810 , CVE-2026-97896 , CVE-2025-10099 , CVE-2025-10234 , CVE-2025-10235 , CVE-2025-10434 , CVE-2025-11027 , CVE-2025-11068 , CVE-2025-11069 , CVE-2025-11289 , CVE-2025-11425 , CVE-2025-12228 , CVE-2025-12229 , CVE-2025-12230 , CVE-2025-12231 , CVE-2025-12303 , CVE-2025-12311 , CVE-2025-12312 , CVE-2025-12920 , CVE-2025-13186 , CVE-2025-13412 , CVE-2025-14991 , CVE-2025-15145 , CVE-2025-15146 , CVE-2025-15149 , CVE-2025-15188 , CVE-2025-15200 , CVE-2025-15202 , CVE-2025-15203 , CVE-2025-15214 , CVE-2025-15416 , CVE-2025-15451 , CVE-2025-15452 , CVE-2025-8538 , CVE-2025-8539 , CVE-2025-9591 , CVE-2026-0642 , CVE-2026-100882 , CVE-2026-10112 , CVE-2026-10529 , CVE-2026-108908 , CVE-2026-11434 , CVE-2026-11468 , CVE-2026-115535 , CVE-2026-115981 , CVE-2026-116100 , CVE-2026-14655 , CVE-2026-16205 , CVE-2026-19110 , CVE-2026-19207 , CVE-2026-4972 , CVE-2026-5647 , CVE-2026-5834 , CVE-2026-5835 , CVE-2026-5836 , CVE-2026-6184 , CVE-2026-6624 , CVE-2026-6995 , CVE-2026-7090 , CVE-2026-7269 , CVE-2026-7281 , CVE-2026-8136 , CVE-2026-90850 , CVE-2026-93975 , CVE-2026-93976 , CVE-2026-94150 , CVE-2026-9564 , CVE-2025-15454 , CVE-2026-78187 , CVE-2025-14007 , CVE-2026-58038
CWE-80	CVE-2024-58355 , CVE-2026-40872 , CVE-2026-40873 , CVE-2025-39663 , CVE-2025-62172 , CVE-2026-39344 , CVE-2026-24128 , CVE-2025-10128 , CVE-2023-23548 , CVE-2025-61583 , CVE-2026-52774 , CVE-2026-39941 , CVE-2025-62414 , CVE-2026-34246 , CVE-2025-13178 , CVE-2025-13180
CWE-81	CVE-2024-6892
CWE-83	CVE-2026-45118 , CVE-2025-11682 , CVE-2026-8245 , CVE-2026-59727
CWE-87	CVE-2026-55237 , CVE-2026-35534 , CVE-2026-34598 , CVE-2026-42458 , CVE-2025-62414 , CVE-2026-85293
CWE-89	CVE-2018-6228 , CVE-2018-6229 , CVE-2015-4669 , CVE-2018-6230 , CVE-2025-63948
CWE-94	CVE-2026-40911 , CVE-2024-31026 , CVE-2025-67744 , CVE-2026-34448 , CVE-2026-55570 , CVE-2026-34725 , CVE-2026-43874 , CVE-2026-39311 , CVE-2026-73084 , CVE-2025-2709 , CVE-2025-2711 , CVE-2025-2712 , CVE-2025-9728 , CVE-2026-5808 , CVE-2026-90571 , CVE-2026-90848 , CVE-2025-10945 , CVE-2025-10946 , CVE-2025-12264 , CVE-2025-13415 , CVE-2025-9655 , CVE-2026-100174 , CVE-2026-100904 , CVE-2026-108942 , CVE-2026-112097 , CVE-2026-90528 , CVE-2026-90563 , CVE-2026-90567 , CVE-2026-90568 , CVE-2026-90602 , CVE-2026-6623 , CVE-2026-90569 , CVE-2026-90570 , CVE-2025-10063 , CVE-2025-10067 , CVE-2025-10590 , CVE-2025-10605 , CVE-2025-10614 , CVE-2025-10710 , CVE-2025-10711 , CVE-2025-10827 , CVE-2025-11112 , CVE-2025-11119 , CVE-2025-11306 , CVE-2025-11512 , CVE-2025-12244 , CVE-2025-12289 , CVE-2025-12290 , CVE-2025-12298 , CVE-2025-12299 , CVE-2025-12300 , CVE-2025-12302 , CVE-2025-13244 , CVE-2025-14962 , CVE-2025-15093 , CVE-2025-15094 , CVE-2025-15144 , CVE-2025-15220 , CVE-2025-9647 , CVE-2025-9656 , CVE-2025-9755 , CVE-2025-9773 , CVE-2026-0586 , CVE-2026-100313 , CVE-2026-100877 , CVE-2026-10153 , CVE-2026-10173 , CVE-2026-10289 , CVE-2026-10301 , CVE-2026-105288 , CVE-2026-105291 , CVE-2026-105708 , CVE-2026-105809 , CVE-2026-10810 , CVE-2026-108931 , CVE-2026-108932 , CVE-2026-111877 , CVE-2026-111942 , CVE-2026-111984 , CVE-2026-112093 , CVE-2026-11337 , CVE-2026-113741 , CVE-2026-11436 , CVE-2026-11512 , CVE-2026-11518 , CVE-2026-115534 , CVE-2026-115982 , CVE-2026-116047 , CVE-2026-116097 , CVE-2026-13499 , CVE-2026-13554 , CVE-2026-13556 , CVE-2026-13557 , CVE-2026-13567 , CVE-2026-14634 , CVE-2026-14656 , CVE-2026-14704 , CVE-2026-15595 , CVE-2026-15596 , CVE-2026-15715 , CVE-2026-16220 , CVE-2026-16229 , CVE-2026-16485 , CVE-2026-16486 , CVE-2026-18968 , CVE-2026-19378 , CVE-2026-19998 , CVE-2026-5255 , CVE-2026-5319 , CVE-2026-5825 , CVE-2026-5826 , CVE-2026-6032 , CVE-2026-6035 , CVE-2026-6150 , CVE-2026-6159 , CVE-2026-7089 , CVE-2026-7116 , CVE-2026-7129 , CVE-2026-7401 , CVE-2026-75077 , CVE-2026-75078 , CVE-2026-78054 , CVE-2026-78055 , CVE-2026-78059 , CVE-2026-78060 , CVE-2026-79793 , CVE-2026-82601 , CVE-2026-82625 , CVE-2026-82664 , CVE-2026-82700 , CVE-2026-85021 , CVE-2026-85382 , CVE-2026-86216 , CVE-2026-86244 , CVE-2026-86278 , CVE-2026-86294 , CVE-2026-86668 , CVE-2026-87926 , CVE-2026-90615 , CVE-2026-90795 , CVE-2026-91854 , CVE-2026-94035 , CVE-2026-9415 , CVE-2026-9416 , CVE-2026-9417 , CVE-2026-9418 , CVE-2026-9419 , CVE-2026-9448 , CVE-2026-9518 , CVE-2026-9519 , CVE-2026-9520 , CVE-2026-9527 , CVE-2026-9566 , CVE-2025-10074 , CVE-2025-10117 , CVE-2025-10584 , CVE-2025-10591 , CVE-2025-10837 , CVE-2025-11124 , CVE-2025-11308 , CVE-2025-11332 , CVE-2025-11421 , CVE-2025-11433 , CVE-2025-11851 , CVE-2025-11946 , CVE-2025-12224 , CVE-2025-12227 , CVE-2025-12546 , CVE-2025-13181 , CVE-2025-13182 , CVE-2025-13245 , CVE-2025-13343 , CVE-2025-13450 , CVE-2025-14006 , CVE-2025-14194 , CVE-2025-14538 , CVE-2025-15052 , CVE-2025-15134 , CVE-2025-15171 , CVE-2025-15172 , CVE-2025-15173 , CVE-2025-15174 , CVE-2025-15175 , CVE-2025-15201 , CVE-2025-15219 , CVE-2025-15221 , CVE-2025-7871 , CVE-2025-7872 , CVE-2025-8511 , CVE-2025-8786 , CVE-2025-8787 , CVE-2025-9646 , CVE-2025-9652 , CVE-2025-9653 , CVE-2025-9657 , CVE-2025-9658 , CVE-2025-9659 , CVE-2025-9680 , CVE-2025-9681 , CVE-2025-9682 , CVE-2025-9683 , CVE-2025-9715 , CVE-2025-9716 , CVE-2025-9717 , CVE-2025-9718 , CVE-2025-9719 , CVE-2025-9721 , CVE-2025-9722 , CVE-2025-9723 , CVE-2025-9734 , CVE-2025-9735 , CVE-2025-9736 , CVE-2025-9737 , CVE-2025-9738 , CVE-2026-0588 , CVE-2026-100880 , CVE-2026-101141 , CVE-2026-102264 , CVE-2026-10228 , CVE-2026-10234 , CVE-2026-10244 , CVE-2026-10245 , CVE-2026-10246 , CVE-2026-10247 , CVE-2026-10567 , CVE-2026-105808 , CVE-2026-112042 , CVE-2026-112095 , CVE-2026-112096 , CVE-2026-116385 , CVE-2026-116482 , CVE-2026-116639 , CVE-2026-116640 , CVE-2026-13504 , CVE-2026-14791 , CVE-2026-15678 , CVE-2026-16155 , CVE-2026-16156 , CVE-2026-16202 , CVE-2026-16203 , CVE-2026-19209 , CVE-2026-19922 , CVE-2026-5806 , CVE-2026-5810 , CVE-2026-6162 , CVE-2026-6493 , CVE-2026-7222 , CVE-2026-7390 , CVE-2026-82483 , CVE-2026-82488 , CVE-2026-82622 , CVE-2026-82666 , CVE-2026-84437 , CVE-2026-84438 , CVE-2026-85022 , CVE-2026-85207 , CVE-2026-86181 , CVE-2026-86301 , CVE-2026-86644 , CVE-2026-90489 , CVE-2026-90695 , CVE-2026-90696 , CVE-2026-90845 , CVE-2026-93956 , CVE-2026-93977 , CVE-2026-94145 , CVE-2026-94426 , CVE-2026-96810 , CVE-2026-97896 , CVE-2025-10099 , CVE-2025-10234 , CVE-2025-10235 , CVE-2025-10434 , CVE-2025-11027 , CVE-2025-11068 , CVE-2025-11069 , CVE-2025-11289 , CVE-2025-11425 , CVE-2025-12228 , CVE-2025-12229 , CVE-2025-12230 , CVE-2025-12231 , CVE-2025-12303 , CVE-2025-12311 , CVE-2025-12312 , CVE-2025-12920 , CVE-2025-13186 , CVE-2025-13412 , CVE-2025-14991 , CVE-2025-15145 , CVE-2025-15146 , CVE-2025-15149 , CVE-2025-15188 , CVE-2025-15200 , CVE-2025-15202 , CVE-2025-15203 , CVE-2025-15214 , CVE-2025-15416 , CVE-2025-15451 , CVE-2025-15452 , CVE-2025-8538 , CVE-2025-8539 , CVE-2025-9591 , CVE-2026-0642 , CVE-2026-100882 , CVE-2026-10112 , CVE-2026-10529 , CVE-2026-108908 , CVE-2026-11434 , CVE-2026-11468 , CVE-2026-115535 , CVE-2026-115981 , CVE-2026-116100 , CVE-2026-14655 , CVE-2026-16205 , CVE-2026-19110 , CVE-2026-19207 , CVE-2026-4972 , CVE-2026-5647 , CVE-2026-5834 , CVE-2026-5835 , CVE-2026-5836 , CVE-2026-6184 , CVE-2026-6624 , CVE-2026-6995 , CVE-2026-7090 , CVE-2026-7269 , CVE-2026-7281 , CVE-2026-8136 , CVE-2026-90850 , CVE-2026-93975 , CVE-2026-93976 , CVE-2026-94150 , CVE-2026-9564 , CVE-2025-15454 , CVE-2026-78187 , CVE-2025-14007
CWE-113	CVE-2026-55486
CWE-116	CVE-2026-106102 , CVE-2026-54694 , CVE-2026-55570 , CVE-2026-12496 , CVE-2026-55659 , CVE-2026-35534 , CVE-2026-54506 , CVE-2026-107393 , CVE-2026-26028 , CVE-2026-33436 , CVE-2026-40483 , CVE-2026-41318 , CVE-2026-35208 , CVE-2025-34141 , CVE-2026-34246 , CVE-2026-59727
CWE-183	CVE-2026-54694
CWE-184	CVE-2026-44587
CWE-185	CVE-2026-54506
CWE-200	CVE-2026-47743 , CVE-2016-1337 , CVE-2013-6043
CWE-264	CVE-2016-1337
CWE-287	CVE-2015-6401
CWE-295	CVE-2018-6221 , CVE-2018-6219
CWE-306	CVE-2018-6223 , CVE-2026-41473
CWE-345	CVE-2026-12724 , CVE-2026-17011 , CVE-2026-10827
CWE-352	CVE-2018-1213 , CVE-2018-6224 , CVE-2025-56798 , CVE-2026-14239
CWE-384	CVE-2022-31798
CWE-434	CVE-2026-67688 , CVE-2026-40262 , CVE-2026-41938 , CVE-2026-68899 , CVE-2026-65986 , CVE-2026-18983 , CVE-2026-45797 , CVE-2026-59188 , CVE-2026-79670 , CVE-2026-75331 , CVE-2026-102366
CWE-436	CVE-2026-48788
CWE-444	CVE-2026-55087
CWE-601	CVE-2026-53662 , CVE-2026-55237 , CVE-2025-62716 , CVE-2015-4668 , CVE-2026-55087 , CVE-2025-64716
CWE-610	CVE-2023-30943
CWE-611	CVE-2016-8526 , CVE-2018-6225
CWE-625	CVE-2026-44587
CWE-639	CVE-2026-47743 , CVE-2026-45551
CWE-665	CVE-2023-1719
CWE-693	CVE-2026-54694
CWE-732	CVE-2018-1203
CWE-749	CVE-2025-59788
CWE-798	CVE-2015-4667
CWE-862	CVE-2026-46518
CWE-915	CVE-2026-63428
CWE-918	CVE-2026-43979 , CVE-2026-82667
CWE-1004	CVE-2026-39338 , CVE-2026-35575
CWE-1188	CVE-2026-54067
CWE-1321	CVE-2021-20086 , CVE-2026-113659
CWE-1336	CVE-2026-55486 , CVE-2026-41318

Atomicorp WAF Rule 333141

Rule Summary

Description

Selected Related CVEs

Observed CWEs