On this page
Atomicorp WAF Rule 340087
Rule Summary
- Rule ID: 340087
- Status: Active
- Alert message: Atomicorp.com WAF Rules: Attack Blocked - PHP function in URL - this may be an attack.
- Observed CWEs: CWE-20 (1), CWE-22 (2), CWE-74 (3), CWE-78 (6), CWE-79 (628), CWE-80 (7), CWE-83 (2), CWE-87 (4), CWE-89 (4), CWE-94 (191), CWE-95 (3), CWE-98 (1), CWE-113 (1), CWE-116 (6), CWE-200 (1), CWE-287 (2), CWE-288 (1), CWE-352 (4), CWE-434 (3), CWE-436 (1), CWE-444 (1), CWE-502 (1), CWE-601 (5), CWE-697 (1), CWE-798 (1), CWE-917 (1), CWE-918 (2), CWE-1004 (1), CWE-1188 (1), CWE-1321 (1), CWE-1336 (3)
- Revision: 1
- Rule severity: Critical (2)
- Phase: 2 (request body)
- Request surfaces: Request URI
- Rule action: deny
- HTTP status: 403
- Logging: log, auditlog
Description
This rule detects behavior identified by its current alert as “Attack Blocked - PHP function in URL - this may be an attack” in the request URI. It evaluates during the request body phase and denies matching traffic with HTTP status 403.
Selected Related CVEs
This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.
| CVE | Vulnerability | Product | CVSS | Severity |
|---|---|---|---|---|
| CVE-2012-10044 | MobileCartly 1.0 Arbitrary File Creation Vulnerability | MobileCartly | 10.0 (v4.0) | Critical |
| CVE-2013-10070 | PHP-Charts v1.0 PHP Code Execution Vulnerability | PHP-Charts | 10.0 (v4.0) | Critical |
| CVE-2013-2751 | NETGEAR ReadyNAS Perl Code Evaluation | raidiator | 10.0 (v2.0) | High |
| CVE-2014-8877 | WordPress Plugin CM Download Manager 2.0.0 - Code Injection | cm download manager | 10.0 (v2.0) | High |
| CVE-2025-49132 | Pterodactyl Panel CVE-2025-49132 Remote Code Execution | panel | 10.0 (v3.1) | Critical |
| CVE-2025-53833 | LaRecipe < 2.8.1 Remote Code Execution via SSTI | larecipe | 10.0 (v3.1) | Critical |
| CVE-2026-40911 | WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side | avideo | 10.0 (v3.1) | Critical |
| CVE-2026-54067 | SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet() | siyuan | 9.9 (v3.1) | Critical |
| CVE-2020-13167 | Netsweeper <=6.4.3 - Python Code Injection | netsweeper | 9.8 (v3.1) | Critical |
| CVE-2020-28188 | TerraMaster TOS 4.2.06 or lower - Unauthenticated Remote Code Execution | tos | 9.8 (v3.1) | Critical |
| CVE-2020-35476 | OpenTSDB Arbitrary Command Injection Remote Code Execution (CVE-2020-35476) | opentsdb | 9.8 (v3.1) | Critical |
| CVE-2020-35665 | TerraMaster TOS 4.2.06 or lower - Unauthenticated Remote Code Execution | terramaster operating system | 9.8 (v3.1) | Critical |
| CVE-2020-5847 | Unraid 6.8.0 Auth Bypass PHP Code Execution | unraid | 9.8 (v3.1) | Critical |
| CVE-2022-22965 | Spring Framework Data Binding Remote Code Execution on JDK 9+ (CVE-2022-22965) | spring framework | 9.8 (v3.1) | Critical |
| CVE-2022-26134 | Atlassian Confluence Pre-Auth Remote Code Execution via OGNL Injection (CVE-2022-26134) | confluence data center | 9.8 (v3.1) | Critical |
| CVE-2022-4060 | WordPress User Post Gallery <=2.19 - Remote Code Execution | user post gallery | 9.8 (v3.1) | Critical |
| CVE-2022-42889 | Apache Commons Text RCE | commons text | 9.8 (v3.1) | Critical |
| CVE-2024-2054 | Artica Proxy Unauthenticated PHP Deserialization Vulnerability | artica proxy | 9.8 (v3.1) | Critical |
| CVE-2024-28255 | OpenMetadata authentication bypass and SpEL injection exploit chain | openmetadata | 9.8 (v3.1) | Critical |
| CVE-2024-3408 | D-Tale RCE | d-tale | 9.8 (v3.1) | Critical |
| CVE-2024-36401 | GeoServer Unauthenticated Remote Code Execution in Evaluating Property Name Expressions (CVE-2024-36401) | geoserver | 9.8 (v3.1) | Critical |
| CVE-2024-9193 | WHMpress <= 6.3-revision-0 - Unauthenticated Local File Inclusion to Arbitrary Options Update | whmcs | 9.8 (v3.1) | Critical |
| CVE-2025-62521 | ChurchCRM Unauthenticated RCE via Setup Page | churchcrm | 9.8 (v3.1) | Critical |
| CVE-2026-104252 | Vitess vttablet /twopcz reflected XSS | vitess | 9.8 (v3.1) | Critical |
| CVE-2026-9082 | Drupal Core PostgreSQL EntityQuery SQL Injection | drupal | 9.8 (v3.1) | Critical |
| CVE-2026-47428 | Vitest browser mode serves unsanitized otelCarrier query parameter as inline script | vitest | 9.6 (v3.1) | Critical |
| CVE-2026-53662 | immich: One-click account takeover via XSS in login page continue redirect | immich | 9.6 (v3.1) | Critical |
| CVE-2026-55085 | Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite | etherpad | 9.6 (v3.1) | Critical |
| CVE-2013-10051 | InstantCMS 1.6 Remote PHP Code Execution | instantcms | 9.3 (v4.0) | Critical |
| CVE-2024-58355 | Cal.com through 4.7.15 Cross-Site Scripting via booking questions | cal.diy | 9.3 (v4.0) | Critical |
| CVE-2025-52472 | XWiki - HQL Injection | xwiki | 9.3 (v4.0) | Critical |
| CVE-2025-71243 | SPIP Saisies Plugin Unauthenticated RCE | saisies | 9.3 (v4.0) | Critical |
| CVE-2026-105089 | WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templates | AVideo | 9.3 (v4.0) | Critical |
| CVE-2026-27174 | MajorDoMo Console Eval Unauthenticated RCE | majordomo | 9.3 (v4.0) | Critical |
| CVE-2026-42849 | authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover | authentik | 9.3 (v3.1) | Critical |
| CVE-2026-45118 | MyBB: Contact page reflected XSS | mybb | 9.3 (v3.1) | Critical |
| CVE-2026-55486 | Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS | goobi-viewer-core | 9.3 (v3.1) | Critical |
| CVE-2026-57858 | Cal.com Cal.diy 6.2.0 Stored XSS via BookingPageTagManager Analytics Tracking ID | Cal.com Self-Hosted (Cal.diy) | 9.3 (v4.0) | Critical |
| CVE-2026-58491 | Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter | warpgate | 9.3 (v3.1) | Critical |
| CVE-2026-66394 | SiYuan before v3.7.3 Stored and Reflected XSS via SVG Sanitizer Bypass | siyuan | 9.3 (v4.0) | Critical |
| CVE-2026-78997 | UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314) Cross-Site Scripting Vulnerability | UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314) | 9.3 (v3.1) | Critical |
| CVE-2026-88869 | AVideo AD_Server Stored XSS via log.php label parameter | AVideo | 9.3 (v4.0) | Critical |
| CVE-2026-89255 | AVideo LoginControl Stored XSS via PGP Public Key | AVideo | 9.3 (v4.0) | Critical |
| CVE-2021-21479 | SCIMono <0.0.19 - Remote Code Execution | scimono | 9.1 (v3.1) | Critical |
| CVE-2024-53900 | Mongoose < 8.8.3 - Remote Code Execution | mongoose | 9.1 (v3.1) | Critical |
| CVE-2026-41201 | CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS Version 2 | ci4ms | 9.1 (v3.1) | Critical |
| CVE-2013-3576 | HP System Management Homepage JustGetSNMPQueue Command Injection | system management homepage | 9.0 (v2.0) | High |
| CVE-2026-34448 | SiYuan: Stored XSS in Attribute View gallery/kanban cover rendering allows arbitrary command execution in the desktop cl | siyuan | 9.0 (v3.1) | Critical |
| CVE-2026-34563 | CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS | ci4ms | 9.0 (v3.1) | Critical |
| CVE-2026-42556 | Postiz stored XSS in public preview page | postiz | 9.0 (v3.1) | Critical |
| CVE-2026-43984 | Tautulli has stored XSS in logFile via guest-controlled log_js_errors input | Tautulli | 8.9 (v3.1) | High |
| CVE-2018-12613 | phpMyAdmin Authenticated Remote Code Execution | phpmyadmin | 8.8 (v3.1) | High |
| CVE-2021-22053 | Spring Cloud Netflix Hystrix Dashboard <2.2.10 - Remote Code Execution | spring cloud netflix | 8.8 (v3.1) | High |
| CVE-2021-32819 | Nodejs Squirrelly - Remote Code Execution | squirrelly | 8.8 (v3.1) | High |
| CVE-2021-41282 | pfSense Diag Routes Web Shell Upload | pfsense | 8.8 (v3.1) | High |
| CVE-2024-28254 | OpenMetadata authentication bypass and SpEL injection exploit chain | openmetadata | 8.8 (v3.1) | High |
| CVE-2025-4428 | Ivanti EPMM Authentication Bypass for Expression Language Remote Code Execution | endpoint manager mobile | 8.8 (v3.1) | High |
| CVE-2025-56798 | Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier Cross-Site Request Forgery Vulnerability | Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier | 8.8 (v3.1) | High |
| CVE-2026-42455 | LinkWarden: Stored XSS via Client-Side Archive Upload (Unsanitized HTML served from same origin) | linkwarden | 8.8 (v4.0) | High |
| CVE-2026-55237 | AutoGPT SignUp Page has DOM-Based XSS and Open Redirect | AutoGPT | 8.8 (v3.1) | High |
| CVE-2026-70650 | GetSimple CMS: Authenticated Stored XSS in backup viewer (backup-edit.php) via output decoding of page meta fields and c | GetSimpleCMS-CE | 8.8 (v4.0) | High |
| CVE-2026-12496 | Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server | LIP-ME20xC | 8.7 (v4.0) | High |
| CVE-2026-13323 | open vsx Cross-site Scripting Vulnerability | open vsx | 8.7 (v3.1) | High |
| CVE-2026-35574 | ChurchCRM has a Stored XSS in Person Profile - Add a Note | churchcrm | 8.7 (v3.1) | High |
| CVE-2026-35576 | ChurchCRM has Stored Cross-Site Scripting (XSS) in Person Properties via PrintView.php | churchcrm | 8.7 (v3.1) | High |
| CVE-2026-39333 | ChurchCRM has Reflected XSS in DateStart/DateEnd parameters in FindFundRaiser.php | churchcrm | 8.7 (v3.1) | High |
| CVE-2026-40262 | Note Mark has Stored XSS via Unrestricted Asset Upload | note-mark | 8.7 (v3.1) | High |
| CVE-2026-41938 | Vvveb < 1.0.8.2 RCE via Media Upload Handler | Vvveb | 8.7 (v4.0) | High |
| CVE-2026-44667 | Faction: Stored XSS in Remediation Verification Attachment Filename Preview Rendering | faction | 8.7 (v3.1) | High |
| CVE-2026-44729 | Twenty: Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers) | twenty | 8.7 (v3.1) | High |
| CVE-2026-45115 | MyBB: Buddy/ignore list username XSS | mybb | 8.7 (v3.1) | High |
| CVE-2026-45116 | MyBB: Profile field type confusion XSS | mybb | 8.7 (v3.1) | High |
| CVE-2026-48026 | lakeFS vulnerable to stored XSS in rendered markdown previews via raw HTML | lakeFS | 8.7 (v3.1) | High |
| CVE-2026-48527 | HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint | haxcms-nodejs | 8.7 (v3.1) | High |
| CVE-2026-54347 | Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover | froxlor | 8.7 (v3.1) | High |
| CVE-2026-84683 | Automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job st | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 8.7 (v3.1) | High |
| CVE-2026-103904 | Stored XSS Vulnerability in JTL-Shop | JTL-Shop | 8.6 (v4.0) | High |
| CVE-2026-34463 | MantisBT has Stored HTML Injection/XSS via Clone Issue Form | mantisbt | 8.6 (v4.0) | High |
| CVE-2026-39338 | ChurchCRM has Blind XSS via Global Search – Administrative Cookie Session Exfiltration | churchcrm | 8.6 (v4.0) | High |
| CVE-2026-42548 | Flight: Reflected XSS via unvalidated JSONP callback in Flight::jsonp() | core | 8.6 (v4.0) | High |
| CVE-2026-49864 | wetty vulnerable to DOM XSS via file-download filename | wetty | 8.6 (v4.0) | High |
| CVE-2026-67328 | @better-auth/sso before 1.6.21 Account Takeover via SSO | sso | 8.6 (v4.0) | High |
| CVE-2026-9585 | Unauthenticated Reflected Cross-Site Scripting (XSS) in Switchvox SMB Web Portal | Switchvox SMB Edition | 8.6 (v4.0) | High |
| CVE-2025-39663 | Cross Site Scripting through compromised remote site | checkmk | 8.5 (v4.0) | High |
| CVE-2026-21618 | Cross-site scripting (XSS) in OAuth Device Authorization screen | hexpm | 8.5 (v4.0) | High |
| CVE-2026-55665 | DOM-based XSS in Grist via unsanitized links, enabling privilege escalation | grist-core | 8.5 (v4.0) | High |
| CVE-2026-58113 | Teamcenter V2412 Cross-site Scripting Vulnerability | Teamcenter V2412 | 8.5 (v4.0) | High |
| CVE-2026-63361 | LimeSurvey Community Edition 7.0.5+260623 - Reflected XSS in HTML editor popup | LimeSurvey | 8.5 (v4.0) | High |
| CVE-2026-71483 | Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View | horilla-hr | 8.5 (v4.0) | High |
| CVE-2026-5385 | GLPI 11.0.0 - Stored XSS in knowledge base | glpi | 8.4 (v4.0) | High |
| CVE-2026-77072 | n8n before 1.123.69 Stored XSS via Form Completion Page | n8n | 8.4 (v4.0) | High |
| CVE-2026-85613 | OpenPanel Unauthenticated XSS via SVG Favicon Proxy | openpanel | 8.4 (v4.0) | High |
| CVE-2026-87811 | SiYuan before v3.8.2 Stored XSS via notebook template paths | siyuan | 8.4 (v4.0) | High |
| CVE-2026-44203 | OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl) | OpenAM | 8.3 (v4.0) | High |
| CVE-2026-34375 | AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page | avideo | 8.2 (v3.1) | High |
| CVE-2026-45627 | Arcane: Unauthenticated reflected XSS via SVG color parameter in /api/app-images/logo enables admin account takeover | arcane | 8.2 (v3.1) | High |
| CVE-2026-48788 | Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing | remark42 | 8.2 (v3.0) | High |
| CVE-2026-54253 | TS3 Manager: Reflected XSS via /api/download port parameter steals operator session | ts3-manager | 8.2 (v3.1) | High |
| CVE-2026-56670 | ComfyUI: Stored XSS via SVG file upload on the /view endpoint | ComfyUI | 8.2 (v3.1) | High |
| CVE-2026-63135 | YOURLS: Stored XSS in referrer statistics chart via crafted Referer header | YOURLS | 8.2 (v3.1) | High |
| CVE-2025-62716 | Plane Vulnerable to Cross-Site Scripting via Open Redirect in ?next_path Parameter | plane | 8.1 (v3.1) | High |
| CVE-2026-18147 | Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url | Red Hat Enterprise Linux 10 | 8.1 (v3.1) | High |
| CVE-2026-39344 | Reflected XSS the login page through the 'username' parameter | churchcrm | 8.1 (v3.0) | High |
| CVE-2026-48060 | Litestar: HTML Injection Through CSRF Token | litestar | 8.1 (v3.1) | High |
| CVE-2025-12029 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab | gitlab | 8.0 (v3.1) | High |
| CVE-2026-58390 | OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views | core | 8.0 (v3.1) | High |
| CVE-2026-55659 | Grist: XSS through unsafe value interpolation in server-rendered pages | grist-core | 7.7 (v3.1) | High |
| CVE-2026-116167 | SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter | siyuan | 7.6 (v4.0) | High |
| CVE-2026-35534 | ChurchCRM has Stored XSS in PersonView.php via Facebook Field Attribute Injection | churchcrm | 7.6 (v3.1) | High |
| CVE-2026-59814 | Joplin: Stored XSS via inline-served note attachment on published shares | joplin | 7.6 (v3.1) | High |
| CVE-2004-1315 | phpBB viewtopic.php Arbitrary Code Execution | phpbb | 7.5 (v2.0) | High |
| CVE-2005-0511 | vBulletin misc.php Template Name Arbitrary Code Execution | vbulletin | 7.5 (v2.0) | High |
| CVE-2005-2086 | phpBB viewtopic.php Arbitrary Code Execution | phpbb | 7.5 (v2.0) | High |
| CVE-2010-4417 | Oracle BeeHive 2 voice-servlet processEvaluation() Vulnerability | beehive | 7.5 (v2.0) | High |
| CVE-2013-1081 | Novell Zenworks Mobile Managment MDM.php Local File Inclusion Vulnerability | zenworks mobile management | 7.5 (v2.0) | High |
| CVE-2020-5849 | Unraid 6.8.0 Auth Bypass PHP Code Execution | unraid | 7.5 (v3.1) | High |
| CVE-2025-4427 | Ivanti EPMM Authentication Bypass for Expression Language Remote Code Execution | endpoint manager mobile | 7.5 (v3.1) | High |
| CVE-2026-44657 | MantisBT: Stored XSS in File Download | mantisbt | 7.5 (v4.0) | High |
| CVE-2026-73546 | Envoy: Stored XSS in Admin Stats Interface (/stats?format=html) | envoy | 7.4 (v3.1) | High |
| CVE-2026-7460 | mailcow-dockerized 2026-03b - Stored XSS in Queue Manager via unescaped | mailcow-dockerized | 7.4 (v4.0) | High |
| CVE-2026-87812 | SiYuan before v3.8.2 Stored XSS via Bazaar iconURL | siyuan | 7.4 (v4.0) | High |
| CVE-2025-11189 | kiwire Cross-Site Scripting Vulnerability | kiwire | 7.3 (v3.1) | High |
| CVE-2026-30819 | Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameter | iTop | 7.3 (v3.1) | High |
| CVE-2026-6735 | XSS within PHP-FPM status endpoint | php | 7.3 (v4.0) | High |
| CVE-2026-8203 | Concrete CMS 9.5.0 and below has Stored XSS on the height parameter | concrete cms | 7.3 (v4.0) | High |
| CVE-2025-11994 | Easy Email Subscription <= 1.3 - Unauthenticated Stored Cross-Site Scripting | Easy Email Subscription | 7.2 (v3.1) | High |
| CVE-2025-14151 | SlimStat Analytics <= 5.3.2 - Unauthenticated Stored Cross-Site Scripting | SlimStat Analytics | 7.2 (v3.1) | High |
| CVE-2026-101928 | Magic Tooltips For Contact Form 7 <= 1.0.34 - Unauthenticated Stored Cross-Site Scripting via 'esc_html' Filter Override | Magic Tooltips For Contact Form 7 | 7.2 (v3.1) | High |
| CVE-2026-102562 | AcyMailing <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting via 'customField[]' Parameter | AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress | 7.2 (v3.1) | High |
| CVE-2026-107764 | SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Inspector hre | SiteOrigin CSS | 7.2 (v3.1) | High |
| CVE-2026-109193 | HivePress <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value | HivePress – Business Directory, Listings & Classified Ads Plugin | 7.2 (v3.1) | High |
| CVE-2026-13359 | Contact Form to DB by BestWebSoft <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting via cntctfrm_contact_dropdown P | Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress | 7.2 (v3.1) | High |
| CVE-2026-17506 | Independent Analytics <= 2.15.0 - Unauthenticated Stored Cross-Site Scripting | Independent Analytics – WordPress Analytics Plugin | 7.2 (v3.1) | High |
| CVE-2026-18756 | HumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button rendering | HumHub | 7.2 (v4.0) | High |
| CVE-2026-4267 | Query Monitor <= 3.20.3 - Reflected Cross-Site Scripting via Request URI | Query Monitor | 7.2 (v3.1) | High |
| CVE-2026-43874 | WWBN AVideo: Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via | AVideo | 7.2 (v3.1) | High |
| CVE-2026-5934 | WP Rocket <= 3.21.0.1 - Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket_beacon Endpo | WP Rocket | 7.2 (v3.1) | High |
| CVE-2026-75528 | Broken Link Checker <= 2.4.13 - Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Log | Broken Link Checker | 7.2 (v3.1) | High |
| CVE-2026-83625 | Contact Form by Supsystic <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via IP Address Header | Contact Form by Supsystic | 7.2 (v3.1) | High |
| CVE-2026-87091 | Welcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters | Welcart e-Commerce | 7.2 (v3.1) | High |
| CVE-2026-89417 | OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 6.3.10 - Unauthenticated Stored Cross-Site Scripting via 's' | OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. | 7.2 (v3.1) | High |
| CVE-2026-93756 | Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in A | Smash Balloon Social Post Feed – Simple Social Feeds for WordPress | 7.2 (v3.1) | High |
| CVE-2026-95670 | No External Links <= 5.2.0 - Unauthenticated Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect | No External Links | 7.2 (v3.1) | High |
| CVE-2026-96561 | AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advi | AI Engine – The Chatbot, AI Framework & MCP for WordPress | 7.2 (v3.1) | High |
| CVE-2026-96566 | Newsletter <= 9.4.0 - Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field Parameter | Newsletter – Send awesome emails from WordPress | 7.2 (v3.1) | High |
| CVE-2022-35499 | In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint Cross-Site Scripting Vulnerability | - | 7.1 (v3.1) | High |
| CVE-2025-11560 | Team Members Showcase < 3.5.0 - Reflected XSS | Team Members Showcase | 7.1 (v3.1) | High |
| CVE-2025-12629 | Broken Link Manager <= 0.6.5 - Reflected XSS | Broken Link Manager | 7.1 (v3.1) | High |
| CVE-2025-12684 | URL Shortify < 1.11.3 - Reflected XSS | URL Shortify | 7.1 (v3.1) | High |
| CVE-2025-13071 | Custom Admin Menu <= 1.0.0 - Reflected XSS | Custom Admin Menu | 7.1 (v3.1) | High |
| CVE-2025-13072 | HandL UTM Grabber / Tracker < 2.8.1 - Reflected XSS via utm_source | HandL UTM Grabber / Tracker | 7.1 (v3.1) | High |
| CVE-2025-13073 | HandL UTM Grabber / Tracker < 2.8.1 - Reflected XSS via handl_landing_page | HandL UTM Grabber / Tracker | 7.1 (v3.1) | High |
| CVE-2025-13355 | URL Shortify < 1.11.4 - Reflected XSS | URL Shortify | 7.1 (v3.1) | High |
| CVE-2025-14701 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller | crafty controller | 7.1 (v3.1) | High |
| CVE-2026-115457 | baserCMS: Unauthenticated Stored XSS via Shortcode Expansion in Blog Comments | basercms | 7.1 (v3.1) | High |
| CVE-2026-12970 | LearnPress < 4.4.1 - Reflected XSS via c_search | LearnPress | 7.1 (v3.1) | High |
| CVE-2026-14234 | WOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRF | WOLF | 7.1 (v3.1) | High |
| CVE-2026-14239 | Tourmaster < 5.4.8 - Stored XSS via CSRF | tourmaster | 7.1 (v3.1) | High |
| CVE-2026-14870 | Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_id | Database for Contact Form 7, WPforms, Elementor forms | 7.1 (v3.1) | High |
| CVE-2026-34598 | YesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter" | yeswiki | 7.1 (v4.0) | High |
| CVE-2026-76790 | Estatik < 4.3.5 - Reflected XSS via get_listings hash Parameter | Estatik Real Estate Plugin | 7.1 (v3.1) | High |
| CVE-2026-84192 | LibreNMS before 26.3.1 Stored XSS via SNMP/Syslog Data | librenms | 7.1 (v4.0) | High |
| CVE-2026-9833 | WordPress Tag Groups < 2.2.0 - Reflected Cross-Site Scripting | tag-groups | 7.1 (v3.1) | High |
| CVE-2026-58411 | ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values | CRM | 7.0 (v4.0) | High |
| CVE-2025-11937 | Stored XSS through a system message in SecurePoll | Mediawiki - SecurePoll Extension | 6.9 (v4.0) | Medium |
| CVE-2025-43779 | digital experience platform Cross-Site Scripting Vulnerability | digital experience platform | 6.9 (v4.0) | Medium |
| CVE-2025-62597 | WeGIA Vulnerable to Reflected Cross-Site Scripting via Endpoint 'pessoa/editar_info_pessoal.php' Parameter 'sql' | wegia | 6.9 (v4.0) | Medium |
| CVE-2025-62598 | WeGIA Vulnerable to Reflected Cross-Site Scripting via Endpoint 'pessoa/editar_info_pessoal.php' Parameter 'action' | wegia | 6.9 (v4.0) | Medium |
| CVE-2025-62662 | Stored XSS through system messages in AdvancedSearch | Mediawiki - AdvancedSearch Extension | 6.9 (v4.0) | Medium |
| CVE-2025-62663 | Stored XSS through a system message in UploadWizard | Mediawiki - UploadWizard Extension | 6.9 (v4.0) | Medium |
| CVE-2025-62664 | Stored XSS through a system message in ImageRating | Mediawiki - ImageRating Extension | 6.9 (v4.0) | Medium |
| CVE-2025-62670 | Stored XSS through a system message in FlexDiagrams | Mediawiki - FlexDiagrams Extension | 6.9 (v4.0) | Medium |
| CVE-2025-62671 | Stored XSS through wikitext in Cargo | Mediawiki - Cargo Extension | 6.9 (v4.0) | Medium |
| CVE-2025-62693 | Stored XSS through system messages in LastModified | Mediawiki - LastModified Extension | 6.9 (v4.0) | Medium |
| CVE-2025-62695 | Stored XSS through system messages | Mediawiki - WikiLambda Extension | 6.9 (v4.0) | Medium |
| CVE-2025-62698 | Stored XSS through system messages in ExternalGuidance | Mediawiki - ExternalGuidance | 6.9 (v4.0) | Medium |
| CVE-2025-62700 | Stored XSS through a system message in MultiBoilerplate | Mediawiki - MultiBoilerplate Extensionmaste | 6.9 (v4.0) | Medium |
| CVE-2026-39838 | ProofreadPage improperly sanitizes multiline styles using Sanitizer::checkCSS | MediaWiki - ProofreadPage Extension | 6.9 (v4.0) | Medium |
| CVE-2026-39936 | Stored XSS in Score due to usage of non-reserved data attributes | Mediawiki - Score Extension | 6.9 (v4.0) | Medium |
| CVE-2026-44651 | SillyTavern: Reflected XSS vulnerability in the CORS proxy middleware | SillyTavern | 6.9 (v4.0) | Medium |
| CVE-2026-69092 | Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpoint | admidio | 6.9 (v4.0) | Medium |
| CVE-2026-73848 | Emlog: Stored XSS via Tag Name in Article Editor | emlog | 6.9 (v4.0) | Medium |
| CVE-2026-86188 | AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting | AVideo | 6.9 (v4.0) | Medium |
| CVE-2026-14817 | Element Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data Attributes | Element Pack Addons for Elementor | 6.8 (v3.1) | Medium |
| CVE-2026-15047 | s2Member < 260805 - Contributor+ Stored XSS via Shortcode | s2Member | 6.8 (v3.1) | Medium |
| CVE-2026-16069 | Brizy - Page Builder < 2.8.19 - Contributor+ Stored XSS via Featured Image Focal Point | Brizy | 6.8 (v3.1) | Medium |
| CVE-2026-33741 | EspoCRM: Stored XSS via SVG attachment loading same-origin JavaScript | espocrm | 6.8 (v3.1) | Medium |
| CVE-2014-8998 | X7 Chat 2.0.5 lib/message.php preg_replace() PHP Code Execution | x7 chat | 6.5 (v2.0) | Medium |
| CVE-2026-55549 | Yamcs <=5.8.6 - Cross-Site Scripting | yamcs | 6.5 (v3.1) | Medium |
| CVE-2026-78838 | AppNitro MachForm v30 Cross-Site Scripting Vulnerability | AppNitro MachForm v30 | 6.5 (v3.1) | Medium |
| CVE-2026-88618 | 1024-lab SmartAdmin v3.30.0 Arbitrary Code Execution Vulnerability | 1024-lab SmartAdmin v3.30.0 | 6.5 (v3.1) | Medium |
| CVE-2025-10128 | Eulerpool Research Systems <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting | Eulerpool Research Systems | 6.4 (v3.1) | Medium |
| CVE-2025-10130 | Layers <= 0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting | Layers | 6.4 (v3.1) | Medium |
| CVE-2025-10139 | WP BookWidgets <= 0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting | WP BookWidgets | 6.4 (v3.1) | Medium |
| CVE-2025-10189 | BP Direct Menus <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting | BP Direct Menus | 6.4 (v3.1) | Medium |
| CVE-2025-13135 | HotelRunner Booking Widget <= 5.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting | HotelRunner Booking Widget | 6.4 (v3.1) | Medium |
| CVE-2025-14387 | LearnPress – WordPress LMS Plugin <= 4.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via get_profile_soc | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | 6.4 (v3.1) | Medium |
| CVE-2025-9130 | Unify <= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via unify_checkout Shortcode | Unify | 6.4 (v3.1) | Medium |
| CVE-2026-0552 | Simple Shopping Cart <= 5.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsc_display_product' Shor | Simple Shopping Cart | 6.4 (v3.1) | Medium |
| CVE-2026-0626 | WPFunnels <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode | WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell | 6.4 (v3.1) | Medium |
| CVE-2026-0737 | Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode | WP Shortcodes Plugin — Shortcodes Ultimate | 6.4 (v3.1) | Medium |
| CVE-2026-0738 | Shortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode | WP Shortcodes Plugin — Shortcodes Ultimate | 6.4 (v3.1) | Medium |
| CVE-2026-100106 | FiboSearch <= 1.34.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'purchased_plan' Parameter | FiboSearch – Ajax Search for WooCommerce | 6.4 (v3.1) | Medium |
| CVE-2026-109983 | YMC Filter <= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' Parameter | YMC Filter | 6.4 (v3.1) | Medium |
| CVE-2026-13203 | Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_id' Shortcode Attribute | Live Composer – Free WordPress Website Builder | 6.4 (v3.1) | Medium |
| CVE-2026-13770 | AppMySite <= 3.15.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via save_ams_license_key AJAX Handler | AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) | 6.4 (v3.1) | Medium |
| CVE-2026-3885 | WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_bo | Shortcodes Ultimate – Content Elements | 6.4 (v3.1) | Medium |
| CVE-2026-50592 | Znuny Cross-Site Scripting Vulnerability | Znuny | 6.4 (v3.1) | Medium |
| CVE-2026-5092 | Greenshift <= 12.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data URI | Greenshift – animation and page builder blocks | 6.4 (v3.1) | Medium |
| CVE-2026-5391 | LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress | 6.4 (v3.1) | Medium |
| CVE-2026-6454 | Firelight Lightbox <= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad 'href' At | Firelight Lightbox | 6.4 (v3.1) | Medium |
| CVE-2026-87870 | Ninja Forms - Scheduled Exports <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Paramete | Ninja Forms - Scheduled Exports | 6.4 (v3.1) | Medium |
| CVE-2026-8977 | WP GDPR Cookie Consent <= 1.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ninja_gdpr_ajax_actions' | WP GDPR Cookie Consent | 6.4 (v3.1) | Medium |
| CVE-2026-9281 | Master Addons For Elementor <= 3.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'jtlma_custom_js' Page Se | Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits | 6.4 (v3.1) | Medium |
| CVE-2025-10567 | FunnelKit < 3.12.0.1 - Reflected XSS | FunnelKit | 6.3 (v3.1) | Medium |
| CVE-2026-43980 | Malla: Stored XSS via Meshtastic node names in multiple frontend pages | malla | 6.3 (v3.1) | Medium |
| CVE-2025-34281 | Stored Cross-Site Scripting (XSS) in ThingsBoard | thingsboard | 6.2 (v4.0) | Medium |
| CVE-2026-44737 | grav-plugin-admin: Stored Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][titl | grav-plugin-admin | 6.2 (v4.0) | Medium |
| CVE-2018-6882 | zimbra collaboration suite Cross-Site Scripting Vulnerability | zimbra collaboration suite | 6.1 (v3.1) | Medium |
| CVE-2023-23548 | XSS in business intelligence | checkmk | 6.1 (v3.1) | Medium |
| CVE-2023-49494 | DedeCMS v5.7.111 - Cross-Site Scripting | dedecms | 6.1 (v3.1) | Medium |
| CVE-2023-51769 | Frappe Cross-Site Scripting Vulnerability | Frappe | 6.1 (v3.1) | Medium |
| CVE-2023-5758 | firefox mobile Cross-Site Scripting Vulnerability | firefox mobile | 6.1 (v3.1) | Medium |
| CVE-2025-12123 | Customer Reviews Collector for WooCommerce <= 4.6.1 - Reflected Cross-Site Scripting | Customer Reviews Collector for WooCommerce | 6.1 (v3.1) | Medium |
| CVE-2025-55757 | Extension - virtuemart.net - XSS in VirtueMart component 1.0.0 - 4.4.10 for Joomla | Virtuemart component for Joomla | 6.1 (v3.1) | Medium |
| CVE-2025-61583 | TS3 Manager is vulnerable to unauthenticated reflected XSS attack due to insecure error handling | ts3 manager | 6.1 (v3.1) | Medium |
| CVE-2025-62358 | WeGIA Reflected XSS to Account TakeOver at /html/configuracao/configuracao_geral.php via log parameter | wegia | 6.1 (v3.1) | Medium |
| CVE-2025-63238 | limesurvey Cross-Site Scripting Vulnerability | limesurvey | 6.1 (v3.1) | Medium |
| CVE-2025-63499 | sogo Cross-Site Scripting Vulnerability | sogo | 6.1 (v3.1) | Medium |
| CVE-2025-63607 | TechStore 1.0 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium |
| CVE-2025-63737 | rockoa Cross-Site Scripting Vulnerability | rockoa | 6.1 (v3.1) | Medium |
| CVE-2025-63949 | hotel management system Cross-Site Scripting Vulnerability | hotel management system | 6.1 (v3.1) | Medium |
| CVE-2025-65013 | LibreNMS vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint /maps/nodeimage parameter Image Name | librenms | 6.1 (v3.1) | Medium |
| CVE-2025-65019 | Astro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /_image endpoint | astro | 6.1 (v3.1) | Medium |
| CVE-2025-65233 | slims Cross-Site Scripting Vulnerability | slims | 6.1 (v3.1) | Medium |
| CVE-2025-66026 | REDAXO is Vulnerable to Reflected XSS in Mediapool Info Banner via args[types] | redaxo | 6.1 (v3.1) | Medium |
| CVE-2025-67443 | cms Cross-Site Scripting Vulnerability | cms | 6.1 (v3.1) | Medium |
| CVE-2025-67495 | ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login | zitadel | 6.1 (v3.1) | Medium |
| CVE-2025-67648 | Shopware's inproper input validation can lead to Reflected XSS through Storefront Login Page | shopware | 6.1 (v3.1) | Medium |
| CVE-2025-69723 | localstack v4.9.2 Cross-Site Scripting Vulnerability | localstack v4.9.2 | 6.1 (v3.1) | Medium |
| CVE-2025-9952 | Trinity Audio <= 5.20.2 - Reflected Cross-Site Scripting | Trinity Audio – Text to Speech AI audio player to convert content into audio | 6.1 (v3.1) | Medium |
| CVE-2026-103888 | WPC Smart Quick View for WooCommerce <= 4.4.0 - Reflected Cross-Site Scripting via 'woosq-redirect' Parameter | WPC Smart Quick View for WooCommerce | 6.1 (v3.1) | Medium |
| CVE-2026-113659 | ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated us | apostrophe | 6.1 (v3.1) | Medium |
| CVE-2026-11881 | Fluent Forms < 6.2.6 - Contributor+ Stored XSS via Date/Time Field | Fluent Forms | 6.1 (v3.1) | Medium |
| CVE-2026-12982 | Document Gallery < 5.1.1 - Reflected XSS via dg_generate_gallery | Document Gallery | 6.1 (v3.1) | Medium |
| CVE-2026-14207 | LifterLMS < 10.0.10 - Instructor+ Stored XSS via Featured Pricing Information | LifterLMS | 6.1 (v3.1) | Medium |
| CVE-2026-14845 | NewStatPress < 1.4.5 - Unauthenticated Stored XSS via Top Post Widget | NewStatPress | 6.1 (v3.1) | Medium |
| CVE-2026-14921 | Ultimate Addons for WPBakery Page Builder < 3.21.5 - Contributor+ Stored XSS via ult_buttons Shortcode | Ultimate Addons for WPBakery Page Builder | 6.1 (v3.1) | Medium |
| CVE-2026-17532 | Seraphinite Accelerator <= 2.29.18 - Reflected Cross-Site Scripting | Seraphinite Accelerator | 6.1 (v3.1) | Medium |
| CVE-2026-18843 | Beaver Builder Plugin (Pro Version) <= 2.11.0.1 - Reflected Cross-Site Scripting via 'no_results_message' node_preview P | Beaver Builder Plugin (Starter Version) | 6.1 (v3.1) | Medium |
| CVE-2026-30251 | zenshare suite Cross-Site Scripting Vulnerability | zenshare suite | 6.1 (v3.1) | Medium |
| CVE-2026-30252 | zencrm Cross-Site Scripting Vulnerability | zencrm | 6.1 (v3.1) | Medium |
| CVE-2026-31013 | ad phonebook Cross-Site Scripting Vulnerability | ad phonebook | 6.1 (v3.1) | Medium |
| CVE-2026-33403 | Pi-hole has a Reflected XSS / HTML injection in taillog.js | web interface | 6.1 (v3.1) | Medium |
| CVE-2026-34206 | Captcha Protect: Reflected XSS in challenge page via unsanitized destination rendered with text/template | captcha protect | 6.1 (v3.1) | Medium |
| CVE-2026-34739 | AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php | avideo | 6.1 (v3.1) | Medium |
| CVE-2026-36468 | Cross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 Vulnerability | - | 6.1 (v3.1) | Medium |
| CVE-2026-37750 | School Management System by mahmoudai1 Cross-Site Scripting Vulnerability | School Management System by mahmoudai1 | 6.1 (v3.1) | Medium |
| CVE-2026-38444 | osTicket v1.18.3 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium |
| CVE-2026-38472 | forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 Cross-Site Scripting Vulnerability | forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 | 6.1 (v3.1) | Medium |
| CVE-2026-38947 | FluentCMS 1.2.3 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium |
| CVE-2026-39335 | ChurchCRM has Stored XSS via Unescaped data-* Attributes in Group/Family Controls | churchcrm | 6.1 (v3.1) | Medium |
| CVE-2026-41067 | Astro: XSS via incomplete </script> sanitization in define:vars allows case-insensitive and whitespace-based bypass | astro | 6.1 (v3.1) | Medium |
| CVE-2026-42253 | Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties | activemq | 6.1 (v3.1) | Medium |
| CVE-2026-4246 | ElementsKit Pro <= 4.10.1 - Unauthenticated Stored Cross-Site Scripting via 's' Parameter | ElementsKit Pro | 6.1 (v3.1) | Medium |
| CVE-2026-43878 | WWBN AVideo: Reflected XSS in plugin/Meet/iframe.php via Unescaped user/pass Parameters Reflected into JavaScript St | AVideo | 6.1 (v3.1) | Medium |
| CVE-2026-44767 | Allowlist Bypass in setThemeRoot() Enables Cross-Origin CSS Injection | @ui5/webcomponents-base | 6.1 (v3.1) | Medium |
| CVE-2026-50182 | AVideo Has Unauthenticated Reflected XSS via $_GET['search'] in YouTubeAPI Gallery Pagination | AVideo | 6.1 (v3.1) | Medium |
| CVE-2026-51133 | za-internet GmbH C-MOR Video Surveillance <= V6.0104 Arbitrary Code Execution Vulnerability | za-internet GmbH C-MOR Video Surveillance <= V6.0104 | 6.1 (v3.1) | Medium |
| CVE-2026-51565 | Modules/Docs/DocsController.php in Milk admin <=0.9.8 Cross-Site Scripting Vulnerability | Modules/Docs/DocsController.php in Milk admin <=0.9.8 | 6.1 (v3.1) | Medium |
| CVE-2026-54714 | Logto: XSS via unescaped RelayState in SAML auto-submit form | logto | 6.1 (v3.1) | Medium |
| CVE-2026-55087 | Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (ope | etherpad | 6.1 (v3.1) | Medium |
| CVE-2026-61526 | AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler | http-server | 6.1 (v3.1) | Medium |
| CVE-2026-62280 | OpenAM Reflected XSS in the OAuth2/OIDC wap consent page | OpenAM | 6.1 (v3.1) | Medium |
| CVE-2026-73084 | Activepieces: Reflected Cross-Site Scripting in OAuth Redirect Endpoint | activepieces | 6.1 (v3.1) | Medium |
| CVE-2026-82382 | Apache Roller: Reflected cross-site scripting in the frontpage directory parameter | Apache Roller | 6.1 (v3.1) | Medium |
| CVE-2026-8447 | Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untruste | langflow | 6.1 (v3.1) | Medium |
| CVE-2026-84925 | Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter | Avada | Website Builder For WordPress & WooCommerce | 6.1 (v3.1) | Medium |
| CVE-2026-8626 | SponsorMe <= 0.5.2 - Reflected Cross-Site Scripting via PHP_SELF Parameter | SponsorMe | 6.1 (v3.1) | Medium |
| CVE-2026-89047 | Social Media Share Buttons & Social Sharing Icons <= 3.0.1 - Reflected DOM-Based Cross-Site Scripting via URL | Social Media Share Buttons & Social Sharing Icons | 6.1 (v3.1) | Medium |
| CVE-2026-92974 | Photo Gallery by 10Web <= 1.8.46 - Reflected Cross-Site Scripting via 'thumb_url' Parameter | Photo Gallery by 10Web – Mobile-Friendly Image Gallery | 6.1 (v3.1) | Medium |
| CVE-2026-96594 | Gitea repository media API stored XSS | gitea | 6.1 (v3.1) | Medium |
| CVE-2023-6717 | Keycloak: xss via assertion consumer service url in saml post-binding flow | Red Hat AMQ Broker 7 | 6.0 (v3.1) | Medium |
| CVE-2026-8245 | Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection | concrete cms | 6.0 (v4.0) | Medium |
| CVE-2026-21631 | Joomla! Core - [20260303] - XSS vector in com_associations comparison view | joomla! | 5.9 (v4.0) | Medium |
| CVE-2026-5696 | Multiple vulnerabilities in the Microweber administration panel | Administration panel | 5.9 (v4.0) | Medium |
| CVE-2025-62657 | Stored XSS through system messages in PageForms | MediaWiki PageForms extension | 5.8 (v4.0) | Medium |
| CVE-2025-8280 | Contact Form 7 reCAPTCHA <= 1.2.0 - Reflected XSS via $_SERVER['REQUEST_URI'] | contact form 7 recaptcha | 5.8 (v3.1) | Medium |
| CVE-2026-84193 | LibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP | librenms | 5.8 (v4.0) | Medium |
| CVE-2026-115425 | Multiple cross-site scripting (XSS) in OPNsense | OPNsense firewall | 5.6 (v4.0) | Medium |
| CVE-2025-62365 | LibreNMS vulnerable to Reflected-XSS in report_this function | librenms | 5.5 (v4.0) | Medium |
| CVE-2025-62421 | DataEase vulnerable to stored cross-site scripting via file upload bypass | dataease | 5.5 (v4.0) | Medium |
| CVE-2022-35497 | TM4WEB Cross-Site Scripting Vulnerability | TM4WEB | 5.4 (v3.1) | Medium |
| CVE-2024-10146 | Simple File List < 6.1.13 - Reflected Cross-Site Scripting | simple file list | 5.4 (v3.1) | Medium |
| CVE-2024-23176 | MassMessage Cross-Site Scripting Vulnerability | MassMessage | 5.4 (v3.1) | Medium |
| CVE-2025-5343 | Stored XSS | manageengine exchange reporter plus | 5.4 (v3.1) | Medium |
| CVE-2025-61597 | Emlog Pro is vulnerable to stored XSS attack through HTML template injection | emlog | 5.4 (v3.1) | Medium |
| CVE-2025-62178 | WeGIA Cross-Site Scripting (XSS) Reflected endpoint '/html/atendido/cadastro_atendido_parentesco_pessoa_nova.php' parame | wegia | 5.4 (v3.1) | Medium |
| CVE-2025-62430 | ClipBucket v5 stored XSS via video/photo fields | clipbucket | 5.4 (v3.1) | Medium |
| CVE-2025-63528 | blood bank management system Cross-Site Scripting Vulnerability | blood bank management system | 5.4 (v3.1) | Medium |
| CVE-2025-63948 | phpmsadmin SQL Injection Vulnerability | phpmsadmin | 5.4 (v3.1) | Medium |
| CVE-2025-65200 | localstack 4.9.2 Arbitrary Code Execution Vulnerability | - | 5.4 (v3.1) | Medium |
| CVE-2026-102295 | Quay: quay: dom-based cross-site scripting via oauth local callback format=json parameter | Red Hat Quay 3 | 5.4 (v3.1) | Medium |
| CVE-2026-103421 | WPMobile.App <= 11.84 - Unauthenticated Stored Cross-Site Scripting via '/android_json/search/<value>/0' Path Segment | WPMobile.App – Android and iOS App Builder | 5.4 (v3.1) | Medium |
| CVE-2026-106033 | Ansible: ansible-ui: ansible ui dom xss in /redirect next parameter | Red Hat Ansible Automation Platform 2 | 5.4 (v3.1) | Medium |
| CVE-2026-15234 | Codeless Page Builder <= 1.1.4 - Contributor+ Stored XSS via Shortcode Attribute | Codeless Page Builder | 5.4 (v3.1) | Medium |
| CVE-2026-15245 | BNE Testimonials < 2.0.8.2 - Contributor+ Stored XSS via Slider Shortcode | BNE Testimonials | 5.4 (v3.1) | Medium |
| CVE-2026-15262 | Admin Columns for ACF Fields <= 0.3.2 - Contributor+ Stored XSS via ACF Field Value Column | Admin Columns for ACF Fields | 5.4 (v3.1) | Medium |
| CVE-2026-16063 | Event Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event Timeline Content | Event Booking Manager for WooCommerce | 5.4 (v3.1) | Medium |
| CVE-2026-16537 | Slick Slider < 0.5.3 - Contributor+ Stored XSS via Gallery Shortcode | Slick Slider | 5.4 (v3.1) | Medium |
| CVE-2026-18395 | Child Pages Card < 1.09 - Contributor+ Stored XSS via Shortcode Attributes | Child Pages Card | 5.4 (v3.1) | Medium |
| CVE-2026-32893 | Chamilo LMS has Reflected XSS via Unsanitized http_build_query() in Exercise Question List Pagination | chamilo lms | 5.4 (v3.1) | Medium |
| CVE-2026-34974 | phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding leads to Stored XSS and Privilege Escalation | phpmyfaq | 5.4 (v3.1) | Medium |
| CVE-2026-35403 | LORIS has potential cross-site scripting in survey_accounts module | loris | 5.4 (v3.1) | Medium |
| CVE-2026-38473 | the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 Cross-Site Scripting Vulnerability | the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 | 5.4 (v3.1) | Medium |
| CVE-2026-39964 | TypeBot: Stored XSS via javascript: URI in text bubble links — bot author executes JS on visitors' browsers | typebot.io | 5.4 (v3.1) | Medium |
| CVE-2026-40483 | ChurchCRM: Stored XSS in PledgeEditor.php via Donation Comment Field | CRM | 5.4 (v3.1) | Medium |
| CVE-2026-41318 | AnythingLLM vulnerable to stored DOM XSS in chart caption renderer - LLM-driven prompt injection produces executable HTM | anythingllm | 5.4 (v3.1) | Medium |
| CVE-2026-42877 | FacturaScripts: Stored XSS via product reference in sales/purchases | facturascripts | 5.4 (v3.1) | Medium |
| CVE-2026-45694 | LibreNMS: Reflected XSS in the Proxmox app view via unsanitized instance/vmid parameters | librenms | 5.4 (v3.1) | Medium |
| CVE-2026-63498 | Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API | snipe-it | 5.4 (v3.1) | Medium |
| CVE-2026-72570 | cube-root directory-serve - Stored Cross-Site Scripting via Malicious Filename | directory-serve | 5.4 (v3.1) | Medium |
| CVE-2026-72583 | fastschema - Stored Cross-Site Scripting via MIME Type Bypass in File Upload | fastschema | 5.4 (v3.1) | Medium |
| CVE-2026-82396 | Sulu: Stored XSS via media download inline-disposition override | sulu | 5.4 (v3.1) | Medium |
| CVE-2026-91021 | Trillium Notes Cross-Site Scripting Vulnerability | Trillium Notes | 5.4 (v3.1) | Medium |
| CVE-2024-58292 | XMB Forum 1.9.12.06 Persistent Cross-Site Scripting via Admin Templates | XMB Forum | 5.3 (v4.0) | Medium |
| CVE-2024-58391 | Frappe before 15.4.0 XSS via Printview Parameters | frappe | 5.3 (v4.0) | Medium |
| CVE-2025-62359 | WeGIA Cross-Site Scripting (XSS) Reflected endpoint id_pet | wegia | 5.3 (v4.0) | Medium |
| CVE-2025-62800 | FastMCP vulnerable to reflected XSS in client's callback page | fastmcp | 5.3 (v4.0) | Medium |
| CVE-2025-66460 | Lookyloo vulnerable to XSS due to lack of escaping in HTML elements passed to Datatables | lookyloo | 5.3 (v4.0) | Medium |
| CVE-2026-100381 | UploadWizard Flickr collection and set titles allow DOM XSS | Mediawiki - UploadWizard Extension | 5.3 (v4.0) | Medium |
| CVE-2026-105114 | OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page | OpenAM | 5.3 (v4.0) | Medium |
| CVE-2026-107797 | Jivejdon through 5.0 Reflected XSS via postThread.jsp to and tag Parameters | jivejdon | 5.3 (v4.0) | Medium |
| CVE-2026-109352 | LibreNMS before 26.9.0 Stored XSS via wireless sensor description | librenms | 5.3 (v4.0) | Medium |
| CVE-2026-109355 | LibreNMS before 26.9.0 Stored XSS via Tools Oxidized Node List | librenms | 5.3 (v4.0) | Medium |
| CVE-2026-116203 | YesWiki before 4.7.0 Stored XSS via filtertags Action Parameters | yeswiki | 5.3 (v4.0) | Medium |
| CVE-2026-116217 | RosarioSIS before 12.9.2 Reflected XSS via menu_id in MenuReports.php | rosariosis | 5.3 (v4.0) | Medium |
| CVE-2026-116823 | YesWiki before 4.7.0 Reflected XSS via BazarField $_REQUEST Fallback | yeswiki | 5.3 (v4.0) | Medium |
| CVE-2026-35208 | lichess.org has an Unsanitized Stream Title Injection on /streamer | lila | 5.3 (v4.0) | Medium |
| CVE-2026-39941 | ChurchCRM has an XSS vulnerability | churchcrm | 5.3 (v4.0) | Medium |
| CVE-2026-42458 | Magento LTS: Reflected XSS - Import -> Data Flow (profiles) | magento-lts | 5.3 (v4.0) | Medium |
| CVE-2026-42554 | Fiber: XSS in AutoFormat Content Negotiation | fiber | 5.3 (v4.0) | Medium |
| CVE-2026-47096 | AJA HELO Plus < 2.1.7 Stored XSS via System Name Parameter | HELO Plus | 5.3 (v4.0) | Medium |
| CVE-2026-47119 | Agent Zero < 1.15 Stored XSS via image_get API Endpoint | agent-zero | 5.3 (v4.0) | Medium |
| CVE-2026-48094 | ShareOpenly has Cross-Site Scripting (XSS) via Missing esc_url() on Shared URL in Content Output | shareopenly | 5.3 (v4.0) | Medium |
| CVE-2026-5808 | openstatusHQ openstatus Onboarding Endpoint client.tsx cross site scripting | openstatus | 5.3 (v4.0) | Medium |
| CVE-2026-73628 | Serendipity 2.3.5 Reflected XSS via search clean-URL route | Serendipity | 5.3 (v4.0) | Medium |
| CVE-2026-82451 | Formwork through 2.3.14 Stored XSS via Referer Header | Formwork | 5.3 (v4.0) | Medium |
| CVE-2026-82646 | WWBN AVideo Unauthenticated Reflected XSS via url2Embed.json.php | AVideo | 5.3 (v4.0) | Medium |
| CVE-2026-85158 | AVideo Reflected XSS via videoEmbeded.php link parameter | AVideo | 5.3 (v4.0) | Medium |
| CVE-2026-85159 | AVideo Reflected XSS via cancelUri in userLogin.php | AVideo | 5.3 (v4.0) | Medium |
| CVE-2026-85577 | AVideo userLogin.php Reflected XSS via error parameter | AVideo | 5.3 (v4.0) | Medium |
| CVE-2026-89240 | WWBN AVideo Reflected XSS via confirmLivePassword.php | AVideo | 5.3 (v4.0) | Medium |
| CVE-2026-89241 | WWBN AVideo Reflected XSS via confirmLivePassword.php | AVideo | 5.3 (v4.0) | Medium |
| CVE-2026-89244 | WWBN AVideo Reflected XSS via Gallery Category getBackURL | AVideo | 5.3 (v4.0) | Medium |
| CVE-2026-90848 | Governikus AusweisApp StartPAOSResponse cross site scripting | AusweisApp | 5.3 (v4.0) | Medium |
| CVE-2026-91922 | Steedos Platform through 3.0.15-beta.47 Reflected XSS via page render | steedos-platform | 5.3 (v4.0) | Medium |
| CVE-2026-92584 | AVideo through 29.0 Stored Cross-Site Scripting via User-Agent Header | AVideo | 5.3 (v4.0) | Medium |
| CVE-2011-10037 | Nagios XI < 2011R1.9 XSS via xiwindow Variables Affecting Permalinks | nagios xi | 5.1 (v4.0) | Medium |
| CVE-2012-20003 | Custom Tables WordPress Plugin < 3.4.6 Reflected XSS via iframe.php | Custom Tables | 5.1 (v4.0) | Medium |
| CVE-2014-125131 | DedeCMS 5.6 / 5.7 Reflected XSS via adminDirHand in config.php | DedeCMS | 5.1 (v4.0) | Medium |
| CVE-2014-125132 | Blogroll Fun WordPress Plugin < 0.8.5 Reflected XSS via blogroll.php | Blogroll Fun | 5.1 (v4.0) | Medium |
| CVE-2017-20288 | QCubed 3.1.1 Reflected XSS via installer step_2.php | QCubed | 5.1 (v4.0) | Medium |
| CVE-2017-20290 | Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed | Discourse | 5.1 (v4.0) | Medium |
| CVE-2018-25349 | userSpice 4.3.24 Cross-Site Scripting via X-Forwarded-For Header | userSpice | 5.1 (v4.0) | Medium |
| CVE-2020-37236 | NewsLister Authenticated Persistent Cross-Site Scripting via Admin Panel | NewsLister | 5.1 (v4.0) | Medium |
| CVE-2020-37284 | Sickbeard build-507 Reflected XSS via testNaming pattern Parameter | Sickbeard | 5.1 (v4.0) | Medium |
| CVE-2022-50943 | Moodle LMS 4.0 Cross-Site Scripting via course search.php | moodle | 5.1 (v4.0) | Medium |
| CVE-2022-50948 | Motopress Hotel Booking Lite 4.2.4 Stored Cross-Site Scripting | Motopress Hotel Booking Lite | 5.1 (v4.0) | Medium |
| CVE-2022-50958 | WordPress Plugin Jetpack 9.1 Cross Site Scripting via grunion-form-view.php | Jetpack | 5.1 (v4.0) | Medium |
| CVE-2022-50959 | WordPress Contact Form Builder 1.6.1 Cross-Site Scripting via code_generator.php | Contact Form Builder | 5.1 (v4.0) | Medium |
| CVE-2022-50960 | WordPress International Sms Contact Form 7 Integration 1.2 XSS | International Sms For Contact Form | 5.1 (v4.0) | Medium |
| CVE-2022-50962 | uBidAuction 2.0.1 myOrders Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium |
| CVE-2022-50963 | uBidAuction 2.0.1 myAuctions active Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium |
| CVE-2022-50964 | uBidAuction 2.0.1 myAuctions loose Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium |
| CVE-2022-50965 | uBidAuction 2.0.1 posts manage Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium |
| CVE-2022-50966 | uBidAuction 2.0.1 news manage Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium |
| CVE-2022-50968 | uBidAuction 2.0.1 auctions manage Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium |
| CVE-2022-50969 | uBidAuction 2.0.1 mailingLog manage Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium |
| CVE-2022-50970 | WordPress Plugin AAWP 3.16 Reflected XSS via tab Parameter | WordPress Plugin AAWP | 5.1 (v4.0) | Medium |
| CVE-2023-54358 | WordPress adivaha Travel Plugin 2.3 Reflected XSS via isMobile | WordPress adivaha Travel Plugin | 5.1 (v4.0) | Medium |
| CVE-2023-54361 | Joomla iProperty Real Estate 4.1.1 Reflected XSS via filter_keyword | Joomla iProperty Real Estate | 5.1 (v4.0) | Medium |
| CVE-2023-54362 | Joomla VirtueMart Shopping-Cart 4.0.12 Reflected XSS via keyword | Cart | 5.1 (v4.0) | Medium |
| CVE-2023-54413 | WPML Multilingual CMS WordPress Plugin < 4.6.1 Reflected XSS via wp-login.php wp_lang | WPML Multilingual CMS | 5.1 (v4.0) | Medium |
| CVE-2024-13992 | Nagios XI < 2024R1.1 XSS via Missing Page / 404 | nagios xi | 5.1 (v4.0) | Medium |
| CVE-2024-58394 | Retool 3.88.0 XSS via /api/imageProxy SVG Proxying | Retool | 5.1 (v4.0) | Medium |
| CVE-2025-10354 | Reflected Cross-Site Scripting (XSS) in Semantic MediaWiki | Semantic MediaWiki | 5.1 (v4.0) | Medium |
| CVE-2025-10945 | nuz007 smsboom d.php cross site scripting | smsboom | 5.1 (v4.0) | Medium |
| CVE-2025-10946 | nuz007 smsboom dy.php cross site scripting | smsboom | 5.1 (v4.0) | Medium |
| CVE-2025-12264 | Wisencode Create Support Ticket create cross site scripting | Wisencode | 5.1 (v4.0) | Medium |
| CVE-2025-34264 | Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via dog/{agentId} | wise-deviceon server | 5.1 (v4.0) | Medium |
| CVE-2025-40638 | Reflected Cross-Site Scripting (XSS) in Eventobot | eventobot | 5.1 (v4.0) | Medium |
| CVE-2025-40642 | Reflected Cross-Site Scripting (XSS) in WebWork | WebWork PHP script | 5.1 (v4.0) | Medium |
| CVE-2025-40647 | Stored Cross-Site Scripting (XSS) vulnerability in Issabel products | Issabel | 5.1 (v4.0) | Medium |
| CVE-2025-40681 | Cross-Site Scripting (XSS) in xCally Omnichannel | Omnichannel | 5.1 (v4.0) | Medium |
| CVE-2025-40693 | Cross Site Scripting in PHPGurukul Online Fire Reporting System | online fire reporting system | 5.1 (v4.0) | Medium |
| CVE-2025-40700 | Reflected Cross-Site Scripting (XSS) in Governalia by IDI Eikon | governalia | 5.1 (v4.0) | Medium |
| CVE-2025-40725 | Reflected Cross-Site Scripting (XSS) in Azon Dominator | Azon Dominator PHP script | 5.1 (v4.0) | Medium |
| CVE-2025-41011 | HTML injection in PHP Point Of Sale | php point of sale | 5.1 (v4.0) | Medium |
| CVE-2025-43804 | digital experience platform Cross-Site Scripting Vulnerability | digital experience platform | 5.1 (v4.0) | Medium |
| CVE-2025-64716 | Anubis vulnerable to possible XSS via redir parameter when using subrequest auth mode | anubis | 5.1 (v4.0) | Medium |
| CVE-2025-71404 | better-auth before 1.1.16 Reflected XSS via error parameter | better-auth | 5.1 (v4.0) | Medium |
| CVE-2025-9655 | O2OA Personal Profile person cross site scripting | o2oa | 5.1 (v4.0) | Medium |
| CVE-2026-100521 | Cotonti through 1.0.0 Reflected XSS via search highlight parameter | Cotonti | 5.1 (v4.0) | Medium |
| CVE-2026-100522 | Cotonti through 1.0.0 Reflected XSS via message.php lng parameter | Cotonti | 5.1 (v4.0) | Medium |
| CVE-2026-100904 | amirsanni mini-inventory-and-sales-management-system Items Management Items.php cross site scripting | mini-inventory-and-sales-management-system | 5.1 (v4.0) | Medium |
| CVE-2026-103587 | QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters | QloApps | 5.1 (v4.0) | Medium |
| CVE-2026-104461 | YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField | yeswiki | 5.1 (v4.0) | Medium |
| CVE-2026-104465 | YesWiki before 4.6.7 Reflected XSS via field Parameter in mail Handler | yeswiki | 5.1 (v4.0) | Medium |
| CVE-2026-104473 | YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages | yeswiki | 5.1 (v4.0) | Medium |
| CVE-2026-105224 | YesWiki before 4.6.7 Stored XSS via Bazar valeur Action | yeswiki | 5.1 (v4.0) | Medium |
| CVE-2026-107799 | Jivejdon through 5.0 Stored XSS via messageListBody.jsp Forum Message Rendering | jivejdon | 5.1 (v4.0) | Medium |
| CVE-2026-109327 | Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.php | admidio | 5.1 (v4.0) | Medium |
| CVE-2026-110101 | Koillection through 1.8.4 Stored XSS via Datum File Attachment Uploads | Koillection | 5.1 (v4.0) | Medium |
| CVE-2026-110625 | ClipBucket v5 through 5.5.3-#206 Reflected XSS via type Parameter in flagged_item.php | clipbucket-v5 | 5.1 (v4.0) | Medium |
| CVE-2026-110626 | ClipBucket v5 through 5.5.3-#206 Reflected XSS via edit_language in language_settings.php | clipbucket-v5 | 5.1 (v4.0) | Medium |
| CVE-2026-113683 | VPL for Moodle before 5.0.0 Reflected XSS via similarity/diff.php filename | moodle-mod vpl | 5.1 (v4.0) | Medium |
| CVE-2026-114407 | e107 CMS before 2.3.13 Reflected XSS via search.php author Parameter | e107 | 5.1 (v4.0) | Medium |
| CVE-2026-116202 | YesWiki before 4.7.0 Stored XSS via ImageField SVG Upload | yeswiki | 5.1 (v4.0) | Medium |
| CVE-2026-11982 | Stored XSS via missing XSS safety check in Admin2 Pages API partial validation | grav-plugin-api | 5.1 (v4.0) | Medium |
| CVE-2026-1630 | Reflected XSS in WEBCON BPS | WEBCON BPS | 5.1 (v4.0) | Medium |
| CVE-2026-22675 | OCS Inventory NG Server Stored XSS via User-Agent | ocs inventory server | 5.1 (v4.0) | Medium |
| CVE-2026-25557 | Evoluted PHP Directory Listing Script 4.0.5 Reflected XSS via dir parameter | PHP Directory Listing Script | 5.1 (v4.0) | Medium |
| CVE-2026-32856 | Ellucian Banner Self-Service Reflected XSS via dateConverter | Banner Self-Service | 5.1 (v4.0) | Medium |
| CVE-2026-3317 | Reflected Cross-Site Scripting in Navigate CMS application | Navigate CMS | 5.1 (v4.0) | Medium |
| CVE-2026-34416 | OSCAL-GUI Reflected XSS via project parameter in oscal.php | OSCAL-GUI | 5.1 (v4.0) | Medium |
| CVE-2026-34417 | OSCAL-GUI Reflected XSS via project parameter in oscal-forms.php | OSCAL-GUI | 5.1 (v4.0) | Medium |
| CVE-2026-34803 | Endian Firewall /manage/qos/classes/ name Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34804 | Endian Firewall /manage/qos/rules/ dscp Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34816 | Endian Firewall /manage/smtpscan/domainrouting/ domain Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34818 | Endian Firewall /manage/dnsmasq/localdomains/ remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34820 | Endian Firewall /manage/ipsec/ remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34822 | Endian Firewall /manage/ca/certificate/ new_cert_name Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34823 | Endian Firewall /manage/password/web/ remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34951 | Reflected XSS in footer.php in Workbench Allows Attackers to Hijack Authenticated Sessions | workbench | 5.1 (v4.0) | Medium |
| CVE-2026-35007 | Open ISES Tickets < 3.44.2 Reflected XSS via single_unit.php id Parameter | tickets | 5.1 (v4.0) | Medium |
| CVE-2026-35008 | Open ISES Tickets < 3.44.2 Reflected XSS via single.php ticket_id Parameter | tickets | 5.1 (v4.0) | Medium |
| CVE-2026-35009 | Open ISES Tickets < 3.44.2 Reflected XSS via add_note.php ticket_id Parameter | tickets | 5.1 (v4.0) | Medium |
| CVE-2026-35010 | Open ISES Tickets < 3.44.2 Reflected XSS via patient_JF.php ticket_id Parameter | tickets | 5.1 (v4.0) | Medium |
| CVE-2026-35011 | Open ISES Tickets < 3.44.2 Reflected XSS via opena.php frm_call Parameter | tickets | 5.1 (v4.0) | Medium |
| CVE-2026-35012 | Open ISES Tickets < 3.44.2 Reflected XSS via add_facnote.php ticket_id Parameter | tickets | 5.1 (v4.0) | Medium |
| CVE-2026-35014 | Open ISES Tickets < 3.44.2 Reflected XSS via routes_nm.php ticket_id Parameter | tickets | 5.1 (v4.0) | Medium |
| CVE-2026-35015 | Open ISES Tickets < 3.44.2 Reflected XSS via do_unit_mail.php the_ticket Parameter | tickets | 5.1 (v4.0) | Medium |
| CVE-2026-40507 | OpenEMR < 8.3.0 Reflected XSS via templateHtml Parameter in Patient Portal | openemr | 5.1 (v4.0) | Medium |
| CVE-2026-40508 | OpenEMR < 8.3.0 Stored XSS via Patient Portal Template Import Handler | openemr | 5.1 (v4.0) | Medium |
| CVE-2026-41929 | Vvveb < 1.0.8.2 Unauthenticated Reflected XSS via Visual Editor | Vvveb | 5.1 (v4.0) | Medium |
| CVE-2026-4316 | Reflected Cross-Site Scripting in software IsMyGym by Zuinq Studio | IsMyGym | 5.1 (v4.0) | Medium |
| CVE-2026-45381 | Tautulli: Reflected XSS in /search endpoint | Tautulli | 5.1 (v4.0) | Medium |
| CVE-2026-45616 | Vvveb: Stored XSS in Posts allows privilege escalation via post editor | Vvveb | 5.1 (v4.0) | Medium |
| CVE-2026-48227 | Open ISES Tickets < 3.44.2 Reflected XSS via patient.php id and ticket_id Parameters | Tickets | 5.1 (v4.0) | Medium |
| CVE-2026-48228 | Open ISES Tickets < 3.44.2 Reflected XSS via patient_w.php id and ticket_id Parameters | Tickets | 5.1 (v4.0) | Medium |
| CVE-2026-48229 | Open ISES Tickets < 3.44.2 Reflected XSS via routes_i.php ticket_id Parameter | Tickets | 5.1 (v4.0) | Medium |
| CVE-2026-48538 | GFI Archiver < 15.13 Stored XSS via ImportSettingsWizard.ashx | GFI Archiver | 5.1 (v4.0) | Medium |
| CVE-2026-48552 | Nagios Core / XI DOM-based XSS via jsonquery.js | Nagios Core | 5.1 (v4.0) | Medium |
| CVE-2026-5010 | Reflected Cross-Site Scripting (XSS) in Sanoma’s Clickedu | Clickedu | 5.1 (v4.0) | Medium |
| CVE-2026-50701 | Frappe Framework 17.0.0-dev - Reflected DOM XSS in dashboard-view breadcrumb rendering | Frappe Framework | 5.1 (v4.0) | Medium |
| CVE-2026-53992 | Reflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date Parameters | ProjectSend | 5.1 (v4.0) | Medium |
| CVE-2026-54386 | marimo < 0.23.9 XSS via file Query Parameter in assets.py | marimo | 5.1 (v4.0) | Medium |
| CVE-2026-57857 | Flow Payment Plugin for WordPress Reflected Cross-Site Scripting via error_message Parameter | Flow Payment | 5.1 (v4.0) | Medium |
| CVE-2026-57958 | Mixpost 2.6.0 - Reflected XSS via OAuth Callback Error Parameter | mixpost | 5.1 (v4.0) | Medium |
| CVE-2026-60092 | AVideo - Stored Cross-Site Scripting via Unescaped User-Agent in Participants Panel | AVideo | 5.1 (v4.0) | Medium |
| CVE-2026-6086 | Stored Cross-Site Scripting in StockAgile by Novadigits technologies | StockAgile | 5.1 (v4.0) | Medium |
| CVE-2026-61504 | Rejetto HFS < 3.2.1 Stored XSS via File Names in Basic Web Listing | hfs | 5.1 (v4.0) | Medium |
| CVE-2026-65697 | Fathom Lite 1.3.1 Stored XSS via /collect Endpoint | fathom | 5.1 (v4.0) | Medium |
| CVE-2026-66296 | Reflected XSS in oaskit's default HTML error handler | oaskit | 5.1 (v4.0) | Medium |
| CVE-2026-67333 | better-auth before 1.6.13 Stored XSS via javascript redirect_uri | better-auth | 5.1 (v4.0) | Medium |
| CVE-2026-71503 | Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template | dolibarr | 5.1 (v4.0) | Medium |
| CVE-2026-73319 | XenForo < 2.3.13 XSS via Dynamic Redirect Handler | xenforo | 5.1 (v4.0) | Medium |
| CVE-2026-75831 | Grav before 2.0.15 Stored XSS via audio/video source URL | grav | 5.1 (v4.0) | Medium |
| CVE-2026-85593 | phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode | phpMyFAQ | 5.1 (v4.0) | Medium |
| CVE-2026-85600 | Grav Admin before 2.0.21 Stored XSS via username | grav-plugin-admin2 | 5.1 (v4.0) | Medium |
| CVE-2026-86197 | Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox | grav | 5.1 (v4.0) | Medium |
| CVE-2026-90567 | quequnlong shiyi-blog Search index.vue highlightKeyword cross site scripting | shiyi-blog | 5.1 (v4.0) | Medium |
| CVE-2026-96535 | Cross-Site Scripting in the YouMind web application | YouMind web application | 5.1 (v4.0) | Medium |
| CVE-2010-1870 | Apache Struts Remote Command Execution | struts | 5.0 (v2.0) | Medium |
| CVE-2026-43979 | Local Deep Research: HTML Injection via Unescaped User Input in PDF Export (pdf_service.py:_markdown_to_html) | local-deep-research | 5.0 (v3.1) | Medium |
| CVE-2024-3822 | Base64 Encoder/Decoder <= 0.9.2 - Reflected XSS | base64 encoderdecoder | 4.8 (v3.1) | Medium |
| CVE-2025-15669 | Bit Form < 3.1.4 - Admin+ Stored XSS via Conversational Form Progress Label | Bit Form | 4.8 (v3.1) | Medium |
| CVE-2025-40648 | Stored Cross-Site Scripting (XSS) vulnerability in Issabel products | Issabel | 4.8 (v4.0) | Medium |
| CVE-2025-43817 | digital experience platform Cross-Site Scripting Vulnerability | digital experience platform | 4.8 (v4.0) | Medium |
| CVE-2025-62248 | digital experience platform Cross-Site Scripting Vulnerability | digital experience platform | 4.8 (v4.0) | Medium |
| CVE-2025-9823 | Reflected XSS in lead:addLeadTags - Quick Add | Mautic | 4.8 (v4.0) | Medium |
| CVE-2026-100376 | TemplateSandbox can be abused for XSS by asking another user to preview a page with a certain sandbox prefix | Mediawiki - TemplateSandbox Extension | 4.8 (v4.0) | Medium |
| CVE-2026-111232 | Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color | pfsense | 4.8 (v4.0) | Medium |
| CVE-2026-14203 | Smart Manager < 8.92.0 - Contributor+ Stored XSS via Post Title | Smart Manager | 4.8 (v3.1) | Medium |
| CVE-2026-15233 | Nested Pages < 3.2.15 - Editor+ Stored XSS via Post Title | Nested Pages | 4.8 (v3.1) | Medium |
| CVE-2026-34096 | Guardian Language-System XSS via name Parameter in designer.php | language-system | 4.8 (v4.0) | Medium |
| CVE-2026-34097 | Guardian Language-System XSS via id Parameter in text_file.php | language-system | 4.8 (v4.0) | Medium |
| CVE-2026-34098 | Guardian Language-System XSS via id Parameter in media.php | language-system | 4.8 (v4.0) | Medium |
| CVE-2026-46516 | Frogman vulnerable to stored XSS in chat console formatter (escalation vector in multi-admin deployments) | frogman | 4.8 (v4.0) | Medium |
| CVE-2026-59659 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium |
| CVE-2026-59660 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium |
| CVE-2026-59661 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium |
| CVE-2026-59662 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium |
| CVE-2026-59663 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium |
| CVE-2026-59664 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium |
| CVE-2026-59665 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium |
| CVE-2026-59666 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium |
| CVE-2026-59667 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium |
| CVE-2026-59668 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium |
| CVE-2026-59669 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium |
| CVE-2026-59670 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium |
| CVE-2026-59672 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium |
| CVE-2026-59673 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium |
| CVE-2026-63001 | REDAXO: Stored XSS via Unescaped Media Manager Type Name in mediaIsInUse() | redaxo | 4.8 (v3.1) | Medium |
| CVE-2026-67612 | OpenEMR 8.2.0 Stored XSS via import_template.php Template Management | openemr | 4.8 (v4.0) | Medium |
| CVE-2026-67617 | Microweber CMS 2.0.20 Stored XSS via tag_names Parameter | microweber | 4.8 (v4.0) | Medium |
| CVE-2026-7171 | Stored Cross-Site Scripting (XSS) in TPVEnlanube | Cloud Web application | 4.8 (v4.0) | Medium |
| CVE-2026-7172 | Stored Cross-Site Scripting (XSS) in TPVEnlanube | Cloud Web application | 4.8 (v4.0) | Medium |
| CVE-2026-84188 | librenms before 26.7.0 Stored XSS via graph_descr settings | librenms | 4.8 (v4.0) | Medium |
| CVE-2026-90569 | linlinjava litemall Admin Topic index.vue AdminTopicController.validate cross site scripting | litemall | 4.8 (v4.0) | Medium |
| CVE-2026-90570 | linlinjava litemall Product Detail index.vue AdminGoodsService.validate cross site scripting | litemall | 4.8 (v4.0) | Medium |
| CVE-2026-95662 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium |
| CVE-2026-9577 | Post Status Notifier Lite < 1.13.0 - Reflected XSS via mod Parameter | Post Status Notifier Lite | 4.8 (v3.1) | Medium |
| CVE-2026-3093 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab | gitlab | 4.7 (v3.1) | Medium |
| CVE-2026-4406 | Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' Parameter | Gravity Forms | 4.7 (v3.1) | Medium |
| CVE-2011-4642 | Splunk Search Remote Code Execution | splunk | 4.6 (v2.0) | Medium |
| CVE-2026-50698 | Frappe Framework 17.0.0-dev - Stored XSS in Audit Trail template rendering | Frappe Framework | 4.6 (v4.0) | Medium |
| CVE-2026-32250 | NamelessMC has Reflected Cross-Site Scripting (XSS) in id parameter of /index.php?route=/queries/user/ | Nameless | 4.3 (v3.1) | Medium |
| CVE-2026-55566 | Yamcs: DOM XSS in Extension Routing | yamcs | 4.3 (v3.1) | Medium |
| CVE-2026-102576 | Quay: quay: dom-based cross-site scripting via unvalidated redirect_url on signin page | Red Hat Quay 3 | 4.2 (v3.1) | Medium |
| CVE-2026-113657 | ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS) | apostrophe | 3.7 (v3.1) | Low |
| CVE-2025-66040 | Spotipy has a XSS vulnerability in OAuth callback server | spotipy | 3.6 (v3.1) | Low |
| CVE-2026-9061 | Agile Store Locator < 1.6.9 - Admin+ Stored XSS via logo_name | Store Locator WordPress | 3.5 (v3.1) | Low |
| CVE-2026-91165 | Warpgate: Markup injection in SSO form_post return page via unencoded redirect/error values | warpgate | 2.4 (v3.1) | Low |
| CVE-2026-42794 | Reflected XSS via backslash bypass in GraphiQL js_escape in absinthe_plug | absinthe.plug | 2.3 (v4.0) | Low |
| CVE-2026-66300 | SNOMED International Snowstorm reflected XSS | Snowstorm | 2.3 (v4.0) | Low |
| CVE-2025-10063 | itsourcecode POS Point of Sale System deferred_table.php cross site scripting | point of sale system | 2.1 (v4.0) | Low |
| CVE-2025-10067 | itsourcecode POS Point of Sale System empty_table.php cross site scripting | point of sale system | 2.1 (v4.0) | Low |
| CVE-2025-10590 | Portabilis i-Educar educar_usuario_det.php cross site scripting | i-educar | 2.1 (v4.0) | Low |
| CVE-2025-10614 | itsourcecode E-Logbook with Health Monitoring System for COVID-19 print_reports_prev.php cross site scripting | e-logbook with health monitoring system for covid-19 | 2.1 (v4.0) | Low |
| CVE-2025-10710 | 07FLYCMS/07FLY-CMS/07FlyCRM index.php cross site scripting | 07FLYCMS | 2.1 (v4.0) | Low |
| CVE-2025-10711 | 07FLYCMS/07FLY-CMS/07FlyCRM Login cross site scripting | 07FLYCMS | 2.1 (v4.0) | Low |
| CVE-2025-10827 | PHPJabbers Restaurant Menu Maker preview.php cross site scripting | restaurant menu maker | 2.1 (v4.0) | Low |
| CVE-2025-11112 | PHPGurukul Employee Record Management System myprofile.php cross site scripting | employee record management system | 2.1 (v4.0) | Low |
| CVE-2025-11306 | qianfox FoxCMS Search cross site scripting | foxcms | 2.1 (v4.0) | Low |
| CVE-2025-12244 | code-projects Simple E-Banking System register.php cross site scripting | simple e-banking system | 2.1 (v4.0) | Low |
| CVE-2025-12289 | Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 1001 cross site scripting | Suishang Enterprise-Level B2B2C Multi-User Mall System | 2.1 (v4.0) | Low |
| CVE-2025-12290 | Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 359 cross site scripting | Suishang Enterprise-Level B2B2C Multi-User Mall System | 2.1 (v4.0) | Low |
| CVE-2025-15093 | sunkaifei FlyCMS Admin Login IndexAdminController.java cross site scripting | flycms | 2.1 (v4.0) | Low |
| CVE-2025-15094 | sunkaifei FlyCMS User Login UserController.java userLogin cross site scripting | flycms | 2.1 (v4.0) | Low |
| CVE-2025-15144 | dayrui XunRuiCMS JSONP Callback Init.php dr_exit_msg cross site scripting | xunruicms | 2.1 (v4.0) | Low |
| CVE-2025-15220 | SohuTV CacheCloud LoginController.java init cross site scripting | cachecloud | 2.1 (v4.0) | Low |
| CVE-2025-9647 | mtons mblog list cross site scripting | mblog | 2.1 (v4.0) | Low |
| CVE-2025-9755 | Khanakag-17 Library Management System index.php cross site scripting | library management system | 2.1 (v4.0) | Low |
| CVE-2025-9773 | RemoteClinic edit.php cross site scripting | remote clinic | 2.1 (v4.0) | Low |
| CVE-2026-0586 | code-projects Online Product Reservation System prod.php cross site scripting | online product reservation system | 2.1 (v4.0) | Low |
| CVE-2026-100313 | mathurvishal CloudClassroom-PHP-Project updatequery.php cross site scripting | CloudClassroom-PHP-Project | 2.1 (v4.0) | Low |
| CVE-2026-10153 | westboy CicadasCMS AbstractCacheManager.java search cross site scripting | CicadasCMS | 2.1 (v4.0) | Low |
| CVE-2026-10173 | Orthanc Explorer 2 URL StudyList.vue cross site scripting | Explorer 2 | 2.1 (v4.0) | Low |
| CVE-2026-10301 | itsourcecode Fees Management System index.php cross site scripting | Fees Management System | 2.1 (v4.0) | Low |
| CVE-2026-105288 | feelec-yishu feelcrm-os Crm Endpoint functions.php index cross site scripting | feelcrm-os | 2.1 (v4.0) | Low |
| CVE-2026-105291 | feelec-yishu feelcrm-os Department Search Endpoint GroupController.class.php index cross site scripting | feelcrm-os | 2.1 (v4.0) | Low |
| CVE-2026-105809 | SourceCodester Simple Student Information System Profile Field register.php cross site scripting | Simple Student Information System | 2.1 (v4.0) | Low |
| CVE-2026-10810 | itsourcecode Fees Management System navbar.php cross site scripting | Fees Management System | 2.1 (v4.0) | Low |
| CVE-2026-111877 | dext34-morgan Books4Cash search.php cross site scripting | Books4Cash | 2.1 (v4.0) | Low |
| CVE-2026-111942 | hrisikeshpal Blood_Bank_Management_System abs.php cross site scripting | Blood Bank Management System | 2.1 (v4.0) | Low |
| CVE-2026-11337 | tittuvarghese CollegeManagementSystem fetch.php cross site scripting | CollegeManagementSystem | 2.1 (v4.0) | Low |
| CVE-2026-113741 | itsourcecode Online Cake Ordering System 404.php cross site scripting | Online Cake Ordering System | 2.1 (v4.0) | Low |
| CVE-2026-11436 | Mage AI Sign-in Flow index.tsx useMutation cross site scripting | Mage AI | 2.1 (v4.0) | Low |
| CVE-2026-11512 | itsourcecode Hospital Management System billing.php cross site scripting | Hospital Management System | 2.1 (v4.0) | Low |
| CVE-2026-13554 | itsourcecode Online Hotel Management System POST Request controller.php add cross site scripting | Online Hotel Management System | 2.1 (v4.0) | Low |
| CVE-2026-13556 | itsourcecode Online Hotel Management System POST Request controller.php edit cross site scripting | Online Hotel Management System | 2.1 (v4.0) | Low |
| CVE-2026-13557 | itsourcecode Online Hotel Management System POST Request controller.php add cross site scripting | Online Hotel Management System | 2.1 (v4.0) | Low |
| CVE-2026-14656 | code-projects Assessment Management remove-user.php cross site scripting | Assessment Management | 2.1 (v4.0) | Low |
| CVE-2026-14704 | stephen-kruger bluebox cross site scripting | bluebox | 2.1 (v4.0) | Low |
| CVE-2026-15595 | SourceCodester Class and Exam Timetabling System forsubject.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low |
| CVE-2026-15596 | SourceCodester Class and Exam Timetabling System subject.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low |
| CVE-2026-15715 | SourceCodester Class and Exam Timetabling System exam.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low |
| CVE-2026-16220 | code-projects Online Examination System account.php cross site scripting | Online Examination System | 2.1 (v4.0) | Low |
| CVE-2026-16229 | itsourcecode Courier Management System index.php cross site scripting | Courier Management System | 2.1 (v4.0) | Low |
| CVE-2026-16485 | SourceCodester Class and Exam Timetabling System class.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low |
| CVE-2026-16486 | SourceCodester Class and Exam Timetabling System BSIS.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low |
| CVE-2026-18968 | ttttonyhe OBlog tags.php cross site scripting | OBlog | 2.1 (v4.0) | Low |
| CVE-2026-5255 | code-projects Simple Laundry System Parameter delstaffinfo.php cross site scripting | simple laundry system | 2.1 (v4.0) | Low |
| CVE-2026-5319 | itsourcecode Payroll Management System navbar.php cross site scripting | Payroll Management System | 2.1 (v4.0) | Low |
| CVE-2026-5825 | code-projects Simple Laundry System delmemberinfo.php cross site scripting | Simple Laundry System | 2.1 (v4.0) | Low |
| CVE-2026-5826 | code-projects Simple IT Discussion Forum edit-category.php cross site scripting | Simple IT Discussion Forum | 2.1 (v4.0) | Low |
| CVE-2026-6032 | code-projects Simple Laundry System checkcheckout.php cross site scripting | Simple Laundry System | 2.1 (v4.0) | Low |
| CVE-2026-6035 | code-projects Vehicle Showroom Management System ServiceAndSalesReport.php cross site scripting | Vehicle Showroom Management System | 2.1 (v4.0) | Low |
| CVE-2026-6150 | code-projects Simple Laundry System checkupdatestatus.php cross site scripting | Simple Laundry System | 2.1 (v4.0) | Low |
| CVE-2026-6159 | code-projects Simple ChatBox Endpoint insert.php cross site scripting | Simple ChatBox | 2.1 (v4.0) | Low |
| CVE-2026-66882 | Reflected XSS in AshAuthentication confirmation and magic link interaction forms | ash authentication | 2.1 (v4.0) | Low |
| CVE-2026-7116 | code-projects Employee Management System mark.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low |
| CVE-2026-7129 | SourceCodester Pharmacy Sales and Inventory System index.php cross site scripting | Pharmacy Sales and Inventory System | 2.1 (v4.0) | Low |
| CVE-2026-75077 | SourceCodester Class and Exam Timetabling System BSCE2.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low |
| CVE-2026-75078 | SourceCodester Class and Exam Timetabling System BSHRM1.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low |
| CVE-2026-78054 | SourceCodester Class and Exam Timetabling System BSIS1.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low |
| CVE-2026-78055 | SourceCodester Class and Exam Timetabling System BSIT2.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low |
| CVE-2026-79793 | code-projects Online Shopping System sumit_form.php cross site scripting | Online Shopping System | 2.1 (v4.0) | Low |
| CVE-2026-82601 | SeaCMS err.php cross site scripting | SeaCMS | 2.1 (v4.0) | Low |
| CVE-2026-82664 | yaojingang GEOFlow JSON-LD Theme HomeController.php cross site scripting | GEOFlow | 2.1 (v4.0) | Low |
| CVE-2026-85021 | langgenius dify Splash Layout splash.tsx router.replace cross site scripting | dify | 2.1 (v4.0) | Low |
| CVE-2026-86216 | code-projects Hotel and Tourism Reservation in PHP details.php cross site scripting | Hotel and Tourism Reservation in PHP | 2.1 (v4.0) | Low |
| CVE-2026-86278 | SourceCodester Syllabus-Aligned Learning Management & Examination System manage_subjects.php cross site scripting | Syllabus-Aligned Learning Management & Examination System | 2.1 (v4.0) | Low |
| CVE-2026-87926 | Rizwan17 inventory-management-system Login Page index.php cross site scripting | inventory-management-system | 2.1 (v4.0) | Low |
| CVE-2026-90615 | SourceCodester Class and Exam Timetabling System subject1.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low |
| CVE-2026-90795 | itsourcecode Loan Management System navbar.php cross site scripting | Loan Management System | 2.1 (v4.0) | Low |
| CVE-2026-9415 | code-projects Employee Management System eloginwel.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low |
| CVE-2026-9416 | code-projects Employee Management System myprofile.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low |
| CVE-2026-9417 | code-projects Employee Management System myprofileup.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low |
| CVE-2026-9418 | code-projects Employee Management System changepassemp.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low |
| CVE-2026-9419 | code-projects Employee Management System empproject.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low |
| CVE-2026-9448 | code-projects Employee Management System applyleave.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low |
| CVE-2026-9519 | stonith404 pingvin-share Sign-in Auto-Redirect signIn.tsx getServerSideProps cross site scripting | pingvin-share | 2.1 (v4.0) | Low |
| CVE-2026-9520 | blitz-js blitz Sign-in LoginForm.tsx cross site scripting | blitz | 2.1 (v4.0) | Low |
| CVE-2026-9527 | itsourcecode Electronic Judging System judges.php cross site scripting | Electronic Judging System | 2.1 (v4.0) | Low |
| CVE-2026-9566 | teableio teable Sign-up LoginPage.tsx cross site scripting | teable | 2.1 (v4.0) | Low |
| CVE-2025-10591 | Portabilis i-Educar Editar Função educar_funcao_cad.php cross site scripting | i-educar | 2.0 (v4.0) | Low |
| CVE-2025-10837 | code-projects Simple Food Ordering System order.php cross site scripting | simple food ordering system | 2.0 (v4.0) | Low |
| CVE-2025-11332 | CmsEasy URL view.php cross site scripting | cmseasy | 2.0 (v4.0) | Low |
| CVE-2025-11433 | itsourcecode Leave Management System Query Parameter controller.php redirect cross site scripting | leave management system | 2.0 (v4.0) | Low |
| CVE-2025-12224 | Iqbolshoh php-business-website contact.php cross site scripting | php-business-website | 2.0 (v4.0) | Low |
| CVE-2025-13343 | SourceCodester Interview Management System editQuestion.php cross site scripting | interview management system | 2.0 (v4.0) | Low |
| CVE-2025-13450 | SourceCodester Online Shop Project register.php cross site scripting | online shop project | 2.0 (v4.0) | Low |
| CVE-2025-14006 | dayrui XunRuiCMS Add Data Validation admind45f74adbd95.php cross site scripting | xunruicms | 2.0 (v4.0) | Low |
| CVE-2025-14194 | code-projects Employee Profile Management System view_personnel.php cross site scripting | employee profile management system | 2.0 (v4.0) | Low |
| CVE-2025-15172 | SohuTV CacheCloud RedisConfigTemplateController.java preview cross site scripting | cachecloud | 2.0 (v4.0) | Low |
| CVE-2025-15173 | SohuTV CacheCloud InstanceController.java advancedAnalysis cross site scripting | cachecloud | 2.0 (v4.0) | Low |
| CVE-2025-62653 | Stored XSS through system messages in PollNY | MediaWiki PollNY extension | 2.0 (v4.0) | Low |
| CVE-2025-7871 | Portabilis i-Diario conteudos cross site scripting | i-diario | 2.0 (v4.0) | Low |
| CVE-2025-9657 | O2OA Personal Profile script cross site scripting | o2oa | 2.0 (v4.0) | Low |
| CVE-2025-9658 | O2OA Personal Profile dict cross site scripting | o2oa | 2.0 (v4.0) | Low |
| CVE-2025-9659 | O2OA Personal Profile widget cross site scripting | o2oa | 2.0 (v4.0) | Low |
| CVE-2025-9680 | O2OA Personal Profile page cross site scripting | o2oa | 2.0 (v4.0) | Low |
| CVE-2025-9681 | O2OA Personal Profile agent cross site scripting | o2oa | 2.0 (v4.0) | Low |
| CVE-2025-9682 | O2OA Personal Profile appdict cross site scripting | o2oa | 2.0 (v4.0) | Low |
| CVE-2025-9683 | O2OA Personal Profile form cross site scripting | o2oa | 2.0 (v4.0) | Low |
| CVE-2025-9715 | O2OA Personal Profile script cross site scripting | o2oa | 2.0 (v4.0) | Low |
| CVE-2025-9716 | O2OA Personal Profile form cross site scripting | o2oa | 2.0 (v4.0) | Low |
| CVE-2025-9717 | O2OA Personal Profile unit cross site scripting | o2oa | 2.0 (v4.0) | Low |
| CVE-2025-9718 | O2OA Personal Profile process cross site scripting | o2oa | 2.0 (v4.0) | Low |
| CVE-2025-9719 | O2OA Personal Profile script cross site scripting | o2oa | 2.0 (v4.0) | Low |
| CVE-2025-9734 | O2OA Personal Profile stat cross site scripting | o2oa | 2.0 (v4.0) | Low |
| CVE-2025-9735 | O2OA Personal Profile table cross site scripting | o2oa | 2.0 (v4.0) | Low |
| CVE-2025-9737 | O2OA Personal Profile importmodel cross site scripting | o2oa | 2.0 (v4.0) | Low |
| CVE-2026-0588 | Xinhu Rainrock RockOA API rockfun.php cross site scripting | rockoa | 2.0 (v4.0) | Low |
| CVE-2026-101141 | Eleveo Call Recording Software Play Audio audio.jsp cross site scripting | Call Recording Software | 2.0 (v4.0) | Low |
| CVE-2026-102264 | mwasikz robo-cafe-rms Edit Profile Feature update-account.php cross site scripting | robo-cafe-rms | 2.0 (v4.0) | Low |
| CVE-2026-10234 | Mettle sendportal Campaign webview cross site scripting | sendportal | 2.0 (v4.0) | Low |
| CVE-2026-10244 | SourceCodester Pharmacy Sales and Inventory System main create_medicine_name cross site scripting | Pharmacy Sales and Inventory System | 2.0 (v4.0) | Low |
| CVE-2026-10245 | SourceCodester Pharmacy Sales and Inventory System main create_supplier cross site scripting | Pharmacy Sales and Inventory System | 2.0 (v4.0) | Low |
| CVE-2026-10246 | SourceCodester Pharmacy Sales and Inventory System main create_medicine_presentation cross site scripting | Pharmacy Sales and Inventory System | 2.0 (v4.0) | Low |
| CVE-2026-10247 | SourceCodester Pharmacy Sales and Inventory System main create_generic_name cross site scripting | Pharmacy Sales and Inventory System | 2.0 (v4.0) | Low |
| CVE-2026-105808 | SourceCodester Simple Student Information System searchresults.php clean cross site scripting | Simple Student Information System | 2.0 (v4.0) | Low |
| CVE-2026-116639 | MD-MAFUJUL-HASAN Online-Payroll-Management-System chat.php cross site scripting | Online-Payroll-Management-System | 2.0 (v4.0) | Low |
| CVE-2026-116640 | Saruf-Ratul HR-Payroll-Management-System chat.php cross site scripting | HR-Payroll-Management-System | 2.0 (v4.0) | Low |
| CVE-2026-15678 | code-projects Online Job Portal DetailJob.php cross site scripting | Online Job Portal | 2.0 (v4.0) | Low |
| CVE-2026-16155 | SourceCodester Class and Exam Timetabling System schoolyr.php cross site scripting | Class and Exam Timetabling System | 2.0 (v4.0) | Low |
| CVE-2026-16156 | SourceCodester Class and Exam Timetabling System forexam.php cross site scripting | Class and Exam Timetabling System | 2.0 (v4.0) | Low |
| CVE-2026-16202 | SourceCodester Class and Exam Timetabling System CYS.php cross site scripting | Class and Exam Timetabling System | 2.0 (v4.0) | Low |
| CVE-2026-16203 | SourceCodester Class and Exam Timetabling System forCYS.php cross site scripting | Class and Exam Timetabling System | 2.0 (v4.0) | Low |
| CVE-2026-5810 | SourceCodester Sales and Inventory System GET Parameter delete.php cross site scripting | Sales and Inventory System | 2.0 (v4.0) | Low |
| CVE-2026-6162 | PHPGurukul Company Visitor Management System bwdates-reports-details.php cross site scripting | Company Visitor Management System | 2.0 (v4.0) | Low |
| CVE-2026-6493 | lukevella rallly Reset Password reset-password-form.tsx cross site scripting | rallly | 2.0 (v4.0) | Low |
| CVE-2026-7390 | SourceCodester Pharmacy Sales and Inventory System index.php customer cross site scripting | Pharmacy Sales and Inventory System | 2.0 (v4.0) | Low |
| CVE-2026-82665 | yaojingang GEOFlow Image Library Cleanup ImageLibraryController.php unlink path traversal | GEOFlow | 2.0 (v4.0) | Low |
| CVE-2026-82666 | yaojingang GEOFlow Superadmin Theme Editor SiteThemeEditorController.php preview code injection | GEOFlow | 2.0 (v4.0) | Low |
| CVE-2026-82667 | yaojingang GEOFlow GenericHttpEndpointResolver.php DistributionController.isValidHttpEndpoint server-side request forger | GEOFlow | 2.0 (v4.0) | Low |
| CVE-2026-84438 | OpenCart Autocomplete Workflow edit.php cross site scripting | OpenCart | 2.0 (v4.0) | Low |
| CVE-2026-85022 | langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting | dify | 2.0 (v4.0) | Low |
| CVE-2026-86301 | code-projects Hospital Information System Patient Management editPatient.php cross site scripting | Hospital Information System | 2.0 (v4.0) | Low |
| CVE-2026-90695 | SourceCodester Inventory Management System Vendor Management vendors_handler.php cross site scripting | Inventory Management System | 2.0 (v4.0) | Low |
| CVE-2026-90696 | SourceCodester Inventory Management System Product Management products_handler.php cross site scripting | Inventory Management System | 2.0 (v4.0) | Low |
| CVE-2026-93956 | olivier-ls PHP-FTS Search SearchEngine.php buildHighlights cross site scripting | PHP-FTS | 2.0 (v4.0) | Low |
| CVE-2025-10099 | Portabilis i-Educar Editar usuário educar_usuario_cad.php cross site scripting | i-educar | 1.9 (v4.0) | Low |
| CVE-2025-10234 | Scada-LTS Data Point Edit data_point_edit.shtm cross site scripting | scada-lts | 1.9 (v4.0) | Low |
| CVE-2025-10235 | Scada-LTS Reports reports.shtm cross site scripting | scada-lts | 1.9 (v4.0) | Low |
| CVE-2025-10940 | Total.js CMS Layout admin layouts_save cross site scripting | total.js | 1.9 (v4.0) | Low |
| CVE-2025-11027 | givanz Vvveb SVG File cross site scripting | vvveb | 1.9 (v4.0) | Low |
| CVE-2025-11289 | westboy CicadasCMS Template Management TemplateFileServiceImpl.java save cross site scripting | cicadascms | 1.9 (v4.0) | Low |
| CVE-2025-12311 | PHPGurukul Curfew e-Pass Management System edit-category-detail.php cross site scripting | curfew e-pass management system | 1.9 (v4.0) | Low |
| CVE-2025-12312 | PHPGurukul Curfew e-Pass Management System view-pass-detail.php cross site scripting | curfew e-pass management system | 1.9 (v4.0) | Low |
| CVE-2025-13186 | Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution manage_customer cross site scripting | isshue | 1.9 (v4.0) | Low |
| CVE-2025-13412 | Campcodes Retro Basketball Shoes Online Store admin_running.php cross site scripting | retro basketball shoes online store | 1.9 (v4.0) | Low |
| CVE-2025-14991 | Campcodes Complete Online Beauty Parlor Management System bwdates-reports-details.php cross site scripting | complete online beauty parlor management system | 1.9 (v4.0) | Low |
| CVE-2025-15188 | Campcodes Complete Online Beauty Parlor Management System search-invoices.php cross site scripting | online beauty parlor management system | 1.9 (v4.0) | Low |
| CVE-2026-0642 | projectworlds House Rental and Property Listing complaint.php cross site scripting | house rental and property listing project | 1.9 (v4.0) | Low |
| CVE-2026-112039 | diem-project diem Administrative Console actions.class.php append cross site scripting | diem | 1.9 (v4.0) | Low |
| CVE-2026-11434 | FluentCMS Blocks Plugin blocks cross site scripting | FluentCMS | 1.9 (v4.0) | Low |
| CVE-2026-11468 | SourceCodester Hospitals Patient Records Management System page room_types cross site scripting | Hospitals Patient Records Management System | 1.9 (v4.0) | Low |
| CVE-2026-115981 | phpIPAM index.php cross site scripting | phpIPAM | 1.9 (v4.0) | Low |
| CVE-2026-5647 | code-projects Online Shoe Store Add Product admin_feature.php cross site scripting | Online Shoe Store | 1.9 (v4.0) | Low |
| CVE-2026-5834 | code-projects Online Shoe Store admin_running.php cross site scripting | Online Shoe Store | 1.9 (v4.0) | Low |
| CVE-2026-5835 | code-projects Online Shoe Store admin_football.php cross site scripting | Online Shoe Store | 1.9 (v4.0) | Low |
| CVE-2026-5836 | code-projects Online Shoe Store admin_product.php cross site scripting | Online Shoe Store | 1.9 (v4.0) | Low |
| CVE-2026-7269 | SourceCodester Pharmacy Sales and Inventory System index.php cross site scripting | Pharmacy Sales and Inventory System | 1.9 (v4.0) | Low |
| CVE-2026-7281 | SourceCodester Pharmacy Sales and Inventory System index.php supplier cross site scripting | Pharmacy Sales and Inventory System | 1.9 (v4.0) | Low |
| CVE-2026-8136 | SourceCodester Pharmacy Sales and Inventory System index.php users cross site scripting | Pharmacy Sales and Inventory System | 1.9 (v4.0) | Low |
| CVE-2026-90850 | PHPGurukul Hostel Management System manage-students.php cross site scripting | Hostel Management System | 1.9 (v4.0) | Low |
| CVE-2026-94150 | Omega Solution HRM OS SVG File Upload view cross site scripting | HRM OS | 1.9 (v4.0) | Low |
| CVE-2026-9564 | SourceCodester/oretnom23 Hospitals Patient Records Management System view_patient cross site scripting | Hospitals Patient Records Management System | 1.9 (v4.0) | Low |
| CVE-2025-15454 | zhanglun lettura RSS ContentRender.tsx cross site scripting | lettura | 1.3 (v4.0) | Low |
| CVE-2026-78187 | Piwigo Public Authentication cross site scripting | Piwigo | 1.3 (v4.0) | Low |
| CVE-2025-14007 | dayrui XunRuiCMS Domain Name Binding admin79f2ec220c7e.php cross site scripting | xunruicms | 1.1 (v4.0) | Low |
| CVE-2025-0655 | D-Tale RCE | - | N/A | N/A |
Observed CWEs
These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.