On this page

Atomicorp WAF Rule 340099

Rule Summary

Rule ID: 340099
Status: Active
Alert message: Atomicorp.com WAF Rules: cross site scripting attempt
Observed CWEs: CWE-20 (2), CWE-22 (2), CWE-73 (1), CWE-74 (1), CWE-79 (716), CWE-80 (7), CWE-83 (2), CWE-87 (2), CWE-89 (2), CWE-94 (166), CWE-113 (1), CWE-116 (6), CWE-352 (3), CWE-384 (1), CWE-436 (1), CWE-444 (1), CWE-601 (5), CWE-610 (1), CWE-749 (1), CWE-798 (1), CWE-918 (1), CWE-1188 (1), CWE-1321 (2), CWE-1336 (1)
Revision: 4
Rule severity: Critical (2)
Phase: 2 (request body)
Request surfaces: Request URI, Request headers
Rule action: deny
HTTP status: 403
Logging: log, auditlog

Description

This rule detects behavior identified by its current alert as “cross site scripting attempt” in the request URI, request headers. It evaluates during the request body phase and denies matching traffic with HTTP status 403.

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

CVE	Vulnerability	Product	CVSS	Severity
CVE-2026-54067	SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()	siyuan	9.9 (v3.1)	Critical
CVE-2015-4664	Xceedium Xsuite - Multiple Vulnerabilities	privileged access manager	9.8 (v3.0)	Critical
CVE-2015-4667	Xceedium Xsuite - Multiple Vulnerabilities	xsuite	9.8 (v3.0)	Critical
CVE-2026-104252	Vitess vttablet /twopcz reflected XSS	vitess	9.8 (v3.1)	Critical
CVE-2026-18516	Improper Encoding or Escaping of Output in Crafty Controller	Crafty Controller	9.6 (v3.1)	Critical
CVE-2026-47428	Vitest browser mode serves unsanitized otelCarrier query parameter as inline script	vitest	9.6 (v3.1)	Critical
CVE-2026-53662	immich: One-click account takeover via XSS in login page continue redirect	immich	9.6 (v3.1)	Critical
CVE-2026-55085	Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite	etherpad	9.6 (v3.1)	Critical
CVE-2024-58355	Cal.com through 4.7.15 Cross-Site Scripting via booking questions	cal.diy	9.3 (v4.0)	Critical
CVE-2026-102989	TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses	router	9.3 (v3.1)	Critical
CVE-2026-105089	WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templates	AVideo	9.3 (v4.0)	Critical
CVE-2026-42849	authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover	authentik	9.3 (v3.1)	Critical
CVE-2026-45118	MyBB: Contact page reflected XSS	mybb	9.3 (v3.1)	Critical
CVE-2026-54527	JupyterLab Git: Stored XSS leading to RCE	jupyterlab-git	9.3 (v4.0)	Critical
CVE-2026-55486	Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS	goobi-viewer-core	9.3 (v3.1)	Critical
CVE-2026-57858	Cal.com Cal.diy 6.2.0 Stored XSS via BookingPageTagManager Analytics Tracking ID	Cal.com Self-Hosted (Cal.diy)	9.3 (v4.0)	Critical
CVE-2026-58491	Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter	warpgate	9.3 (v3.1)	Critical
CVE-2026-66394	SiYuan before v3.7.3 Stored and Reflected XSS via SVG Sanitizer Bypass	siyuan	9.3 (v4.0)	Critical
CVE-2026-78997	UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314) Cross-Site Scripting Vulnerability	UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314)	9.3 (v3.1)	Critical
CVE-2026-88869	AVideo AD_Server Stored XSS via log.php label parameter	AVideo	9.3 (v4.0)	Critical
CVE-2026-89255	AVideo LoginControl Stored XSS via PGP Public Key	AVideo	9.3 (v4.0)	Critical
CVE-2026-89243	WWBN AVideo Stored XSS via UserGroups setGroup_name	AVideo	9.2 (v4.0)	Critical
CVE-2026-34448	SiYuan: Stored XSS in Attribute View gallery/kanban cover rendering allows arbitrary command execution in the desktop cl	siyuan	9.0 (v3.1)	Critical
CVE-2026-42556	Postiz stored XSS in public preview page	postiz	9.0 (v3.1)	Critical
CVE-2026-62378	RustFS Console: Critical Stored XSS in Preview Modal leading to Administrative Account Takeover	console	9.0 (v3.1)	Critical
CVE-2026-43984	Tautulli has stored XSS in logFile via guest-controlled log_js_errors input	Tautulli	8.9 (v3.1)	High
CVE-2021-20086	Odoo Apps - Cross-Site Scripting via Prototype Pollution	jquery-bbq	8.8 (v3.1)	High
CVE-2025-56798	Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier Cross-Site Request Forgery Vulnerability	Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier	8.8 (v3.1)	High
CVE-2026-42455	LinkWarden: Stored XSS via Client-Side Archive Upload (Unsanitized HTML served from same origin)	linkwarden	8.8 (v4.0)	High
CVE-2026-70650	GetSimple CMS: Authenticated Stored XSS in backup viewer (backup-edit.php) via output decoding of page meta fields and c	GetSimpleCMS-CE	8.8 (v4.0)	High
CVE-2026-12496	Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server	LIP-ME20xC	8.7 (v4.0)	High
CVE-2026-13323	open vsx Cross-site Scripting Vulnerability	open vsx	8.7 (v3.1)	High
CVE-2026-44667	Faction: Stored XSS in Remediation Verification Attachment Filename Preview Rendering	faction	8.7 (v3.1)	High
CVE-2026-44729	Twenty: Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers)	twenty	8.7 (v3.1)	High
CVE-2026-45115	MyBB: Buddy/ignore list username XSS	mybb	8.7 (v3.1)	High
CVE-2026-45116	MyBB: Profile field type confusion XSS	mybb	8.7 (v3.1)	High
CVE-2026-48026	lakeFS vulnerable to stored XSS in rendered markdown previews via raw HTML	lakeFS	8.7 (v3.1)	High
CVE-2026-48527	HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint	haxcms-nodejs	8.7 (v3.1)	High
CVE-2026-54347	Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover	froxlor	8.7 (v3.1)	High
CVE-2026-84683	Automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job st	Red Hat Ansible Automation Platform 2.5 for RHEL 8	8.7 (v3.1)	High
CVE-2026-103904	Stored XSS Vulnerability in JTL-Shop	JTL-Shop	8.6 (v4.0)	High
CVE-2026-34463	MantisBT has Stored HTML Injection/XSS via Clone Issue Form	mantisbt	8.6 (v4.0)	High
CVE-2026-49864	wetty vulnerable to DOM XSS via file-download filename	wetty	8.6 (v4.0)	High
CVE-2026-67328	@better-auth/sso before 1.6.21 Account Takeover via SSO	sso	8.6 (v4.0)	High
CVE-2026-92985	SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels	siyuan	8.6 (v4.0)	High
CVE-2026-9585	Unauthenticated Reflected Cross-Site Scripting (XSS) in Switchvox SMB Web Portal	Switchvox SMB Edition	8.6 (v4.0)	High
CVE-2025-39663	Cross Site Scripting through compromised remote site	checkmk	8.5 (v4.0)	High
CVE-2026-21618	Cross-site scripting (XSS) in OAuth Device Authorization screen	hexpm	8.5 (v4.0)	High
CVE-2026-55665	DOM-based XSS in Grist via unsanitized links, enabling privilege escalation	grist-core	8.5 (v4.0)	High
CVE-2026-58113	Teamcenter V2412 Cross-site Scripting Vulnerability	Teamcenter V2412	8.5 (v4.0)	High
CVE-2026-63361	LimeSurvey Community Edition 7.0.5+260623 - Reflected XSS in HTML editor popup	LimeSurvey	8.5 (v4.0)	High
CVE-2026-71483	Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View	horilla-hr	8.5 (v4.0)	High
CVE-2026-5385	GLPI 11.0.0 - Stored XSS in knowledge base	glpi	8.4 (v4.0)	High
CVE-2026-77072	n8n before 1.123.69 Stored XSS via Form Completion Page	n8n	8.4 (v4.0)	High
CVE-2026-85613	OpenPanel Unauthenticated XSS via SVG Favicon Proxy	openpanel	8.4 (v4.0)	High
CVE-2026-87811	SiYuan before v3.8.2 Stored XSS via notebook template paths	siyuan	8.4 (v4.0)	High
CVE-2026-44203	OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)	OpenAM	8.3 (v4.0)	High
CVE-2026-48788	Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing	remark42	8.2 (v3.0)	High
CVE-2026-54253	TS3 Manager: Reflected XSS via /api/download port parameter steals operator session	ts3-manager	8.2 (v3.1)	High
CVE-2026-56670	ComfyUI: Stored XSS via SVG file upload on the /view endpoint	ComfyUI	8.2 (v3.1)	High
CVE-2026-63135	YOURLS: Stored XSS in referrer statistics chart via crafted Referer header	YOURLS	8.2 (v3.1)	High
CVE-2025-62716	Plane Vulnerable to Cross-Site Scripting via Open Redirect in ?next_path Parameter	plane	8.1 (v3.1)	High
CVE-2026-18147	Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url	Red Hat Enterprise Linux 10	8.1 (v3.1)	High
CVE-2026-39344	Reflected XSS the login page through the 'username' parameter	churchcrm	8.1 (v3.0)	High
CVE-2026-48060	Litestar: HTML Injection Through CSRF Token	litestar	8.1 (v3.1)	High
CVE-2026-50758	DayuanJiang next-ai-draw-io 0.4.13 Arbitrary Code Execution Vulnerability	DayuanJiang next-ai-draw-io 0.4.13	8.1 (v3.1)	High
CVE-2025-12029	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab	gitlab	8.0 (v3.1)	High
CVE-2026-58390	OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views	core	8.0 (v3.1)	High
CVE-2015-4669	Xceedium Xsuite - Multiple Vulnerabilities	xsuite	7.8 (v3.0)	High
CVE-2026-55659	Grist: XSS through unsafe value interpolation in server-rendered pages	grist-core	7.7 (v3.1)	High
CVE-2026-116167	SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter	siyuan	7.6 (v4.0)	High
CVE-2026-32308	OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose")	oneuptime	7.6 (v3.1)	High
CVE-2026-59814	Joplin: Stored XSS via inline-served note attachment on published shares	joplin	7.6 (v3.1)	High
CVE-2026-12592	SlimStat Analytics < 5.5.0 - Unauthenticated Stored XSS via CF-IPCountry Header	SlimStat Analytics	7.5 (v3.1)	High
CVE-2026-44657	MantisBT: Stored XSS in File Download	mantisbt	7.5 (v4.0)	High
CVE-2026-67237	RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint	rabbitmq server	7.5 (v4.0)	High
CVE-2026-73546	Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)	envoy	7.4 (v3.1)	High
CVE-2026-7460	mailcow-dockerized 2026-03b - Stored XSS in Queue Manager via unescaped	mailcow-dockerized	7.4 (v4.0)	High
CVE-2026-87812	SiYuan before v3.8.2 Stored XSS via Bazaar iconURL	siyuan	7.4 (v4.0)	High
CVE-2025-11189	kiwire Cross-Site Scripting Vulnerability	kiwire	7.3 (v3.1)	High
CVE-2026-30819	Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameter	iTop	7.3 (v3.1)	High
CVE-2026-6735	XSS within PHP-FPM status endpoint	php	7.3 (v4.0)	High
CVE-2026-8203	Concrete CMS 9.5.0 and below has Stored XSS on the height parameter	concrete cms	7.3 (v4.0)	High
CVE-2025-11994	Easy Email Subscription <= 1.3 - Unauthenticated Stored Cross-Site Scripting	Easy Email Subscription	7.2 (v3.1)	High
CVE-2025-14151	SlimStat Analytics <= 5.3.2 - Unauthenticated Stored Cross-Site Scripting	SlimStat Analytics	7.2 (v3.1)	High
CVE-2026-101928	Magic Tooltips For Contact Form 7 <= 1.0.34 - Unauthenticated Stored Cross-Site Scripting via 'esc_html' Filter Override	Magic Tooltips For Contact Form 7	7.2 (v3.1)	High
CVE-2026-102562	AcyMailing <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting via 'customField[]' Parameter	AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress	7.2 (v3.1)	High
CVE-2026-107764	SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Inspector hre	SiteOrigin CSS	7.2 (v3.1)	High
CVE-2026-109193	HivePress <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value	HivePress – Business Directory, Listings & Classified Ads Plugin	7.2 (v3.1)	High
CVE-2026-13359	Contact Form to DB by BestWebSoft <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting via cntctfrm_contact_dropdown P	Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress	7.2 (v3.1)	High
CVE-2026-17506	Independent Analytics <= 2.15.0 - Unauthenticated Stored Cross-Site Scripting	Independent Analytics – WordPress Analytics Plugin	7.2 (v3.1)	High
CVE-2026-18756	HumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button rendering	HumHub	7.2 (v4.0)	High
CVE-2026-4267	Query Monitor <= 3.20.3 - Reflected Cross-Site Scripting via Request URI	Query Monitor	7.2 (v3.1)	High
CVE-2026-5934	WP Rocket <= 3.21.0.1 - Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket_beacon Endpo	WP Rocket	7.2 (v3.1)	High
CVE-2026-75528	Broken Link Checker <= 2.4.13 - Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Log	Broken Link Checker	7.2 (v3.1)	High
CVE-2026-83625	Contact Form by Supsystic <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via IP Address Header	Contact Form by Supsystic	7.2 (v3.1)	High
CVE-2026-87091	Welcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters	Welcart e-Commerce	7.2 (v3.1)	High
CVE-2026-89417	OMGF \| GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 6.3.10 - Unauthenticated Stored Cross-Site Scripting via 's'	OMGF \| GDPR/DSGVO Compliant, Faster Google Fonts. Easy.	7.2 (v3.1)	High
CVE-2026-93756	Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in A	Smash Balloon Social Post Feed – Simple Social Feeds for WordPress	7.2 (v3.1)	High
CVE-2026-95670	No External Links <= 5.2.0 - Unauthenticated Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect	No External Links	7.2 (v3.1)	High
CVE-2026-96561	AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advi	AI Engine – The Chatbot, AI Framework & MCP for WordPress	7.2 (v3.1)	High
CVE-2026-96566	Newsletter <= 9.4.0 - Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field Parameter	Newsletter – Send awesome emails from WordPress	7.2 (v3.1)	High
CVE-2022-35499	In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint Cross-Site Scripting Vulnerability	-	7.1 (v3.1)	High
CVE-2025-11560	Team Members Showcase < 3.5.0 - Reflected XSS	Team Members Showcase	7.1 (v3.1)	High
CVE-2025-12629	Broken Link Manager <= 0.6.5 - Reflected XSS	Broken Link Manager	7.1 (v3.1)	High
CVE-2025-12684	URL Shortify < 1.11.3 - Reflected XSS	URL Shortify	7.1 (v3.1)	High
CVE-2025-13071	Custom Admin Menu <= 1.0.0 - Reflected XSS	Custom Admin Menu	7.1 (v3.1)	High
CVE-2025-13072	HandL UTM Grabber / Tracker < 2.8.1 - Reflected XSS via utm_source	HandL UTM Grabber / Tracker	7.1 (v3.1)	High
CVE-2025-13073	HandL UTM Grabber / Tracker < 2.8.1 - Reflected XSS via handl_landing_page	HandL UTM Grabber / Tracker	7.1 (v3.1)	High
CVE-2025-13355	URL Shortify < 1.11.4 - Reflected XSS	URL Shortify	7.1 (v3.1)	High
CVE-2025-14701	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller	crafty controller	7.1 (v3.1)	High
CVE-2026-115457	baserCMS: Unauthenticated Stored XSS via Shortcode Expansion in Blog Comments	basercms	7.1 (v3.1)	High
CVE-2026-12970	LearnPress < 4.4.1 - Reflected XSS via c_search	LearnPress	7.1 (v3.1)	High
CVE-2026-14234	WOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRF	WOLF	7.1 (v3.1)	High
CVE-2026-14239	Tourmaster < 5.4.8 - Stored XSS via CSRF	tourmaster	7.1 (v3.1)	High
CVE-2026-14870	Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_id	Database for Contact Form 7, WPforms, Elementor forms	7.1 (v3.1)	High
CVE-2026-34598	YesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter"	yeswiki	7.1 (v4.0)	High
CVE-2026-6495	WordPress Ajax Load More < 7.8.4 - Reflected Cross-Site Scripting	ajax-load-more	7.1 (v3.1)	High
CVE-2026-76790	Estatik < 4.3.5 - Reflected XSS via get_listings hash Parameter	Estatik Real Estate Plugin	7.1 (v3.1)	High
CVE-2026-84192	LibreNMS before 26.3.1 Stored XSS via SNMP/Syslog Data	librenms	7.1 (v4.0)	High
CVE-2026-9833	WordPress Tag Groups < 2.2.0 - Reflected Cross-Site Scripting	tag-groups	7.1 (v3.1)	High
CVE-2026-58411	ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values	CRM	7.0 (v4.0)	High
CVE-2025-11937	Stored XSS through a system message in SecurePoll	Mediawiki - SecurePoll Extension	6.9 (v4.0)	Medium
CVE-2025-43779	digital experience platform Cross-Site Scripting Vulnerability	digital experience platform	6.9 (v4.0)	Medium
CVE-2025-4388	Liferay Portal - Cross-Site Scripting	digital experience platform	6.9 (v4.0)	Medium
CVE-2025-59746	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	6.9 (v4.0)	Medium
CVE-2025-59747	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	6.9 (v4.0)	Medium
CVE-2025-59748	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	6.9 (v4.0)	Medium
CVE-2025-59749	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	6.9 (v4.0)	Medium
CVE-2025-62597	WeGIA Vulnerable to Reflected Cross-Site Scripting via Endpoint 'pessoa/editar_info_pessoal.php' Parameter 'sql'	wegia	6.9 (v4.0)	Medium
CVE-2025-62598	WeGIA Vulnerable to Reflected Cross-Site Scripting via Endpoint 'pessoa/editar_info_pessoal.php' Parameter 'action'	wegia	6.9 (v4.0)	Medium
CVE-2025-62613	VDO.Ninja - DOM-Based Cross-Site Scripting	vdo.ninja	6.9 (v4.0)	Medium
CVE-2025-62662	Stored XSS through system messages in AdvancedSearch	Mediawiki - AdvancedSearch Extension	6.9 (v4.0)	Medium
CVE-2025-62663	Stored XSS through a system message in UploadWizard	Mediawiki - UploadWizard Extension	6.9 (v4.0)	Medium
CVE-2025-62664	Stored XSS through a system message in ImageRating	Mediawiki - ImageRating Extension	6.9 (v4.0)	Medium
CVE-2025-62670	Stored XSS through a system message in FlexDiagrams	Mediawiki - FlexDiagrams Extension	6.9 (v4.0)	Medium
CVE-2025-62671	Stored XSS through wikitext in Cargo	Mediawiki - Cargo Extension	6.9 (v4.0)	Medium
CVE-2025-62693	Stored XSS through system messages in LastModified	Mediawiki - LastModified Extension	6.9 (v4.0)	Medium
CVE-2025-62695	Stored XSS through system messages	Mediawiki - WikiLambda Extension	6.9 (v4.0)	Medium
CVE-2025-62698	Stored XSS through system messages in ExternalGuidance	Mediawiki - ExternalGuidance	6.9 (v4.0)	Medium
CVE-2025-62700	Stored XSS through a system message in MultiBoilerplate	Mediawiki - MultiBoilerplate Extensionmaste	6.9 (v4.0)	Medium
CVE-2026-39838	ProofreadPage improperly sanitizes multiline styles using Sanitizer::checkCSS	MediaWiki - ProofreadPage Extension	6.9 (v4.0)	Medium
CVE-2026-39936	Stored XSS in Score due to usage of non-reserved data attributes	Mediawiki - Score Extension	6.9 (v4.0)	Medium
CVE-2026-44651	SillyTavern: Reflected XSS vulnerability in the CORS proxy middleware	SillyTavern	6.9 (v4.0)	Medium
CVE-2026-69092	Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpoint	admidio	6.9 (v4.0)	Medium
CVE-2026-73848	Emlog: Stored XSS via Tag Name in Article Editor	emlog	6.9 (v4.0)	Medium
CVE-2026-86188	AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting	AVideo	6.9 (v4.0)	Medium
CVE-2026-13605	Photo Swipe <= 4.1.1.1 - Author+ Stored XSS via title Attribute	PhotoSwipe	6.8 (v3.1)	Medium
CVE-2026-14817	Element Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data Attributes	Element Pack Addons for Elementor	6.8 (v3.1)	Medium
CVE-2026-14833	Lightbox with PhotoSwipe < 5.9.0 - Author+ Stored XSS via data-lbwps-caption Attribute	Lightbox with PhotoSwipe	6.8 (v3.1)	Medium
CVE-2026-15047	s2Member < 260805 - Contributor+ Stored XSS via Shortcode	s2Member	6.8 (v3.1)	Medium
CVE-2026-16069	Brizy - Page Builder < 2.8.19 - Contributor+ Stored XSS via Featured Image Focal Point	Brizy	6.8 (v3.1)	Medium
CVE-2026-33741	EspoCRM: Stored XSS via SVG attachment loading same-origin JavaScript	espocrm	6.8 (v3.1)	Medium
CVE-2026-39311	Trilium Notes: Stored XSS Leads to Unauthorized Remote Code Execution (RCE) via Unsanitized SVG Attachments	Trilium	6.8 (v3.1)	Medium
CVE-2025-32430	XWiki Platform - Cross-Site Scripting	xwiki-platform	6.5 (v4.0)	Medium
CVE-2026-24128	XWiki Platform Distribution Flavor Main - Cross-Site Scripting	xwiki-platform-distribution-flavor-main	6.5 (v4.0)	Medium
CVE-2026-55549	Yamcs <=5.8.6 - Cross-Site Scripting	yamcs	6.5 (v3.1)	Medium
CVE-2026-78838	AppNitro MachForm v30 Cross-Site Scripting Vulnerability	AppNitro MachForm v30	6.5 (v3.1)	Medium
CVE-2026-88618	1024-lab SmartAdmin v3.30.0 Arbitrary Code Execution Vulnerability	1024-lab SmartAdmin v3.30.0	6.5 (v3.1)	Medium
CVE-2025-10128	Eulerpool Research Systems <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	Eulerpool Research Systems	6.4 (v3.1)	Medium
CVE-2025-10130	Layers <= 0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting	Layers	6.4 (v3.1)	Medium
CVE-2025-10139	WP BookWidgets <= 0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting	WP BookWidgets	6.4 (v3.1)	Medium
CVE-2025-10189	BP Direct Menus <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	BP Direct Menus	6.4 (v3.1)	Medium
CVE-2025-13135	HotelRunner Booking Widget <= 5.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting	HotelRunner Booking Widget	6.4 (v3.1)	Medium
CVE-2025-14387	LearnPress – WordPress LMS Plugin <= 4.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via get_profile_soc	LearnPress – WordPress LMS Plugin for Create and Sell Online Courses	6.4 (v3.1)	Medium
CVE-2025-9130	Unify <= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via unify_checkout Shortcode	Unify	6.4 (v3.1)	Medium
CVE-2026-0552	Simple Shopping Cart <= 5.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsc_display_product' Shor	Simple Shopping Cart	6.4 (v3.1)	Medium
CVE-2026-0626	WPFunnels <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode	WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell	6.4 (v3.1)	Medium
CVE-2026-0737	Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode	WP Shortcodes Plugin — Shortcodes Ultimate	6.4 (v3.1)	Medium
CVE-2026-0738	Shortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode	WP Shortcodes Plugin — Shortcodes Ultimate	6.4 (v3.1)	Medium
CVE-2026-100106	FiboSearch <= 1.34.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'purchased_plan' Parameter	FiboSearch – Ajax Search for WooCommerce	6.4 (v3.1)	Medium
CVE-2026-109983	YMC Filter <= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' Parameter	YMC Filter	6.4 (v3.1)	Medium
CVE-2026-13203	Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_id' Shortcode Attribute	Live Composer – Free WordPress Website Builder	6.4 (v3.1)	Medium
CVE-2026-13770	AppMySite <= 3.15.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via save_ams_license_key AJAX Handler	AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker)	6.4 (v3.1)	Medium
CVE-2026-3885	WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_bo	Shortcodes Ultimate – Content Elements	6.4 (v3.1)	Medium
CVE-2026-50592	Znuny Cross-Site Scripting Vulnerability	Znuny	6.4 (v3.1)	Medium
CVE-2026-5092	Greenshift <= 12.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data URI	Greenshift – animation and page builder blocks	6.4 (v3.1)	Medium
CVE-2026-5391	LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	Appointment Booking Plugin – LatePoint \| Calendar & Scheduling for WordPress	6.4 (v3.1)	Medium
CVE-2026-6454	Firelight Lightbox <= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad 'href' At	Firelight Lightbox	6.4 (v3.1)	Medium
CVE-2026-87870	Ninja Forms - Scheduled Exports <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Paramete	Ninja Forms - Scheduled Exports	6.4 (v3.1)	Medium
CVE-2026-8977	WP GDPR Cookie Consent <= 1.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ninja_gdpr_ajax_actions'	WP GDPR Cookie Consent	6.4 (v3.1)	Medium
CVE-2026-9281	Master Addons For Elementor <= 3.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'jtlma_custom_js' Page Se	Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits	6.4 (v3.1)	Medium
CVE-2025-10567	FunnelKit < 3.12.0.1 - Reflected XSS	FunnelKit	6.3 (v3.1)	Medium
CVE-2026-115513	OpenCATS before 0.12.0 Stored XSS via MRU Navigation Panel	OpenCATS	6.3 (v4.0)	Medium
CVE-2026-43980	Malla: Stored XSS via Meshtastic node names in multiple frontend pages	malla	6.3 (v3.1)	Medium
CVE-2025-34281	Stored Cross-Site Scripting (XSS) in ThingsBoard	thingsboard	6.2 (v4.0)	Medium
CVE-2015-4668	Xceedium Xsuite - Multiple Vulnerabilities	xsuite	6.1 (v3.0)	Medium
CVE-2015-9312	NewStatPress <=1.0.4 - Cross-Site Scripting	newstatpress	6.1 (v3.0)	Medium
CVE-2017-15687	Logitech Media Server - Cross-Site Scripting	media server	6.1 (v3.0)	Medium
CVE-2017-7855	IceWarp WebMail 11.3.1.5 - Cross-Site Scripting	server	6.1 (v3.0)	Medium
CVE-2018-12111	Canon PrintMe EFI - Cross-Site Scripting	efi printme	6.1 (v3.0)	Medium
CVE-2018-19287	WordPress Ninja Forms <3.3.18 - Cross-Site Scripting	ninja forms	6.1 (v3.0)	Medium
CVE-2018-6882	zimbra collaboration suite Cross-Site Scripting Vulnerability	zimbra collaboration suite	6.1 (v3.1)	Medium
CVE-2018-7653	YzmCMS v3.6 - Cross-Site Scripting	yzmcms	6.1 (v3.0)	Medium
CVE-2019-20141	WordPress Laborator Neon Theme 2.0 - Cross-Site Scripting	neon	6.1 (v3.1)	Medium
CVE-2019-9912	WP Google Maps < 7.10.43 - Cross-Site Scripting	wp go maps	6.1 (v3.1)	Medium
CVE-2020-12054	WordPress Catch Breadcrumb <1.5.4 - Cross-Site Scripting	catch breadcrumb	6.1 (v3.1)	Medium
CVE-2020-14413	NeDi 1.9C - Cross-Site Scripting	nedi	6.1 (v3.1)	Medium
CVE-2020-19515	qdPM 9.1 - Cross-site Scripting	qdpm	6.1 (v3.1)	Medium
CVE-2020-27982	IceWarp WebMail 11.4.5.0 - Cross-Site Scripting	mail server	6.1 (v3.1)	Medium
CVE-2020-29164	PacsOne Server <7.1.1 - Cross-Site Scripting	pacsone server	6.1 (v3.1)	Medium
CVE-2021-24235	WordPress Goto Tour & Travel Theme <2.0 - Cross-Site Scripting	goto	6.1 (v3.1)	Medium
CVE-2021-24910	WordPress Transposh Translation <1.0.8 - Cross-Site Scripting	transposh wordpress translation	6.1 (v3.1)	Medium
CVE-2021-24987	WordPress Super Socializer <7.13.30 - Cross-Site Scripting	super socializer	6.1 (v3.1)	Medium
CVE-2021-25055	WordPress FeedWordPress < 2022.0123 - Authenticated Cross-Site Scripting	feedwordpress	6.1 (v3.1)	Medium
CVE-2021-25085	WOOF WordPress plugin - Cross-Site Scripting	woocommerce products filter	6.1 (v3.1)	Medium
CVE-2021-3030	Cute Editor for ASP.NET 6.4 Cross-Site Scripting Vulnerability	-	6.1 (v3.1)	Medium
CVE-2021-37573	Tiny Java Web Server - Cross-Site Scripting	tiny java web server	6.1 (v3.1)	Medium
CVE-2021-41878	i-Panel Administration System 2.0 - Reflected Cross-site Scripting (XSS)	i-panel administration system	6.1 (v3.1)	Medium
CVE-2021-46387	Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting (XSS)	zywall 2 plus internet security appliance firmware	6.1 (v3.1)	Medium
CVE-2022-0271	LearnPress <4.1.6 - Cross-Site Scripting	learnpress	6.1 (v3.1)	Medium
CVE-2022-1168	WordPress WP JobSearch <1.5.1 - Cross-Site Scripting	jobsearch wp job board	6.1 (v3.1)	Medium
CVE-2022-1170	JobMonster < 4.5.2.9 - Cross-Site Scripting	jobmonster	6.1 (v3.1)	Medium
CVE-2022-2290	Trilium <0.52.4 - Cross-Site Scripting	trilium	6.1 (v3.1)	Medium
CVE-2022-23397	Cedar Gate EZ-NET <= 6.8.0 - Cross-Site Scripting	ez-net portal	6.1 (v3.1)	Medium
CVE-2022-24384	SmarterTools SmarterTrack - Cross-Site Scripting	smartertrack	6.1 (v3.1)	Medium
CVE-2022-25323	ZEROF Web Server 2.0 - Cross-Site Scripting	web server	6.1 (v3.1)	Medium
CVE-2022-2733	Openemr < 7.0.0.1 - Cross-Site Scripting	openemr	6.1 (v3.1)	Medium
CVE-2022-27926	Zimbra Collaboration (ZCS) - Cross Site Scripting	collaboration	6.1 (v3.1)	Medium
CVE-2022-31798	Nortek Linear eMerge E3-Series - Cross-Site Scripting	emerge e3 firmware	6.1 (v3.1)	Medium
CVE-2022-35493	eShop 3.0.4 - Cross-Site Scripting	eshop - ecommerce / store website	6.1 (v3.1)	Medium
CVE-2022-4971	Sassy Social Share <= 3.3.3 - Cross-Site Scripting	sassy social share	6.1 (v3.1)	Medium
CVE-2023-0334	ShortPixel Adaptive Images < 3.6.3 - Cross Site Scripting	shortpixel adaptive images	6.1 (v3.1)	Medium
CVE-2023-2122	Image Optimizer by 10web < 1.0.26 - Cross-Site Scripting	image optimizer	6.1 (v3.1)	Medium
CVE-2023-23161	Art Gallery Management System Project v1.0 - Cross-Site Scripting	art gallery management system	6.1 (v3.1)	Medium
CVE-2023-23548	XSS in business intelligence	checkmk	6.1 (v3.1)	Medium
CVE-2023-24488	Citrix Gateway and Citrix ADC - Cross-Site Scripting	gateway	6.1 (v3.1)	Medium
CVE-2023-2779	Super Socializer < 7.13.52 - Cross-Site Scripting	social share, social login and social comments	6.1 (v3.1)	Medium
CVE-2023-2813	Wordpress Multiple Themes - Reflected Cross-Site Scripting	connections reloaded	6.1 (v3.1)	Medium
CVE-2023-2822	Ellucian Ethos Identity CAS - Cross-Site Scripting	ethos identity	6.1 (v3.1)	Medium
CVE-2023-29489	cPanel < 11.109.9999.116 - Cross-Site Scripting	cpanel	6.1 (v3.1)	Medium
CVE-2023-2949	OpenEMR < 7.0.1 - Cross-site Scripting	openemr	6.1 (v3.1)	Medium
CVE-2023-3521	FOSSBilling < 0.5.3 - Cross-Site Scripting	fossbilling	6.1 (v3.1)	Medium
CVE-2023-37580	Zimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site Scripting	zimbra	6.1 (v3.1)	Medium
CVE-2023-38194	SuperWebMailer - Cross-Site Scripting	superwebmailer	6.1 (v3.1)	Medium
CVE-2023-3843	mooDating 1.2 - Cross-site scripting	moodating	6.1 (v3.1)	Medium
CVE-2023-3844	MooDating 1.2 - Cross-Site Scripting	moodating	6.1 (v3.1)	Medium
CVE-2023-3845	MooDating 1.2 - Cross-Site Scripting	moodating	6.1 (v3.1)	Medium
CVE-2023-3846	MooDating 1.2 - Cross-Site Scripting	moodating	6.1 (v3.1)	Medium
CVE-2023-3847	MooDating 1.2 - Cross-Site scripting	moodating	6.1 (v3.1)	Medium
CVE-2023-3848	MooDating 1.2 - Cross-site scripting	moodating	6.1 (v3.1)	Medium
CVE-2023-3849	mooDating 1.2 - Cross-site scripting	moodating	6.1 (v3.1)	Medium
CVE-2023-38501	CopyParty v1.8.6 - Cross Site Scripting	copyparty	6.1 (v3.1)	Medium
CVE-2023-39598	IceWarp Email Client - Cross Site Scripting	webclient	6.1 (v3.1)	Medium
CVE-2023-39600	IceWarp 11.4.6.0 - Cross-Site Scripting	icewarp	6.1 (v3.1)	Medium
CVE-2023-39700	IceWarp Mail Server v10.4.5 - Cross-Site Scripting	mail server	6.1 (v3.1)	Medium
CVE-2023-40750	PHPJabbers Yacht Listing Script v1.0 - Cross-Site Scripting	yacht listing script	6.1 (v3.1)	Medium
CVE-2023-40751	PHPJabbers Fundraising Script v1.0 - Cross-Site Scripting	fundraising script	6.1 (v3.1)	Medium
CVE-2023-40752	PHPJabbers Make an Offer Widget v1.0 - Cross-Site Scripting	make an offer widget	6.1 (v3.1)	Medium
CVE-2023-4173	mooSocial 3.1.8 - Reflected XSS	moostore	6.1 (v3.1)	Medium
CVE-2023-4174	mooSocial 3.1.6 - Reflected Cross Site Scripting	moostore	6.1 (v3.1)	Medium
CVE-2023-43325	MooSocial 3.1.8 - Cross-Site Scripting	moosocial	6.1 (v3.1)	Medium
CVE-2023-43326	MooSocial 3.1.8 - Cross-Site Scripting	moosocial	6.1 (v3.1)	Medium
CVE-2023-44352	Adobe Coldfusion - Cross-Site Scripting	coldfusion	6.1 (v3.1)	Medium
CVE-2023-4451	Cockpit - Cross-Site Scripting	cockpit	6.1 (v3.1)	Medium
CVE-2023-49494	DedeCMS v5.7.111 - Cross-Site Scripting	dedecms	6.1 (v3.1)	Medium
CVE-2023-51769	Frappe Cross-Site Scripting Vulnerability	Frappe	6.1 (v3.1)	Medium
CVE-2023-5758	firefox mobile Cross-Site Scripting Vulnerability	firefox mobile	6.1 (v3.1)	Medium
CVE-2023-6697	WP Go Maps (formerly WP Google Maps) < 9.0.29 - Cross-Site Scripting	wp go maps	6.1 (v3.1)	Medium
CVE-2024-34321	ProPhoenix Law RMS v2022.2403.3.101 Cross-Site Scripting Vulnerability	ProPhoenix Law RMS v2022.2403.3.101	6.1 (v3.1)	Medium
CVE-2024-34326	ProPhoenix Law RMS v2022.2403.3.101 Cross-Site Scripting Vulnerability	ProPhoenix Law RMS v2022.2403.3.101	6.1 (v3.1)	Medium
CVE-2025-12123	Customer Reviews Collector for WooCommerce <= 4.6.1 - Reflected Cross-Site Scripting	Customer Reviews Collector for WooCommerce	6.1 (v3.1)	Medium
CVE-2025-25296	Label Studio < 1.16.0 - Cross-Site Scripting	label studio	6.1 (v3.1)	Medium
CVE-2025-54597	Heimdall Application Dashboard < 2.7.3 - Reflected XSS	heimdall	6.1 (v3.1)	Medium
CVE-2025-55757	Extension - virtuemart.net - XSS in VirtueMart component 1.0.0 - 4.4.10 for Joomla	Virtuemart component for Joomla	6.1 (v3.1)	Medium
CVE-2025-61583	TS3 Manager is vulnerable to unauthenticated reflected XSS attack due to insecure error handling	ts3 manager	6.1 (v3.1)	Medium
CVE-2025-62358	WeGIA Reflected XSS to Account TakeOver at /html/configuracao/configuracao_geral.php via log parameter	wegia	6.1 (v3.1)	Medium
CVE-2025-63238	limesurvey Cross-Site Scripting Vulnerability	limesurvey	6.1 (v3.1)	Medium
CVE-2025-63607	TechStore 1.0 Cross-Site Scripting Vulnerability	-	6.1 (v3.1)	Medium
CVE-2025-63737	rockoa Cross-Site Scripting Vulnerability	rockoa	6.1 (v3.1)	Medium
CVE-2025-63949	hotel management system Cross-Site Scripting Vulnerability	hotel management system	6.1 (v3.1)	Medium
CVE-2025-65013	LibreNMS vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint `/maps/nodeimage` parameter `Image Name`	librenms	6.1 (v3.1)	Medium
CVE-2025-65019	Astro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /_image endpoint	astro	6.1 (v3.1)	Medium
CVE-2025-65233	slims Cross-Site Scripting Vulnerability	slims	6.1 (v3.1)	Medium
CVE-2025-66026	REDAXO is Vulnerable to Reflected XSS in Mediapool Info Banner via args[types]	redaxo	6.1 (v3.1)	Medium
CVE-2025-67495	ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login	zitadel	6.1 (v3.1)	Medium
CVE-2025-67648	Shopware's inproper input validation can lead to Reflected XSS through Storefront Login Page	shopware	6.1 (v3.1)	Medium
CVE-2025-9952	Trinity Audio <= 5.20.2 - Reflected Cross-Site Scripting	Trinity Audio – Text to Speech AI audio player to convert content into audio	6.1 (v3.1)	Medium
CVE-2026-103888	WPC Smart Quick View for WooCommerce <= 4.4.0 - Reflected Cross-Site Scripting via 'woosq-redirect' Parameter	WPC Smart Quick View for WooCommerce	6.1 (v3.1)	Medium
CVE-2026-107393	FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header	freescout	6.1 (v3.1)	Medium
CVE-2026-113659	ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated us	apostrophe	6.1 (v3.1)	Medium
CVE-2026-11881	Fluent Forms < 6.2.6 - Contributor+ Stored XSS via Date/Time Field	Fluent Forms	6.1 (v3.1)	Medium
CVE-2026-12982	Document Gallery < 5.1.1 - Reflected XSS via dg_generate_gallery	Document Gallery	6.1 (v3.1)	Medium
CVE-2026-14207	LifterLMS < 10.0.10 - Instructor+ Stored XSS via Featured Pricing Information	LifterLMS	6.1 (v3.1)	Medium
CVE-2026-14845	NewStatPress < 1.4.5 - Unauthenticated Stored XSS via Top Post Widget	NewStatPress	6.1 (v3.1)	Medium
CVE-2026-14921	Ultimate Addons for WPBakery Page Builder < 3.21.5 - Contributor+ Stored XSS via ult_buttons Shortcode	Ultimate Addons for WPBakery Page Builder	6.1 (v3.1)	Medium
CVE-2026-17532	Seraphinite Accelerator <= 2.29.18 - Reflected Cross-Site Scripting	Seraphinite Accelerator	6.1 (v3.1)	Medium
CVE-2026-18843	Beaver Builder Plugin (Pro Version) <= 2.11.0.1 - Reflected Cross-Site Scripting via 'no_results_message' node_preview P	Beaver Builder Plugin (Starter Version)	6.1 (v3.1)	Medium
CVE-2026-30251	zenshare suite Cross-Site Scripting Vulnerability	zenshare suite	6.1 (v3.1)	Medium
CVE-2026-30252	zencrm Cross-Site Scripting Vulnerability	zencrm	6.1 (v3.1)	Medium
CVE-2026-31013	ad phonebook Cross-Site Scripting Vulnerability	ad phonebook	6.1 (v3.1)	Medium
CVE-2026-34206	Captcha Protect: Reflected XSS in challenge page via unsanitized destination rendered with text/template	captcha protect	6.1 (v3.1)	Medium
CVE-2026-34739	AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php	avideo	6.1 (v3.1)	Medium
CVE-2026-36468	Cross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 Vulnerability	-	6.1 (v3.1)	Medium
CVE-2026-37750	School Management System by mahmoudai1 Cross-Site Scripting Vulnerability	School Management System by mahmoudai1	6.1 (v3.1)	Medium
CVE-2026-38444	osTicket v1.18.3 Cross-Site Scripting Vulnerability	-	6.1 (v3.1)	Medium
CVE-2026-38472	forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 Cross-Site Scripting Vulnerability	forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449	6.1 (v3.1)	Medium
CVE-2026-38947	FluentCMS 1.2.3 Cross-Site Scripting Vulnerability	-	6.1 (v3.1)	Medium
CVE-2026-39275	Cockpit CMS v.2.13.5 and before Arbitrary Code Execution Vulnerability	Cockpit CMS v.2.13.5 and before	6.1 (v3.1)	Medium
CVE-2026-42253	Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties	activemq	6.1 (v3.1)	Medium
CVE-2026-4246	ElementsKit Pro <= 4.10.1 - Unauthenticated Stored Cross-Site Scripting via 's' Parameter	ElementsKit Pro	6.1 (v3.1)	Medium
CVE-2026-44767	Allowlist Bypass in setThemeRoot() Enables Cross-Origin CSS Injection	@ui5/webcomponents-base	6.1 (v3.1)	Medium
CVE-2026-50182	AVideo Has Unauthenticated Reflected XSS via $_GET['search'] in YouTubeAPI Gallery Pagination	AVideo	6.1 (v3.1)	Medium
CVE-2026-51133	za-internet GmbH C-MOR Video Surveillance <= V6.0104 Arbitrary Code Execution Vulnerability	za-internet GmbH C-MOR Video Surveillance <= V6.0104	6.1 (v3.1)	Medium
CVE-2026-51565	Modules/Docs/DocsController.php in Milk admin <=0.9.8 Cross-Site Scripting Vulnerability	Modules/Docs/DocsController.php in Milk admin <=0.9.8	6.1 (v3.1)	Medium
CVE-2026-52232	FS Inc S3150-8T2F Switch 2.2.0D Build 118101 Cross-Site Scripting Vulnerability	FS Inc S3150-8T2F Switch 2.2.0D Build 118101	6.1 (v3.1)	Medium
CVE-2026-54714	Logto: XSS via unescaped RelayState in SAML auto-submit form	logto	6.1 (v3.1)	Medium
CVE-2026-55087	Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (ope	etherpad	6.1 (v3.1)	Medium
CVE-2026-61526	AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler	http-server	6.1 (v3.1)	Medium
CVE-2026-62280	OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page	OpenAM	6.1 (v3.1)	Medium
CVE-2026-73084	Activepieces: Reflected Cross-Site Scripting in OAuth Redirect Endpoint	activepieces	6.1 (v3.1)	Medium
CVE-2026-78738	Silverpeas Core 6.4.6 Cross-Site Scripting Vulnerability	-	6.1 (v3.1)	Medium
CVE-2026-82382	Apache Roller: Reflected cross-site scripting in the frontpage directory parameter	Apache Roller	6.1 (v3.1)	Medium
CVE-2026-8447	Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untruste	langflow	6.1 (v3.1)	Medium
CVE-2026-84925	Avada \| Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter	Avada \| Website Builder For WordPress & WooCommerce	6.1 (v3.1)	Medium
CVE-2026-8626	SponsorMe <= 0.5.2 - Reflected Cross-Site Scripting via PHP_SELF Parameter	SponsorMe	6.1 (v3.1)	Medium
CVE-2026-89047	Social Media Share Buttons & Social Sharing Icons <= 3.0.1 - Reflected DOM-Based Cross-Site Scripting via URL	Social Media Share Buttons & Social Sharing Icons	6.1 (v3.1)	Medium
CVE-2026-92974	Photo Gallery by 10Web <= 1.8.46 - Reflected Cross-Site Scripting via 'thumb_url' Parameter	Photo Gallery by 10Web – Mobile-Friendly Image Gallery	6.1 (v3.1)	Medium
CVE-2026-96594	Gitea repository media API stored XSS	gitea	6.1 (v3.1)	Medium
CVE-2023-6717	Keycloak: xss via assertion consumer service url in saml post-binding flow	Red Hat AMQ Broker 7	6.0 (v3.1)	Medium
CVE-2026-8245	Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection	concrete cms	6.0 (v4.0)	Medium
CVE-2026-5696	Multiple vulnerabilities in the Microweber administration panel	Administration panel	5.9 (v4.0)	Medium
CVE-2025-62657	Stored XSS through system messages in PageForms	MediaWiki PageForms extension	5.8 (v4.0)	Medium
CVE-2025-8280	Contact Form 7 reCAPTCHA <= 1.2.0 - Reflected XSS via $_SERVER['REQUEST_URI']	contact form 7 recaptcha	5.8 (v3.1)	Medium
CVE-2026-36470	CuteNews v.2.1.2 Cross-Site Scripting Vulnerability	-	5.8 (v3.1)	Medium
CVE-2026-84193	LibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP	librenms	5.8 (v4.0)	Medium
CVE-2025-62365	LibreNMS vulnerable to Reflected-XSS in `report_this` function	librenms	5.5 (v4.0)	Medium
CVE-2025-62421	DataEase vulnerable to stored cross-site scripting via file upload bypass	dataease	5.5 (v4.0)	Medium
CVE-2020-20285	ZZcms - Cross-Site Scripting	zzcms	5.4 (v3.1)	Medium
CVE-2022-35497	TM4WEB Cross-Site Scripting Vulnerability	TM4WEB	5.4 (v3.1)	Medium
CVE-2023-1317	osTicket < v1.16.6 - Cross-Site Scripting	osticket	5.4 (v3.1)	Medium
CVE-2024-23176	MassMessage Cross-Site Scripting Vulnerability	MassMessage	5.4 (v3.1)	Medium
CVE-2025-5343	Stored XSS	manageengine exchange reporter plus	5.4 (v3.1)	Medium
CVE-2025-59788	nextcloud server Cross-Site Scripting Vulnerability	nextcloud server	5.4 (v3.1)	Medium
CVE-2025-61597	Emlog Pro is vulnerable to stored XSS attack through HTML template injection	emlog	5.4 (v3.1)	Medium
CVE-2025-62178	WeGIA Cross-Site Scripting (XSS) Reflected endpoint '/html/atendido/cadastro_atendido_parentesco_pessoa_nova.php' parame	wegia	5.4 (v3.1)	Medium
CVE-2025-62430	ClipBucket v5 stored XSS via video/photo fields	clipbucket	5.4 (v3.1)	Medium
CVE-2025-63948	phpmsadmin SQL Injection Vulnerability	phpmsadmin	5.4 (v3.1)	Medium
CVE-2026-102295	Quay: quay: dom-based cross-site scripting via oauth local callback format=json parameter	Red Hat Quay 3	5.4 (v3.1)	Medium
CVE-2026-103421	WPMobile.App <= 11.84 - Unauthenticated Stored Cross-Site Scripting via '/android_json/search/<value>/0' Path Segment	WPMobile.App – Android and iOS App Builder	5.4 (v3.1)	Medium
CVE-2026-106033	Ansible: ansible-ui: ansible ui dom xss in /redirect next parameter	Red Hat Ansible Automation Platform 2	5.4 (v3.1)	Medium
CVE-2026-15234	Codeless Page Builder <= 1.1.4 - Contributor+ Stored XSS via Shortcode Attribute	Codeless Page Builder	5.4 (v3.1)	Medium
CVE-2026-15245	BNE Testimonials < 2.0.8.2 - Contributor+ Stored XSS via Slider Shortcode	BNE Testimonials	5.4 (v3.1)	Medium
CVE-2026-15262	Admin Columns for ACF Fields <= 0.3.2 - Contributor+ Stored XSS via ACF Field Value Column	Admin Columns for ACF Fields	5.4 (v3.1)	Medium
CVE-2026-16063	Event Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event Timeline Content	Event Booking Manager for WooCommerce	5.4 (v3.1)	Medium
CVE-2026-16537	Slick Slider < 0.5.3 - Contributor+ Stored XSS via Gallery Shortcode	Slick Slider	5.4 (v3.1)	Medium
CVE-2026-18395	Child Pages Card < 1.09 - Contributor+ Stored XSS via Shortcode Attributes	Child Pages Card	5.4 (v3.1)	Medium
CVE-2026-34974	phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding leads to Stored XSS and Privilege Escalation	phpmyfaq	5.4 (v3.1)	Medium
CVE-2026-35403	LORIS has potential cross-site scripting in survey_accounts module	loris	5.4 (v3.1)	Medium
CVE-2026-38473	the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 Cross-Site Scripting Vulnerability	the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449	5.4 (v3.1)	Medium
CVE-2026-39964	TypeBot: Stored XSS via javascript: URI in text bubble links — bot author executes JS on visitors' browsers	typebot.io	5.4 (v3.1)	Medium
CVE-2026-45694	LibreNMS: Reflected XSS in the Proxmox app view via unsanitized instance/vmid parameters	librenms	5.4 (v3.1)	Medium
CVE-2026-63498	Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API	snipe-it	5.4 (v3.1)	Medium
CVE-2026-72570	cube-root directory-serve - Stored Cross-Site Scripting via Malicious Filename	directory-serve	5.4 (v3.1)	Medium
CVE-2026-72583	fastschema - Stored Cross-Site Scripting via MIME Type Bypass in File Upload	fastschema	5.4 (v3.1)	Medium
CVE-2026-82396	Sulu: Stored XSS via media download inline-disposition override	sulu	5.4 (v3.1)	Medium
CVE-2026-91021	Trillium Notes Cross-Site Scripting Vulnerability	Trillium Notes	5.4 (v3.1)	Medium
CVE-2023-30943	Moodle - Cross-Site Scripting/Remote Code Execution	moodle	5.3 (v3.1)	Medium
CVE-2024-58292	XMB Forum 1.9.12.06 Persistent Cross-Site Scripting via Admin Templates	XMB Forum	5.3 (v4.0)	Medium
CVE-2024-58391	Frappe before 15.4.0 XSS via Printview Parameters	frappe	5.3 (v4.0)	Medium
CVE-2025-34398	MailEnable < 10.54 Reflected XSS in AddressesBcc Parameter of AddressBook.aspx	mailenable	5.3 (v4.0)	Medium
CVE-2025-34400	MailEnable < 10.54 Reflected XSS in AddressesTo Parameter of AddressBook.aspx	mailenable	5.3 (v4.0)	Medium
CVE-2025-34408	MailEnable < 10.54 Reflected XSS in Added Parameter of MAI/AddRecipientsResult.aspx	mailenable	5.3 (v4.0)	Medium
CVE-2025-34425	MailEnable < 10.54 Reflected XSS in WindowContext Parameter of MAI/compose.aspx	mailenable	5.3 (v4.0)	Medium
CVE-2025-62359	WeGIA Cross-Site Scripting (XSS) Reflected endpoint id_pet	wegia	5.3 (v4.0)	Medium
CVE-2025-62800	FastMCP vulnerable to reflected XSS in client's callback page	fastmcp	5.3 (v4.0)	Medium
CVE-2025-66460	Lookyloo vulnerable to XSS due to lack of escaping in HTML elements passed to Datatables	lookyloo	5.3 (v4.0)	Medium
CVE-2026-100381	UploadWizard Flickr collection and set titles allow DOM XSS	Mediawiki - UploadWizard Extension	5.3 (v4.0)	Medium
CVE-2026-105114	OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page	OpenAM	5.3 (v4.0)	Medium
CVE-2026-107797	Jivejdon through 5.0 Reflected XSS via postThread.jsp to and tag Parameters	jivejdon	5.3 (v4.0)	Medium
CVE-2026-109352	LibreNMS before 26.9.0 Stored XSS via wireless sensor description	librenms	5.3 (v4.0)	Medium
CVE-2026-109355	LibreNMS before 26.9.0 Stored XSS via Tools Oxidized Node List	librenms	5.3 (v4.0)	Medium
CVE-2026-116203	YesWiki before 4.7.0 Stored XSS via filtertags Action Parameters	yeswiki	5.3 (v4.0)	Medium
CVE-2026-35208	lichess.org has an Unsanitized Stream Title Injection on /streamer	lila	5.3 (v4.0)	Medium
CVE-2026-47096	AJA HELO Plus < 2.1.7 Stored XSS via System Name Parameter	HELO Plus	5.3 (v4.0)	Medium
CVE-2026-48094	ShareOpenly has Cross-Site Scripting (XSS) via Missing esc_url() on Shared URL in Content Output	shareopenly	5.3 (v4.0)	Medium
CVE-2026-5808	openstatusHQ openstatus Onboarding Endpoint client.tsx cross site scripting	openstatus	5.3 (v4.0)	Medium
CVE-2026-73422	Astro: Reflected XSS via unescaped View Transition animation properties	astro	5.3 (v4.0)	Medium
CVE-2026-73628	Serendipity 2.3.5 Reflected XSS via search clean-URL route	Serendipity	5.3 (v4.0)	Medium
CVE-2026-82451	Formwork through 2.3.14 Stored XSS via Referer Header	Formwork	5.3 (v4.0)	Medium
CVE-2026-82646	WWBN AVideo Unauthenticated Reflected XSS via url2Embed.json.php	AVideo	5.3 (v4.0)	Medium
CVE-2026-85158	AVideo Reflected XSS via videoEmbeded.php link parameter	AVideo	5.3 (v4.0)	Medium
CVE-2026-85159	AVideo Reflected XSS via cancelUri in userLogin.php	AVideo	5.3 (v4.0)	Medium
CVE-2026-85577	AVideo userLogin.php Reflected XSS via error parameter	AVideo	5.3 (v4.0)	Medium
CVE-2026-89240	WWBN AVideo Reflected XSS via confirmLivePassword.php	AVideo	5.3 (v4.0)	Medium
CVE-2026-89241	WWBN AVideo Reflected XSS via confirmLivePassword.php	AVideo	5.3 (v4.0)	Medium
CVE-2026-89244	WWBN AVideo Reflected XSS via Gallery Category getBackURL	AVideo	5.3 (v4.0)	Medium
CVE-2026-91922	Steedos Platform through 3.0.15-beta.47 Reflected XSS via page render	steedos-platform	5.3 (v4.0)	Medium
CVE-2026-92584	AVideo through 29.0 Stored Cross-Site Scripting via User-Agent Header	AVideo	5.3 (v4.0)	Medium
CVE-2011-10037	Nagios XI < 2011R1.9 XSS via xiwindow Variables Affecting Permalinks	nagios xi	5.1 (v4.0)	Medium
CVE-2012-20003	Custom Tables WordPress Plugin < 3.4.6 Reflected XSS via iframe.php	Custom Tables	5.1 (v4.0)	Medium
CVE-2014-125131	DedeCMS 5.6 / 5.7 Reflected XSS via adminDirHand in config.php	DedeCMS	5.1 (v4.0)	Medium
CVE-2014-125132	Blogroll Fun WordPress Plugin < 0.8.5 Reflected XSS via blogroll.php	Blogroll Fun	5.1 (v4.0)	Medium
CVE-2017-20288	QCubed 3.1.1 Reflected XSS via installer step_2.php	QCubed	5.1 (v4.0)	Medium
CVE-2017-20290	Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed	Discourse	5.1 (v4.0)	Medium
CVE-2018-25349	userSpice 4.3.24 Cross-Site Scripting via X-Forwarded-For Header	userSpice	5.1 (v4.0)	Medium
CVE-2020-37236	NewsLister Authenticated Persistent Cross-Site Scripting via Admin Panel	NewsLister	5.1 (v4.0)	Medium
CVE-2020-37284	Sickbeard build-507 Reflected XSS via testNaming pattern Parameter	Sickbeard	5.1 (v4.0)	Medium
CVE-2022-50943	Moodle LMS 4.0 Cross-Site Scripting via course search.php	moodle	5.1 (v4.0)	Medium
CVE-2022-50948	Motopress Hotel Booking Lite 4.2.4 Stored Cross-Site Scripting	Motopress Hotel Booking Lite	5.1 (v4.0)	Medium
CVE-2022-50958	WordPress Plugin Jetpack 9.1 Cross Site Scripting via grunion-form-view.php	Jetpack	5.1 (v4.0)	Medium
CVE-2022-50959	WordPress Contact Form Builder 1.6.1 Cross-Site Scripting via code_generator.php	Contact Form Builder	5.1 (v4.0)	Medium
CVE-2022-50960	WordPress International Sms Contact Form 7 Integration 1.2 XSS	International Sms For Contact Form	5.1 (v4.0)	Medium
CVE-2022-50962	uBidAuction 2.0.1 myOrders Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2022-50963	uBidAuction 2.0.1 myAuctions active Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2022-50964	uBidAuction 2.0.1 myAuctions loose Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2022-50965	uBidAuction 2.0.1 posts manage Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2022-50966	uBidAuction 2.0.1 news manage Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2022-50968	uBidAuction 2.0.1 auctions manage Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2022-50969	uBidAuction 2.0.1 mailingLog manage Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2022-50970	WordPress Plugin AAWP 3.16 Reflected XSS via tab Parameter	WordPress Plugin AAWP	5.1 (v4.0)	Medium
CVE-2023-54358	WordPress adivaha Travel Plugin 2.3 Reflected XSS via isMobile	WordPress adivaha Travel Plugin	5.1 (v4.0)	Medium
CVE-2023-54361	Joomla iProperty Real Estate 4.1.1 Reflected XSS via filter_keyword	Joomla iProperty Real Estate	5.1 (v4.0)	Medium
CVE-2023-54362	Joomla VirtueMart Shopping-Cart 4.0.12 Reflected XSS via keyword	Cart	5.1 (v4.0)	Medium
CVE-2023-54413	WPML Multilingual CMS WordPress Plugin < 4.6.1 Reflected XSS via wp-login.php wp_lang	WPML Multilingual CMS	5.1 (v4.0)	Medium
CVE-2024-13992	Nagios XI < 2024R1.1 XSS via Missing Page / 404	nagios xi	5.1 (v4.0)	Medium
CVE-2024-58394	Retool 3.88.0 XSS via /api/imageProxy SVG Proxying	Retool	5.1 (v4.0)	Medium
CVE-2025-10354	Reflected Cross-Site Scripting (XSS) in Semantic MediaWiki	Semantic MediaWiki	5.1 (v4.0)	Medium
CVE-2025-10945	nuz007 smsboom d.php cross site scripting	smsboom	5.1 (v4.0)	Medium
CVE-2025-10946	nuz007 smsboom dy.php cross site scripting	smsboom	5.1 (v4.0)	Medium
CVE-2025-12264	Wisencode Create Support Ticket create cross site scripting	Wisencode	5.1 (v4.0)	Medium
CVE-2025-34141	ETQ Reliance - Reflected XSS via SQLConverterServlet	reliance	5.1 (v4.0)	Medium
CVE-2025-34264	Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via dog/{agentId}	wise-deviceon server	5.1 (v4.0)	Medium
CVE-2025-34301	IPFire < v2.29 Stored XSS via Location Group Creation	ipfire	5.1 (v4.0)	Medium
CVE-2025-34302	IPFire < v2.29 Stored XSS via Service Creation	ipfire	5.1 (v4.0)	Medium
CVE-2025-34313	IPFire < v2.29 Stored XSS via User Quota Rule URL Filter	ipfire	5.1 (v4.0)	Medium
CVE-2025-34314	IPFire < v2.29 Stored XSS via Time Constraint Rule URL Filter	ipfire	5.1 (v4.0)	Medium
CVE-2025-40638	Reflected Cross-Site Scripting (XSS) in Eventobot	eventobot	5.1 (v4.0)	Medium
CVE-2025-40642	Reflected Cross-Site Scripting (XSS) in WebWork	WebWork PHP script	5.1 (v4.0)	Medium
CVE-2025-40647	Stored Cross-Site Scripting (XSS) vulnerability in Issabel products	Issabel	5.1 (v4.0)	Medium
CVE-2025-40681	Cross-Site Scripting (XSS) in xCally Omnichannel	Omnichannel	5.1 (v4.0)	Medium
CVE-2025-40693	Cross Site Scripting in PHPGurukul Online Fire Reporting System	online fire reporting system	5.1 (v4.0)	Medium
CVE-2025-40700	Reflected Cross-Site Scripting (XSS) in Governalia by IDI Eikon	governalia	5.1 (v4.0)	Medium
CVE-2025-40725	Reflected Cross-Site Scripting (XSS) in Azon Dominator	Azon Dominator PHP script	5.1 (v4.0)	Medium
CVE-2025-41011	HTML injection in PHP Point Of Sale	php point of sale	5.1 (v4.0)	Medium
CVE-2025-43804	digital experience platform Cross-Site Scripting Vulnerability	digital experience platform	5.1 (v4.0)	Medium
CVE-2025-59750	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	5.1 (v4.0)	Medium
CVE-2025-59756	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	5.1 (v4.0)	Medium
CVE-2025-59758	Multiple vulnerabilities in AndSoft's e-TMS	e-tms	5.1 (v4.0)	Medium
CVE-2025-64716	Anubis vulnerable to possible XSS via redir parameter when using subrequest auth mode	anubis	5.1 (v4.0)	Medium
CVE-2025-71385	Netdata < 2.3.1 - Reflected Cross-Site Scripting via love Parameter in ilove.svg Endpoint	netdata	5.1 (v4.0)	Medium
CVE-2025-71404	better-auth before 1.1.16 Reflected XSS via error parameter	better-auth	5.1 (v4.0)	Medium
CVE-2025-9655	O2OA Personal Profile person cross site scripting	o2oa	5.1 (v4.0)	Medium
CVE-2026-100521	Cotonti through 1.0.0 Reflected XSS via search highlight parameter	Cotonti	5.1 (v4.0)	Medium
CVE-2026-100522	Cotonti through 1.0.0 Reflected XSS via message.php lng parameter	Cotonti	5.1 (v4.0)	Medium
CVE-2026-100904	amirsanni mini-inventory-and-sales-management-system Items Management Items.php cross site scripting	mini-inventory-and-sales-management-system	5.1 (v4.0)	Medium
CVE-2026-103587	QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters	QloApps	5.1 (v4.0)	Medium
CVE-2026-104461	YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField	yeswiki	5.1 (v4.0)	Medium
CVE-2026-104465	YesWiki before 4.6.7 Reflected XSS via field Parameter in mail Handler	yeswiki	5.1 (v4.0)	Medium
CVE-2026-104473	YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages	yeswiki	5.1 (v4.0)	Medium
CVE-2026-105224	YesWiki before 4.6.7 Stored XSS via Bazar valeur Action	yeswiki	5.1 (v4.0)	Medium
CVE-2026-107799	Jivejdon through 5.0 Stored XSS via messageListBody.jsp Forum Message Rendering	jivejdon	5.1 (v4.0)	Medium
CVE-2026-109327	Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.php	admidio	5.1 (v4.0)	Medium
CVE-2026-110101	Koillection through 1.8.4 Stored XSS via Datum File Attachment Uploads	Koillection	5.1 (v4.0)	Medium
CVE-2026-110625	ClipBucket v5 through 5.5.3-#206 Reflected XSS via type Parameter in flagged_item.php	clipbucket-v5	5.1 (v4.0)	Medium
CVE-2026-110626	ClipBucket v5 through 5.5.3-#206 Reflected XSS via edit_language in language_settings.php	clipbucket-v5	5.1 (v4.0)	Medium
CVE-2026-111168	LibreDesk before 2.9.0-rc.8 Stored XSS via SVG Upload Content-Type Parameter	libredesk	5.1 (v4.0)	Medium
CVE-2026-113683	VPL for Moodle before 5.0.0 Reflected XSS via similarity/diff.php filename	moodle-mod vpl	5.1 (v4.0)	Medium
CVE-2026-114407	e107 CMS before 2.3.13 Reflected XSS via search.php author Parameter	e107	5.1 (v4.0)	Medium
CVE-2026-116202	YesWiki before 4.7.0 Stored XSS via ImageField SVG Upload	yeswiki	5.1 (v4.0)	Medium
CVE-2026-1630	Reflected XSS in WEBCON BPS	WEBCON BPS	5.1 (v4.0)	Medium
CVE-2026-22675	OCS Inventory NG Server Stored XSS via User-Agent	ocs inventory server	5.1 (v4.0)	Medium
CVE-2026-25557	Evoluted PHP Directory Listing Script 4.0.5 Reflected XSS via dir parameter	PHP Directory Listing Script	5.1 (v4.0)	Medium
CVE-2026-27176	MajorDoMo - Cross-Site Scripting	majordomo	5.1 (v4.0)	Medium
CVE-2026-32856	Ellucian Banner Self-Service Reflected XSS via dateConverter	Banner Self-Service	5.1 (v4.0)	Medium
CVE-2026-34416	OSCAL-GUI Reflected XSS via project parameter in oscal.php	OSCAL-GUI	5.1 (v4.0)	Medium
CVE-2026-34417	OSCAL-GUI Reflected XSS via project parameter in oscal-forms.php	OSCAL-GUI	5.1 (v4.0)	Medium
CVE-2026-34798	Endian Firewall /cgi-bin/routing.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34800	Endian Firewall /cgi-bin/uplinkeditor.cgi NAME Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34802	Endian Firewall /cgi-bin/salearn.cgi remark user ham spam Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34803	Endian Firewall /manage/qos/classes/ name Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34804	Endian Firewall /manage/qos/rules/ dscp Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34805	Endian Firewall /cgi-bin/dnat.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34806	Endian Firewall /cgi-bin/snat.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34807	Endian Firewall /cgi-bin/incoming.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34808	Endian Firewall /cgi-bin/outgoingfw.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34809	Endian Firewall /cgi-bin/zonefw.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34810	Endian Firewall /cgi-bin/vpnfw.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34811	Endian Firewall /cgi-bin/xtaccess.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34812	Endian Firewall /cgi-bin/proxypolicy.cgi mimetypes Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34813	Endian Firewall /cgi-bin/proxyuser.cgi user Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34814	Endian Firewall /cgi-bin/proxygroup.cgi group Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34815	Endian Firewall /cgi-bin/smtpdomains.cgi DOMAIN Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34816	Endian Firewall /manage/smtpscan/domainrouting/ domain Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34817	Endian Firewall /cgi-bin/smtprouting.cgi ADDRESS BCC Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34818	Endian Firewall /manage/dnsmasq/localdomains/ remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34819	Endian Firewall /cgi-bin/openvpnclient.cgi REMARK Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34820	Endian Firewall /manage/ipsec/ remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34822	Endian Firewall /manage/ca/certificate/ new_cert_name Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34823	Endian Firewall /manage/password/web/ remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34951	Reflected XSS in footer.php in Workbench Allows Attackers to Hijack Authenticated Sessions	workbench	5.1 (v4.0)	Medium
CVE-2026-35007	Open ISES Tickets < 3.44.2 Reflected XSS via single_unit.php id Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35008	Open ISES Tickets < 3.44.2 Reflected XSS via single.php ticket_id Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35009	Open ISES Tickets < 3.44.2 Reflected XSS via add_note.php ticket_id Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35010	Open ISES Tickets < 3.44.2 Reflected XSS via patient_JF.php ticket_id Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35011	Open ISES Tickets < 3.44.2 Reflected XSS via opena.php frm_call Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35012	Open ISES Tickets < 3.44.2 Reflected XSS via add_facnote.php ticket_id Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35014	Open ISES Tickets < 3.44.2 Reflected XSS via routes_nm.php ticket_id Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35015	Open ISES Tickets < 3.44.2 Reflected XSS via do_unit_mail.php the_ticket Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-40507	OpenEMR < 8.3.0 Reflected XSS via templateHtml Parameter in Patient Portal	openemr	5.1 (v4.0)	Medium
CVE-2026-40508	OpenEMR < 8.3.0 Stored XSS via Patient Portal Template Import Handler	openemr	5.1 (v4.0)	Medium
CVE-2026-41456	Bludit CMS <= 3.20.0 - Cross-Site Scripting	bludit	5.1 (v4.0)	Medium
CVE-2026-45381	Tautulli: Reflected XSS in `/search` endpoint	Tautulli	5.1 (v4.0)	Medium
CVE-2026-48227	Open ISES Tickets < 3.44.2 Reflected XSS via patient.php id and ticket_id Parameters	Tickets	5.1 (v4.0)	Medium
CVE-2026-48228	Open ISES Tickets < 3.44.2 Reflected XSS via patient_w.php id and ticket_id Parameters	Tickets	5.1 (v4.0)	Medium
CVE-2026-48229	Open ISES Tickets < 3.44.2 Reflected XSS via routes_i.php ticket_id Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48534	GFI Archiver < 15.13 Stored XSS via ImapServerWizard.aspx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48537	GFI Archiver < 15.13 Stored XSS via FileArchiveAssistantWizard.aspx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48538	GFI Archiver < 15.13 Stored XSS via ImportSettingsWizard.ashx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48552	Nagios Core / XI DOM-based XSS via jsonquery.js	Nagios Core	5.1 (v4.0)	Medium
CVE-2026-50701	Frappe Framework 17.0.0-dev - Reflected DOM XSS in dashboard-view breadcrumb rendering	Frappe Framework	5.1 (v4.0)	Medium
CVE-2026-53992	Reflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date Parameters	ProjectSend	5.1 (v4.0)	Medium
CVE-2026-54386	marimo < 0.23.9 XSS via file Query Parameter in assets.py	marimo	5.1 (v4.0)	Medium
CVE-2026-57857	Flow Payment Plugin for WordPress Reflected Cross-Site Scripting via error_message Parameter	Flow Payment	5.1 (v4.0)	Medium
CVE-2026-57958	Mixpost 2.6.0 - Reflected XSS via OAuth Callback Error Parameter	mixpost	5.1 (v4.0)	Medium
CVE-2026-60092	AVideo - Stored Cross-Site Scripting via Unescaped User-Agent in Participants Panel	AVideo	5.1 (v4.0)	Medium
CVE-2026-6086	Stored Cross-Site Scripting in StockAgile by Novadigits technologies	StockAgile	5.1 (v4.0)	Medium
CVE-2026-61504	Rejetto HFS < 3.2.1 Stored XSS via File Names in Basic Web Listing	hfs	5.1 (v4.0)	Medium
CVE-2026-65697	Fathom Lite 1.3.1 Stored XSS via /collect Endpoint	fathom	5.1 (v4.0)	Medium
CVE-2026-66296	Reflected XSS in oaskit's default HTML error handler	oaskit	5.1 (v4.0)	Medium
CVE-2026-67333	better-auth before 1.6.13 Stored XSS via javascript redirect_uri	better-auth	5.1 (v4.0)	Medium
CVE-2026-6954	Multiple vulnerabilities in Intermark IT's WebControl CMS	WebControl CMS	5.1 (v4.0)	Medium
CVE-2026-71503	Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template	dolibarr	5.1 (v4.0)	Medium
CVE-2026-73319	XenForo < 2.3.13 XSS via Dynamic Redirect Handler	xenforo	5.1 (v4.0)	Medium
CVE-2026-75831	Grav before 2.0.15 Stored XSS via audio/video source URL	grav	5.1 (v4.0)	Medium
CVE-2026-85593	phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode	phpMyFAQ	5.1 (v4.0)	Medium
CVE-2026-85600	Grav Admin before 2.0.21 Stored XSS via username	grav-plugin-admin2	5.1 (v4.0)	Medium
CVE-2026-86197	Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox	grav	5.1 (v4.0)	Medium
CVE-2026-90567	quequnlong shiyi-blog Search index.vue highlightKeyword cross site scripting	shiyi-blog	5.1 (v4.0)	Medium
CVE-2026-96535	Cross-Site Scripting in the YouMind web application	YouMind web application	5.1 (v4.0)	Medium
CVE-2015-4666	Xceedium Xsuite - Multiple Vulnerabilities	xsuite	5.0 (v2.0)	Medium
CVE-2017-14651	WSO2 Data Analytics Server 3.1.0 - Cross-Site Scripting	api manager	4.8 (v3.1)	Medium
CVE-2024-3822	Base64 Encoder/Decoder <= 0.9.2 - Reflected XSS	base64 encoderdecoder	4.8 (v3.1)	Medium
CVE-2025-15669	Bit Form < 3.1.4 - Admin+ Stored XSS via Conversational Form Progress Label	Bit Form	4.8 (v3.1)	Medium
CVE-2025-40648	Stored Cross-Site Scripting (XSS) vulnerability in Issabel products	Issabel	4.8 (v4.0)	Medium
CVE-2025-43817	digital experience platform Cross-Site Scripting Vulnerability	digital experience platform	4.8 (v4.0)	Medium
CVE-2025-62248	digital experience platform Cross-Site Scripting Vulnerability	digital experience platform	4.8 (v4.0)	Medium
CVE-2025-9823	Reflected XSS in lead:addLeadTags - Quick Add	Mautic	4.8 (v4.0)	Medium
CVE-2026-100376	TemplateSandbox can be abused for XSS by asking another user to preview a page with a certain sandbox prefix	Mediawiki - TemplateSandbox Extension	4.8 (v4.0)	Medium
CVE-2026-111232	Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color	pfsense	4.8 (v4.0)	Medium
CVE-2026-14203	Smart Manager < 8.92.0 - Contributor+ Stored XSS via Post Title	Smart Manager	4.8 (v3.1)	Medium
CVE-2026-15233	Nested Pages < 3.2.15 - Editor+ Stored XSS via Post Title	Nested Pages	4.8 (v3.1)	Medium
CVE-2026-34096	Guardian Language-System XSS via name Parameter in designer.php	language-system	4.8 (v4.0)	Medium
CVE-2026-34097	Guardian Language-System XSS via id Parameter in text_file.php	language-system	4.8 (v4.0)	Medium
CVE-2026-34098	Guardian Language-System XSS via id Parameter in media.php	language-system	4.8 (v4.0)	Medium
CVE-2026-46516	Frogman vulnerable to stored XSS in chat console formatter (escalation vector in multi-admin deployments)	frogman	4.8 (v4.0)	Medium
CVE-2026-58657	Grav - Stored CSS Injection via Markdown Image resize() Action	Grav	4.8 (v4.0)	Medium
CVE-2026-59659	Multiple vulnerabilities in the Repasat application	Repasat application	4.8 (v4.0)	Medium
CVE-2026-59660	Multiple vulnerabilities in the Repasat application	Repasat application	4.8 (v4.0)	Medium
CVE-2026-59661	Multiple vulnerabilities in the Repasat application	Repasat application	4.8 (v4.0)	Medium
CVE-2026-59662	Multiple vulnerabilities in the Repasat application	Repasat application	4.8 (v4.0)	Medium
CVE-2026-59663	Multiple vulnerabilities in the Repasat application	Repasat application	4.8 (v4.0)	Medium
CVE-2026-59664	Multiple vulnerabilities in the Repasat application	Repasat application	4.8 (v4.0)	Medium
CVE-2026-59665	Multiple vulnerabilities in the Repasat application	Repasat application	4.8 (v4.0)	Medium
CVE-2026-59666	Multiple vulnerabilities in the Repasat application	Repasat application	4.8 (v4.0)	Medium
CVE-2026-59667	Multiple vulnerabilities in the Repasat application	Repasat application	4.8 (v4.0)	Medium
CVE-2026-59668	Multiple vulnerabilities in the Repasat application	Repasat application	4.8 (v4.0)	Medium
CVE-2026-59669	Multiple vulnerabilities in the Repasat application	Repasat application	4.8 (v4.0)	Medium
CVE-2026-59670	Multiple vulnerabilities in the Repasat application	Repasat application	4.8 (v4.0)	Medium
CVE-2026-59672	Multiple vulnerabilities in the Repasat application	Repasat application	4.8 (v4.0)	Medium
CVE-2026-59673	Multiple vulnerabilities in the Repasat application	Repasat application	4.8 (v4.0)	Medium
CVE-2026-63001	REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`	redaxo	4.8 (v3.1)	Medium
CVE-2026-67612	OpenEMR 8.2.0 Stored XSS via import_template.php Template Management	openemr	4.8 (v4.0)	Medium
CVE-2026-67617	Microweber CMS 2.0.20 Stored XSS via tag_names Parameter	microweber	4.8 (v4.0)	Medium
CVE-2026-7171	Stored Cross-Site Scripting (XSS) in TPVEnlanube	Cloud Web application	4.8 (v4.0)	Medium
CVE-2026-7172	Stored Cross-Site Scripting (XSS) in TPVEnlanube	Cloud Web application	4.8 (v4.0)	Medium
CVE-2026-84188	librenms before 26.7.0 Stored XSS via graph_descr settings	librenms	4.8 (v4.0)	Medium
CVE-2026-85293	InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer Forms	InvoicePlane	4.8 (v3.1)	Medium
CVE-2026-90569	linlinjava litemall Admin Topic index.vue AdminTopicController.validate cross site scripting	litemall	4.8 (v4.0)	Medium
CVE-2026-90570	linlinjava litemall Product Detail index.vue AdminGoodsService.validate cross site scripting	litemall	4.8 (v4.0)	Medium
CVE-2026-95662	Multiple vulnerabilities in the Repasat application	Repasat application	4.8 (v4.0)	Medium
CVE-2026-9577	Post Status Notifier Lite < 1.13.0 - Reflected XSS via mod Parameter	Post Status Notifier Lite	4.8 (v3.1)	Medium
CVE-2023-45671	Frigate < 0.13.0 Beta 3 - Cross-Site Scripting	frigate	4.7 (v3.1)	Medium
CVE-2026-3093	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab	gitlab	4.7 (v3.1)	Medium
CVE-2026-4406	Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' Parameter	Gravity Forms	4.7 (v3.1)	Medium
CVE-2026-16273	Narrative Publisher <= 1.0.7 - Contributor+ Stored XSS via narrative_post_script Post Meta	Narrative Publisher	4.6 (v3.1)	Medium
CVE-2026-50698	Frappe Framework 17.0.0-dev - Stored XSS in Audit Trail template rendering	Frappe Framework	4.6 (v4.0)	Medium
CVE-2015-4665	Xceedium Xsuite - Multiple Vulnerabilities	xsuite	4.3 (v2.0)	Medium
CVE-2026-32250	NamelessMC has Reflected Cross-Site Scripting (XSS) in id parameter of /index.php?route=/queries/user/	Nameless	4.3 (v3.1)	Medium
CVE-2026-55566	Yamcs: DOM XSS in Extension Routing	yamcs	4.3 (v3.1)	Medium
CVE-2026-102576	Quay: quay: dom-based cross-site scripting via unvalidated redirect_url on signin page	Red Hat Quay 3	4.2 (v3.1)	Medium
CVE-2026-113657	ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)	apostrophe	3.7 (v3.1)	Low
CVE-2025-66040	Spotipy has a XSS vulnerability in OAuth callback server	spotipy	3.6 (v3.1)	Low
CVE-2026-9061	Agile Store Locator < 1.6.9 - Admin+ Stored XSS via logo_name	Store Locator WordPress	3.5 (v3.1)	Low
CVE-2026-91165	Warpgate: Markup injection in SSO form_post return page via unencoded redirect/error values	warpgate	2.4 (v3.1)	Low
CVE-2026-114127	Astro: Arbitrary CSS injection in Astro View Transitions	astro	2.3 (v4.0)	Low
CVE-2026-66300	SNOMED International Snowstorm reflected XSS	Snowstorm	2.3 (v4.0)	Low
CVE-2025-10063	itsourcecode POS Point of Sale System deferred_table.php cross site scripting	point of sale system	2.1 (v4.0)	Low
CVE-2025-10067	itsourcecode POS Point of Sale System empty_table.php cross site scripting	point of sale system	2.1 (v4.0)	Low
CVE-2025-10590	Portabilis i-Educar educar_usuario_det.php cross site scripting	i-educar	2.1 (v4.0)	Low
CVE-2025-10614	itsourcecode E-Logbook with Health Monitoring System for COVID-19 print_reports_prev.php cross site scripting	e-logbook with health monitoring system for covid-19	2.1 (v4.0)	Low
CVE-2025-10710	07FLYCMS/07FLY-CMS/07FlyCRM index.php cross site scripting	07FLYCMS	2.1 (v4.0)	Low
CVE-2025-10711	07FLYCMS/07FLY-CMS/07FlyCRM Login cross site scripting	07FLYCMS	2.1 (v4.0)	Low
CVE-2025-10827	PHPJabbers Restaurant Menu Maker preview.php cross site scripting	restaurant menu maker	2.1 (v4.0)	Low
CVE-2025-11112	PHPGurukul Employee Record Management System myprofile.php cross site scripting	employee record management system	2.1 (v4.0)	Low
CVE-2025-11306	qianfox FoxCMS Search cross site scripting	foxcms	2.1 (v4.0)	Low
CVE-2025-12244	code-projects Simple E-Banking System register.php cross site scripting	simple e-banking system	2.1 (v4.0)	Low
CVE-2025-12289	Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 1001 cross site scripting	Suishang Enterprise-Level B2B2C Multi-User Mall System	2.1 (v4.0)	Low
CVE-2025-12290	Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 359 cross site scripting	Suishang Enterprise-Level B2B2C Multi-User Mall System	2.1 (v4.0)	Low
CVE-2025-15093	sunkaifei FlyCMS Admin Login IndexAdminController.java cross site scripting	flycms	2.1 (v4.0)	Low
CVE-2025-15094	sunkaifei FlyCMS User Login UserController.java userLogin cross site scripting	flycms	2.1 (v4.0)	Low
CVE-2025-15144	dayrui XunRuiCMS JSONP Callback Init.php dr_exit_msg cross site scripting	xunruicms	2.1 (v4.0)	Low
CVE-2025-15220	SohuTV CacheCloud LoginController.java init cross site scripting	cachecloud	2.1 (v4.0)	Low
CVE-2025-9647	mtons mblog list cross site scripting	mblog	2.1 (v4.0)	Low
CVE-2025-9755	Khanakag-17 Library Management System index.php cross site scripting	library management system	2.1 (v4.0)	Low
CVE-2025-9773	RemoteClinic edit.php cross site scripting	remote clinic	2.1 (v4.0)	Low
CVE-2026-100313	mathurvishal CloudClassroom-PHP-Project updatequery.php cross site scripting	CloudClassroom-PHP-Project	2.1 (v4.0)	Low
CVE-2026-10153	westboy CicadasCMS AbstractCacheManager.java search cross site scripting	CicadasCMS	2.1 (v4.0)	Low
CVE-2026-10173	Orthanc Explorer 2 URL StudyList.vue cross site scripting	Explorer 2	2.1 (v4.0)	Low
CVE-2026-10301	itsourcecode Fees Management System index.php cross site scripting	Fees Management System	2.1 (v4.0)	Low
CVE-2026-105288	feelec-yishu feelcrm-os Crm Endpoint functions.php index cross site scripting	feelcrm-os	2.1 (v4.0)	Low
CVE-2026-105291	feelec-yishu feelcrm-os Department Search Endpoint GroupController.class.php index cross site scripting	feelcrm-os	2.1 (v4.0)	Low
CVE-2026-105708	imgproxy SVG svg.go sanitizeElement cross site scripting	imgproxy	2.1 (v4.0)	Low
CVE-2026-105809	SourceCodester Simple Student Information System Profile Field register.php cross site scripting	Simple Student Information System	2.1 (v4.0)	Low
CVE-2026-10810	itsourcecode Fees Management System navbar.php cross site scripting	Fees Management System	2.1 (v4.0)	Low
CVE-2026-108932	Netcore NR268 DHCP Hostname filter_hosts_dump.cgi eval cross site scripting	NR268	2.1 (v4.0)	Low
CVE-2026-111877	dext34-morgan Books4Cash search.php cross site scripting	Books4Cash	2.1 (v4.0)	Low
CVE-2026-111942	hrisikeshpal Blood_Bank_Management_System abs.php cross site scripting	Blood Bank Management System	2.1 (v4.0)	Low
CVE-2026-11337	tittuvarghese CollegeManagementSystem fetch.php cross site scripting	CollegeManagementSystem	2.1 (v4.0)	Low
CVE-2026-113741	itsourcecode Online Cake Ordering System 404.php cross site scripting	Online Cake Ordering System	2.1 (v4.0)	Low
CVE-2026-11436	Mage AI Sign-in Flow index.tsx useMutation cross site scripting	Mage AI	2.1 (v4.0)	Low
CVE-2026-11512	itsourcecode Hospital Management System billing.php cross site scripting	Hospital Management System	2.1 (v4.0)	Low
CVE-2026-116047	Privoce Vocechat Query Parameter widget.html cross site scripting	Vocechat	2.1 (v4.0)	Low
CVE-2026-13554	itsourcecode Online Hotel Management System POST Request controller.php add cross site scripting	Online Hotel Management System	2.1 (v4.0)	Low
CVE-2026-13556	itsourcecode Online Hotel Management System POST Request controller.php edit cross site scripting	Online Hotel Management System	2.1 (v4.0)	Low
CVE-2026-13557	itsourcecode Online Hotel Management System POST Request controller.php add cross site scripting	Online Hotel Management System	2.1 (v4.0)	Low
CVE-2026-14656	code-projects Assessment Management remove-user.php cross site scripting	Assessment Management	2.1 (v4.0)	Low
CVE-2026-14704	stephen-kruger bluebox cross site scripting	bluebox	2.1 (v4.0)	Low
CVE-2026-15595	SourceCodester Class and Exam Timetabling System forsubject.php cross site scripting	Class and Exam Timetabling System	2.1 (v4.0)	Low
CVE-2026-15596	SourceCodester Class and Exam Timetabling System subject.php cross site scripting	Class and Exam Timetabling System	2.1 (v4.0)	Low
CVE-2026-15715	SourceCodester Class and Exam Timetabling System exam.php cross site scripting	Class and Exam Timetabling System	2.1 (v4.0)	Low
CVE-2026-16220	code-projects Online Examination System account.php cross site scripting	Online Examination System	2.1 (v4.0)	Low
CVE-2026-16229	itsourcecode Courier Management System index.php cross site scripting	Courier Management System	2.1 (v4.0)	Low
CVE-2026-16485	SourceCodester Class and Exam Timetabling System class.php cross site scripting	Class and Exam Timetabling System	2.1 (v4.0)	Low
CVE-2026-16486	SourceCodester Class and Exam Timetabling System BSIS.php cross site scripting	Class and Exam Timetabling System	2.1 (v4.0)	Low
CVE-2026-18968	ttttonyhe OBlog tags.php cross site scripting	OBlog	2.1 (v4.0)	Low
CVE-2026-5825	code-projects Simple Laundry System delmemberinfo.php cross site scripting	Simple Laundry System	2.1 (v4.0)	Low
CVE-2026-5826	code-projects Simple IT Discussion Forum edit-category.php cross site scripting	Simple IT Discussion Forum	2.1 (v4.0)	Low
CVE-2026-6032	code-projects Simple Laundry System checkcheckout.php cross site scripting	Simple Laundry System	2.1 (v4.0)	Low
CVE-2026-66882	Reflected XSS in AshAuthentication confirmation and magic link interaction forms	ash authentication	2.1 (v4.0)	Low
CVE-2026-75077	SourceCodester Class and Exam Timetabling System BSCE2.php cross site scripting	Class and Exam Timetabling System	2.1 (v4.0)	Low
CVE-2026-75078	SourceCodester Class and Exam Timetabling System BSHRM1.php cross site scripting	Class and Exam Timetabling System	2.1 (v4.0)	Low
CVE-2026-78054	SourceCodester Class and Exam Timetabling System BSIS1.php cross site scripting	Class and Exam Timetabling System	2.1 (v4.0)	Low
CVE-2026-78055	SourceCodester Class and Exam Timetabling System BSIT2.php cross site scripting	Class and Exam Timetabling System	2.1 (v4.0)	Low
CVE-2026-79793	code-projects Online Shopping System sumit_form.php cross site scripting	Online Shopping System	2.1 (v4.0)	Low
CVE-2026-82601	SeaCMS err.php cross site scripting	SeaCMS	2.1 (v4.0)	Low
CVE-2026-82664	yaojingang GEOFlow JSON-LD Theme HomeController.php cross site scripting	GEOFlow	2.1 (v4.0)	Low
CVE-2026-85021	langgenius dify Splash Layout splash.tsx router.replace cross site scripting	dify	2.1 (v4.0)	Low
CVE-2026-86216	code-projects Hotel and Tourism Reservation in PHP details.php cross site scripting	Hotel and Tourism Reservation in PHP	2.1 (v4.0)	Low
CVE-2026-86244	FastAdmin User Controller User.php login cross site scripting	FastAdmin	2.1 (v4.0)	Low
CVE-2026-86278	SourceCodester Syllabus-Aligned Learning Management & Examination System manage_subjects.php cross site scripting	Syllabus-Aligned Learning Management & Examination System	2.1 (v4.0)	Low
CVE-2026-87926	Rizwan17 inventory-management-system Login Page index.php cross site scripting	inventory-management-system	2.1 (v4.0)	Low
CVE-2026-90615	SourceCodester Class and Exam Timetabling System subject1.php cross site scripting	Class and Exam Timetabling System	2.1 (v4.0)	Low
CVE-2026-90795	itsourcecode Loan Management System navbar.php cross site scripting	Loan Management System	2.1 (v4.0)	Low
CVE-2026-9415	code-projects Employee Management System eloginwel.php cross site scripting	Employee Management System	2.1 (v4.0)	Low
CVE-2026-9416	code-projects Employee Management System myprofile.php cross site scripting	Employee Management System	2.1 (v4.0)	Low
CVE-2026-9417	code-projects Employee Management System myprofileup.php cross site scripting	Employee Management System	2.1 (v4.0)	Low
CVE-2026-9418	code-projects Employee Management System changepassemp.php cross site scripting	Employee Management System	2.1 (v4.0)	Low
CVE-2026-9419	code-projects Employee Management System empproject.php cross site scripting	Employee Management System	2.1 (v4.0)	Low
CVE-2026-9448	code-projects Employee Management System applyleave.php cross site scripting	Employee Management System	2.1 (v4.0)	Low
CVE-2026-9519	stonith404 pingvin-share Sign-in Auto-Redirect signIn.tsx getServerSideProps cross site scripting	pingvin-share	2.1 (v4.0)	Low
CVE-2026-9520	blitz-js blitz Sign-in LoginForm.tsx cross site scripting	blitz	2.1 (v4.0)	Low
CVE-2026-9527	itsourcecode Electronic Judging System judges.php cross site scripting	Electronic Judging System	2.1 (v4.0)	Low
CVE-2026-9566	teableio teable Sign-up LoginPage.tsx cross site scripting	teable	2.1 (v4.0)	Low
CVE-2025-10591	Portabilis i-Educar Editar Função educar_funcao_cad.php cross site scripting	i-educar	2.0 (v4.0)	Low
CVE-2025-10837	code-projects Simple Food Ordering System order.php cross site scripting	simple food ordering system	2.0 (v4.0)	Low
CVE-2025-11332	CmsEasy URL view.php cross site scripting	cmseasy	2.0 (v4.0)	Low
CVE-2025-11433	itsourcecode Leave Management System Query Parameter controller.php redirect cross site scripting	leave management system	2.0 (v4.0)	Low
CVE-2025-11851	Apeman ID71 set_alias.cgi cross site scripting	ID71	2.0 (v4.0)	Low
CVE-2025-12224	Iqbolshoh php-business-website contact.php cross site scripting	php-business-website	2.0 (v4.0)	Low
CVE-2025-13343	SourceCodester Interview Management System editQuestion.php cross site scripting	interview management system	2.0 (v4.0)	Low
CVE-2025-13450	SourceCodester Online Shop Project register.php cross site scripting	online shop project	2.0 (v4.0)	Low
CVE-2025-14006	dayrui XunRuiCMS Add Data Validation admind45f74adbd95.php cross site scripting	xunruicms	2.0 (v4.0)	Low
CVE-2025-14194	code-projects Employee Profile Management System view_personnel.php cross site scripting	employee profile management system	2.0 (v4.0)	Low
CVE-2025-15172	SohuTV CacheCloud RedisConfigTemplateController.java preview cross site scripting	cachecloud	2.0 (v4.0)	Low
CVE-2025-15173	SohuTV CacheCloud InstanceController.java advancedAnalysis cross site scripting	cachecloud	2.0 (v4.0)	Low
CVE-2025-62653	Stored XSS through system messages in PollNY	MediaWiki PollNY extension	2.0 (v4.0)	Low
CVE-2025-7871	Portabilis i-Diario conteudos cross site scripting	i-diario	2.0 (v4.0)	Low
CVE-2025-9657	O2OA Personal Profile script cross site scripting	o2oa	2.0 (v4.0)	Low
CVE-2025-9658	O2OA Personal Profile dict cross site scripting	o2oa	2.0 (v4.0)	Low
CVE-2025-9659	O2OA Personal Profile widget cross site scripting	o2oa	2.0 (v4.0)	Low
CVE-2025-9680	O2OA Personal Profile page cross site scripting	o2oa	2.0 (v4.0)	Low
CVE-2025-9681	O2OA Personal Profile agent cross site scripting	o2oa	2.0 (v4.0)	Low
CVE-2025-9682	O2OA Personal Profile appdict cross site scripting	o2oa	2.0 (v4.0)	Low
CVE-2025-9683	O2OA Personal Profile form cross site scripting	o2oa	2.0 (v4.0)	Low
CVE-2025-9715	O2OA Personal Profile script cross site scripting	o2oa	2.0 (v4.0)	Low
CVE-2025-9716	O2OA Personal Profile form cross site scripting	o2oa	2.0 (v4.0)	Low
CVE-2025-9717	O2OA Personal Profile unit cross site scripting	o2oa	2.0 (v4.0)	Low
CVE-2025-9718	O2OA Personal Profile process cross site scripting	o2oa	2.0 (v4.0)	Low
CVE-2025-9719	O2OA Personal Profile script cross site scripting	o2oa	2.0 (v4.0)	Low
CVE-2025-9734	O2OA Personal Profile stat cross site scripting	o2oa	2.0 (v4.0)	Low
CVE-2025-9735	O2OA Personal Profile table cross site scripting	o2oa	2.0 (v4.0)	Low
CVE-2025-9737	O2OA Personal Profile importmodel cross site scripting	o2oa	2.0 (v4.0)	Low
CVE-2026-101141	Eleveo Call Recording Software Play Audio audio.jsp cross site scripting	Call Recording Software	2.0 (v4.0)	Low
CVE-2026-102264	mwasikz robo-cafe-rms Edit Profile Feature update-account.php cross site scripting	robo-cafe-rms	2.0 (v4.0)	Low
CVE-2026-10234	Mettle sendportal Campaign webview cross site scripting	sendportal	2.0 (v4.0)	Low
CVE-2026-10244	SourceCodester Pharmacy Sales and Inventory System main create_medicine_name cross site scripting	Pharmacy Sales and Inventory System	2.0 (v4.0)	Low
CVE-2026-10245	SourceCodester Pharmacy Sales and Inventory System main create_supplier cross site scripting	Pharmacy Sales and Inventory System	2.0 (v4.0)	Low
CVE-2026-10246	SourceCodester Pharmacy Sales and Inventory System main create_medicine_presentation cross site scripting	Pharmacy Sales and Inventory System	2.0 (v4.0)	Low
CVE-2026-10247	SourceCodester Pharmacy Sales and Inventory System main create_generic_name cross site scripting	Pharmacy Sales and Inventory System	2.0 (v4.0)	Low
CVE-2026-105808	SourceCodester Simple Student Information System searchresults.php clean cross site scripting	Simple Student Information System	2.0 (v4.0)	Low
CVE-2026-15678	code-projects Online Job Portal DetailJob.php cross site scripting	Online Job Portal	2.0 (v4.0)	Low
CVE-2026-16155	SourceCodester Class and Exam Timetabling System schoolyr.php cross site scripting	Class and Exam Timetabling System	2.0 (v4.0)	Low
CVE-2026-16156	SourceCodester Class and Exam Timetabling System forexam.php cross site scripting	Class and Exam Timetabling System	2.0 (v4.0)	Low
CVE-2026-16202	SourceCodester Class and Exam Timetabling System CYS.php cross site scripting	Class and Exam Timetabling System	2.0 (v4.0)	Low
CVE-2026-16203	SourceCodester Class and Exam Timetabling System forCYS.php cross site scripting	Class and Exam Timetabling System	2.0 (v4.0)	Low
CVE-2026-5810	SourceCodester Sales and Inventory System GET Parameter delete.php cross site scripting	Sales and Inventory System	2.0 (v4.0)	Low
CVE-2026-82665	yaojingang GEOFlow Image Library Cleanup ImageLibraryController.php unlink path traversal	GEOFlow	2.0 (v4.0)	Low
CVE-2026-82666	yaojingang GEOFlow Superadmin Theme Editor SiteThemeEditorController.php preview code injection	GEOFlow	2.0 (v4.0)	Low
CVE-2026-82667	yaojingang GEOFlow GenericHttpEndpointResolver.php DistributionController.isValidHttpEndpoint server-side request forger	GEOFlow	2.0 (v4.0)	Low
CVE-2026-84438	OpenCart Autocomplete Workflow edit.php cross site scripting	OpenCart	2.0 (v4.0)	Low
CVE-2026-85022	langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting	dify	2.0 (v4.0)	Low
CVE-2026-86301	code-projects Hospital Information System Patient Management editPatient.php cross site scripting	Hospital Information System	2.0 (v4.0)	Low
CVE-2026-90695	SourceCodester Inventory Management System Vendor Management vendors_handler.php cross site scripting	Inventory Management System	2.0 (v4.0)	Low
CVE-2026-90696	SourceCodester Inventory Management System Product Management products_handler.php cross site scripting	Inventory Management System	2.0 (v4.0)	Low
CVE-2026-93956	olivier-ls PHP-FTS Search SearchEngine.php buildHighlights cross site scripting	PHP-FTS	2.0 (v4.0)	Low
CVE-2025-10099	Portabilis i-Educar Editar usuário educar_usuario_cad.php cross site scripting	i-educar	1.9 (v4.0)	Low
CVE-2025-10234	Scada-LTS Data Point Edit data_point_edit.shtm cross site scripting	scada-lts	1.9 (v4.0)	Low
CVE-2025-10235	Scada-LTS Reports reports.shtm cross site scripting	scada-lts	1.9 (v4.0)	Low
CVE-2025-10940	Total.js CMS Layout admin layouts_save cross site scripting	total.js	1.9 (v4.0)	Low
CVE-2025-11027	givanz Vvveb SVG File cross site scripting	vvveb	1.9 (v4.0)	Low
CVE-2025-11289	westboy CicadasCMS Template Management TemplateFileServiceImpl.java save cross site scripting	cicadascms	1.9 (v4.0)	Low
CVE-2025-12311	PHPGurukul Curfew e-Pass Management System edit-category-detail.php cross site scripting	curfew e-pass management system	1.9 (v4.0)	Low
CVE-2025-12312	PHPGurukul Curfew e-Pass Management System view-pass-detail.php cross site scripting	curfew e-pass management system	1.9 (v4.0)	Low
CVE-2025-13186	Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution manage_customer cross site scripting	isshue	1.9 (v4.0)	Low
CVE-2025-13412	Campcodes Retro Basketball Shoes Online Store admin_running.php cross site scripting	retro basketball shoes online store	1.9 (v4.0)	Low
CVE-2025-14991	Campcodes Complete Online Beauty Parlor Management System bwdates-reports-details.php cross site scripting	complete online beauty parlor management system	1.9 (v4.0)	Low
CVE-2025-15188	Campcodes Complete Online Beauty Parlor Management System search-invoices.php cross site scripting	online beauty parlor management system	1.9 (v4.0)	Low
CVE-2025-15416	xnx3 wangmarket Add Global Variable save.do cross site scripting	wangmarket	1.9 (v4.0)	Low
CVE-2025-15451	xnx3 wangmarket System Variables variableSave.do cross site scripting	wangmarket	1.9 (v4.0)	Low
CVE-2025-15452	xnx3 wangmarket Backend Variable Search variableList.do variableList cross site scripting	wangmarket	1.9 (v4.0)	Low
CVE-2026-108908	Netcore NR268 Web UI l7_call_board_user_set.cgi eval cross site scripting	NR268	1.9 (v4.0)	Low
CVE-2026-112039	diem-project diem Administrative Console actions.class.php append cross site scripting	diem	1.9 (v4.0)	Low
CVE-2026-11434	FluentCMS Blocks Plugin blocks cross site scripting	FluentCMS	1.9 (v4.0)	Low
CVE-2026-11468	SourceCodester Hospitals Patient Records Management System page room_types cross site scripting	Hospitals Patient Records Management System	1.9 (v4.0)	Low
CVE-2026-115981	phpIPAM index.php cross site scripting	phpIPAM	1.9 (v4.0)	Low
CVE-2026-5834	code-projects Online Shoe Store admin_running.php cross site scripting	Online Shoe Store	1.9 (v4.0)	Low
CVE-2026-5835	code-projects Online Shoe Store admin_football.php cross site scripting	Online Shoe Store	1.9 (v4.0)	Low
CVE-2026-5836	code-projects Online Shoe Store admin_product.php cross site scripting	Online Shoe Store	1.9 (v4.0)	Low
CVE-2026-90850	PHPGurukul Hostel Management System manage-students.php cross site scripting	Hostel Management System	1.9 (v4.0)	Low
CVE-2026-94150	Omega Solution HRM OS SVG File Upload view cross site scripting	HRM OS	1.9 (v4.0)	Low
CVE-2026-9564	SourceCodester/oretnom23 Hospitals Patient Records Management System view_patient cross site scripting	Hospitals Patient Records Management System	1.9 (v4.0)	Low
CVE-2025-15454	zhanglun lettura RSS ContentRender.tsx cross site scripting	lettura	1.3 (v4.0)	Low
CVE-2026-78187	Piwigo Public Authentication cross site scripting	Piwigo	1.3 (v4.0)	Low
CVE-2025-14007	dayrui XunRuiCMS Domain Name Binding admin79f2ec220c7e.php cross site scripting	xunruicms	1.1 (v4.0)	Low
CVE-2026-58038	Stored XSS through javascript URLs in SVGs generated by EasyTimeline	mediawiki	0.0 (v4.0)	None

Observed CWEs

These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.

CWE	Related Published CVEs
CWE-20	CVE-2015-4664 , CVE-2025-61583
CWE-22	CVE-2015-4666 , CVE-2026-82665
CWE-73	CVE-2023-30943
CWE-74	CVE-2026-82666
CWE-79	CVE-2026-54067 , CVE-2026-104252 , CVE-2026-47428 , CVE-2026-53662 , CVE-2026-55085 , CVE-2026-102989 , CVE-2026-105089 , CVE-2026-42849 , CVE-2026-54527 , CVE-2026-55486 , CVE-2026-57858 , CVE-2026-58491 , CVE-2026-66394 , CVE-2026-78997 , CVE-2026-88869 , CVE-2026-89255 , CVE-2026-89243 , CVE-2026-34448 , CVE-2026-42556 , CVE-2026-62378 , CVE-2026-43984 , CVE-2026-42455 , CVE-2026-70650 , CVE-2026-12496 , CVE-2026-13323 , CVE-2026-44667 , CVE-2026-44729 , CVE-2026-45115 , CVE-2026-45116 , CVE-2026-48026 , CVE-2026-48527 , CVE-2026-54347 , CVE-2026-84683 , CVE-2026-103904 , CVE-2026-34463 , CVE-2026-49864 , CVE-2026-67328 , CVE-2026-92985 , CVE-2026-9585 , CVE-2025-39663 , CVE-2026-21618 , CVE-2026-55665 , CVE-2026-58113 , CVE-2026-63361 , CVE-2026-71483 , CVE-2026-5385 , CVE-2026-77072 , CVE-2026-85613 , CVE-2026-87811 , CVE-2026-44203 , CVE-2026-48788 , CVE-2026-54253 , CVE-2026-56670 , CVE-2026-63135 , CVE-2025-62716 , CVE-2026-18147 , CVE-2026-39344 , CVE-2026-48060 , CVE-2026-50758 , CVE-2025-12029 , CVE-2026-58390 , CVE-2026-55659 , CVE-2026-116167 , CVE-2026-32308 , CVE-2026-59814 , CVE-2026-12592 , CVE-2026-44657 , CVE-2026-67237 , CVE-2026-73546 , CVE-2026-7460 , CVE-2026-87812 , CVE-2025-11189 , CVE-2026-30819 , CVE-2026-6735 , CVE-2026-8203 , CVE-2025-11994 , CVE-2025-14151 , CVE-2026-101928 , CVE-2026-102562 , CVE-2026-107764 , CVE-2026-109193 , CVE-2026-13359 , CVE-2026-17506 , CVE-2026-18756 , CVE-2026-4267 , CVE-2026-5934 , CVE-2026-75528 , CVE-2026-83625 , CVE-2026-87091 , CVE-2026-89417 , CVE-2026-93756 , CVE-2026-95670 , CVE-2026-96561 , CVE-2026-96566 , CVE-2022-35499 , CVE-2025-13071 , CVE-2025-14701 , CVE-2026-115457 , CVE-2026-12970 , CVE-2026-14234 , CVE-2026-14239 , CVE-2026-14870 , CVE-2026-34598 , CVE-2026-6495 , CVE-2026-76790 , CVE-2026-84192 , CVE-2026-9833 , CVE-2026-58411 , CVE-2025-11937 , CVE-2025-43779 , CVE-2025-4388 , CVE-2025-59746 , CVE-2025-59747 , CVE-2025-59748 , CVE-2025-59749 , CVE-2025-62597 , CVE-2025-62598 , CVE-2025-62613 , CVE-2025-62662 , CVE-2025-62663 , CVE-2025-62664 , CVE-2025-62670 , CVE-2025-62671 , CVE-2025-62693 , CVE-2025-62695 , CVE-2025-62698 , CVE-2025-62700 , CVE-2026-39838 , CVE-2026-39936 , CVE-2026-44651 , CVE-2026-69092 , CVE-2026-73848 , CVE-2026-86188 , CVE-2026-13605 , CVE-2026-14817 , CVE-2026-14833 , CVE-2026-15047 , CVE-2026-16069 , CVE-2026-33741 , CVE-2026-39311 , CVE-2025-32430 , CVE-2026-24128 , CVE-2026-55549 , CVE-2026-78838 , CVE-2026-88618 , CVE-2025-10130 , CVE-2025-10139 , CVE-2025-10189 , CVE-2025-13135 , CVE-2025-14387 , CVE-2025-9130 , CVE-2026-0552 , CVE-2026-0626 , CVE-2026-0737 , CVE-2026-0738 , CVE-2026-100106 , CVE-2026-109983 , CVE-2026-13203 , CVE-2026-13770 , CVE-2026-3885 , CVE-2026-50592 , CVE-2026-5092 , CVE-2026-5391 , CVE-2026-6454 , CVE-2026-87870 , CVE-2026-8977 , CVE-2026-9281 , CVE-2026-115513 , CVE-2026-43980 , CVE-2025-34281 , CVE-2015-9312 , CVE-2017-15687 , CVE-2017-7855 , CVE-2018-12111 , CVE-2018-19287 , CVE-2018-6882 , CVE-2018-7653 , CVE-2019-20141 , CVE-2019-9912 , CVE-2020-12054 , CVE-2020-14413 , CVE-2020-19515 , CVE-2020-27982 , CVE-2020-29164 , CVE-2021-24235 , CVE-2021-24910 , CVE-2021-24987 , CVE-2021-25055 , CVE-2021-25085 , CVE-2021-3030 , CVE-2021-37573 , CVE-2021-41878 , CVE-2021-46387 , CVE-2022-0271 , CVE-2022-1168 , CVE-2022-1170 , CVE-2022-2290 , CVE-2022-23397 , CVE-2022-24384 , CVE-2022-25323 , CVE-2022-2733 , CVE-2022-27926 , CVE-2022-35493 , CVE-2022-4971 , CVE-2023-23161 , CVE-2023-23548 , CVE-2023-24488 , CVE-2023-2822 , CVE-2023-29489 , CVE-2023-2949 , CVE-2023-3521 , CVE-2023-37580 , CVE-2023-38194 , CVE-2023-3843 , CVE-2023-3844 , CVE-2023-3845 , CVE-2023-3846 , CVE-2023-3847 , CVE-2023-3848 , CVE-2023-3849 , CVE-2023-38501 , CVE-2023-39598 , CVE-2023-39600 , CVE-2023-39700 , CVE-2023-40750 , CVE-2023-40751 , CVE-2023-40752 , CVE-2023-4173 , CVE-2023-4174 , CVE-2023-43325 , CVE-2023-43326 , CVE-2023-44352 , CVE-2023-4451 , CVE-2023-49494 , CVE-2023-51769 , CVE-2023-5758 , CVE-2023-6697 , CVE-2024-34321 , CVE-2024-34326 , CVE-2025-12123 , CVE-2025-25296 , CVE-2025-54597 , CVE-2025-55757 , CVE-2025-62358 , CVE-2025-63238 , CVE-2025-63607 , CVE-2025-63737 , CVE-2025-63949 , CVE-2025-65013 , CVE-2025-65019 , CVE-2025-65233 , CVE-2025-66026 , CVE-2025-67495 , CVE-2025-67648 , CVE-2025-9952 , CVE-2026-103888 , CVE-2026-107393 , CVE-2026-113659 , CVE-2026-11881 , CVE-2026-12982 , CVE-2026-14207 , CVE-2026-14845 , CVE-2026-14921 , CVE-2026-17532 , CVE-2026-18843 , CVE-2026-30251 , CVE-2026-30252 , CVE-2026-31013 , CVE-2026-34206 , CVE-2026-34739 , CVE-2026-36468 , CVE-2026-37750 , CVE-2026-38444 , CVE-2026-38472 , CVE-2026-38947 , CVE-2026-39275 , CVE-2026-42253 , CVE-2026-4246 , CVE-2026-44767 , CVE-2026-50182 , CVE-2026-51133 , CVE-2026-51565 , CVE-2026-52232 , CVE-2026-54714 , CVE-2026-55087 , CVE-2026-61526 , CVE-2026-62280 , CVE-2026-73084 , CVE-2026-78738 , CVE-2026-82382 , CVE-2026-8447 , CVE-2026-84925 , CVE-2026-8626 , CVE-2026-89047 , CVE-2026-92974 , CVE-2026-96594 , CVE-2023-6717 , CVE-2026-5696 , CVE-2025-62657 , CVE-2025-8280 , CVE-2026-36470 , CVE-2026-84193 , CVE-2025-62365 , CVE-2025-62421 , CVE-2020-20285 , CVE-2022-35497 , CVE-2023-1317 , CVE-2024-23176 , CVE-2025-5343 , CVE-2025-59788 , CVE-2025-61597 , CVE-2025-62178 , CVE-2025-62430 , CVE-2026-102295 , CVE-2026-103421 , CVE-2026-106033 , CVE-2026-15234 , CVE-2026-15245 , CVE-2026-15262 , CVE-2026-16063 , CVE-2026-16537 , CVE-2026-18395 , CVE-2026-34974 , CVE-2026-35403 , CVE-2026-38473 , CVE-2026-39964 , CVE-2026-45694 , CVE-2026-63498 , CVE-2026-72570 , CVE-2026-72583 , CVE-2026-82396 , CVE-2026-91021 , CVE-2024-58292 , CVE-2024-58391 , CVE-2025-34398 , CVE-2025-34400 , CVE-2025-34408 , CVE-2025-34425 , CVE-2025-62359 , CVE-2025-62800 , CVE-2025-66460 , CVE-2026-100381 , CVE-2026-105114 , CVE-2026-107797 , CVE-2026-109352 , CVE-2026-109355 , CVE-2026-116203 , CVE-2026-35208 , CVE-2026-47096 , CVE-2026-48094 , CVE-2026-5808 , CVE-2026-73422 , CVE-2026-73628 , CVE-2026-82451 , CVE-2026-82646 , CVE-2026-85158 , CVE-2026-85159 , CVE-2026-85577 , CVE-2026-89240 , CVE-2026-89241 , CVE-2026-89244 , CVE-2026-91922 , CVE-2026-92584 , CVE-2011-10037 , CVE-2012-20003 , CVE-2014-125131 , CVE-2014-125132 , CVE-2017-20288 , CVE-2017-20290 , CVE-2018-25349 , CVE-2020-37236 , CVE-2020-37284 , CVE-2022-50943 , CVE-2022-50948 , CVE-2022-50958 , CVE-2022-50959 , CVE-2022-50960 , CVE-2022-50962 , CVE-2022-50963 , CVE-2022-50964 , CVE-2022-50965 , CVE-2022-50966 , CVE-2022-50968 , CVE-2022-50969 , CVE-2022-50970 , CVE-2023-54358 , CVE-2023-54361 , CVE-2023-54362 , CVE-2023-54413 , CVE-2024-13992 , CVE-2024-58394 , CVE-2025-10354 , CVE-2025-10945 , CVE-2025-10946 , CVE-2025-12264 , CVE-2025-34141 , CVE-2025-34264 , CVE-2025-34301 , CVE-2025-34302 , CVE-2025-34313 , CVE-2025-34314 , CVE-2025-40638 , CVE-2025-40642 , CVE-2025-40647 , CVE-2025-40681 , CVE-2025-40693 , CVE-2025-40700 , CVE-2025-40725 , CVE-2025-41011 , CVE-2025-43804 , CVE-2025-59750 , CVE-2025-59756 , CVE-2025-59758 , CVE-2025-64716 , CVE-2025-71385 , CVE-2025-71404 , CVE-2025-9655 , CVE-2026-100521 , CVE-2026-100522 , CVE-2026-100904 , CVE-2026-103587 , CVE-2026-104461 , CVE-2026-104465 , CVE-2026-104473 , CVE-2026-105224 , CVE-2026-107799 , CVE-2026-109327 , CVE-2026-110101 , CVE-2026-110625 , CVE-2026-110626 , CVE-2026-111168 , CVE-2026-113683 , CVE-2026-114407 , CVE-2026-116202 , CVE-2026-1630 , CVE-2026-22675 , CVE-2026-25557 , CVE-2026-27176 , CVE-2026-32856 , CVE-2026-34416 , CVE-2026-34417 , CVE-2026-34798 , CVE-2026-34800 , CVE-2026-34802 , CVE-2026-34803 , CVE-2026-34804 , CVE-2026-34805 , CVE-2026-34806 , CVE-2026-34807 , CVE-2026-34808 , CVE-2026-34809 , CVE-2026-34810 , CVE-2026-34811 , CVE-2026-34812 , CVE-2026-34813 , CVE-2026-34814 , CVE-2026-34815 , CVE-2026-34816 , CVE-2026-34817 , CVE-2026-34818 , CVE-2026-34819 , CVE-2026-34820 , CVE-2026-34822 , CVE-2026-34823 , CVE-2026-34951 , CVE-2026-35007 , CVE-2026-35008 , CVE-2026-35009 , CVE-2026-35010 , CVE-2026-35011 , CVE-2026-35012 , CVE-2026-35014 , CVE-2026-35015 , CVE-2026-40507 , CVE-2026-40508 , CVE-2026-41456 , CVE-2026-45381 , CVE-2026-48227 , CVE-2026-48228 , CVE-2026-48229 , CVE-2026-48534 , CVE-2026-48537 , CVE-2026-48538 , CVE-2026-48552 , CVE-2026-50701 , CVE-2026-53992 , CVE-2026-54386 , CVE-2026-57857 , CVE-2026-57958 , CVE-2026-60092 , CVE-2026-6086 , CVE-2026-61504 , CVE-2026-65697 , CVE-2026-66296 , CVE-2026-67333 , CVE-2026-6954 , CVE-2026-71503 , CVE-2026-73319 , CVE-2026-75831 , CVE-2026-85593 , CVE-2026-85600 , CVE-2026-86197 , CVE-2026-90567 , CVE-2026-96535 , CVE-2017-14651 , CVE-2024-3822 , CVE-2025-15669 , CVE-2025-40648 , CVE-2025-43817 , CVE-2025-62248 , CVE-2025-9823 , CVE-2026-100376 , CVE-2026-111232 , CVE-2026-14203 , CVE-2026-15233 , CVE-2026-34096 , CVE-2026-34097 , CVE-2026-34098 , CVE-2026-46516 , CVE-2026-58657 , CVE-2026-59659 , CVE-2026-59660 , CVE-2026-59661 , CVE-2026-59662 , CVE-2026-59663 , CVE-2026-59664 , CVE-2026-59665 , CVE-2026-59666 , CVE-2026-59667 , CVE-2026-59668 , CVE-2026-59669 , CVE-2026-59670 , CVE-2026-59672 , CVE-2026-59673 , CVE-2026-63001 , CVE-2026-67612 , CVE-2026-67617 , CVE-2026-7171 , CVE-2026-7172 , CVE-2026-84188 , CVE-2026-85293 , CVE-2026-90569 , CVE-2026-90570 , CVE-2026-95662 , CVE-2026-9577 , CVE-2023-45671 , CVE-2026-3093 , CVE-2026-4406 , CVE-2026-16273 , CVE-2026-50698 , CVE-2015-4665 , CVE-2026-32250 , CVE-2026-55566 , CVE-2026-102576 , CVE-2026-113657 , CVE-2025-66040 , CVE-2026-9061 , CVE-2026-91165 , CVE-2026-114127 , CVE-2026-66300 , CVE-2025-10063 , CVE-2025-10067 , CVE-2025-10590 , CVE-2025-10614 , CVE-2025-10710 , CVE-2025-10711 , CVE-2025-10827 , CVE-2025-11112 , CVE-2025-11306 , CVE-2025-12244 , CVE-2025-12289 , CVE-2025-12290 , CVE-2025-15093 , CVE-2025-15094 , CVE-2025-15144 , CVE-2025-15220 , CVE-2025-9647 , CVE-2025-9755 , CVE-2025-9773 , CVE-2026-100313 , CVE-2026-10153 , CVE-2026-10173 , CVE-2026-10301 , CVE-2026-105288 , CVE-2026-105291 , CVE-2026-105708 , CVE-2026-105809 , CVE-2026-10810 , CVE-2026-108932 , CVE-2026-111877 , CVE-2026-111942 , CVE-2026-11337 , CVE-2026-113741 , CVE-2026-11436 , CVE-2026-11512 , CVE-2026-116047 , CVE-2026-13554 , CVE-2026-13556 , CVE-2026-13557 , CVE-2026-14656 , CVE-2026-14704 , CVE-2026-15595 , CVE-2026-15596 , CVE-2026-15715 , CVE-2026-16220 , CVE-2026-16229 , CVE-2026-16485 , CVE-2026-16486 , CVE-2026-18968 , CVE-2026-5825 , CVE-2026-5826 , CVE-2026-6032 , CVE-2026-66882 , CVE-2026-75077 , CVE-2026-75078 , CVE-2026-78054 , CVE-2026-78055 , CVE-2026-79793 , CVE-2026-82601 , CVE-2026-82664 , CVE-2026-85021 , CVE-2026-86216 , CVE-2026-86244 , CVE-2026-86278 , CVE-2026-87926 , CVE-2026-90615 , CVE-2026-90795 , CVE-2026-9415 , CVE-2026-9416 , CVE-2026-9417 , CVE-2026-9418 , CVE-2026-9419 , CVE-2026-9448 , CVE-2026-9519 , CVE-2026-9520 , CVE-2026-9527 , CVE-2026-9566 , CVE-2025-10591 , CVE-2025-10837 , CVE-2025-11332 , CVE-2025-11433 , CVE-2025-11851 , CVE-2025-12224 , CVE-2025-13343 , CVE-2025-13450 , CVE-2025-14006 , CVE-2025-14194 , CVE-2025-15172 , CVE-2025-15173 , CVE-2025-62653 , CVE-2025-7871 , CVE-2025-9657 , CVE-2025-9658 , CVE-2025-9659 , CVE-2025-9680 , CVE-2025-9681 , CVE-2025-9682 , CVE-2025-9683 , CVE-2025-9715 , CVE-2025-9716 , CVE-2025-9717 , CVE-2025-9718 , CVE-2025-9719 , CVE-2025-9734 , CVE-2025-9735 , CVE-2025-9737 , CVE-2026-101141 , CVE-2026-102264 , CVE-2026-10234 , CVE-2026-10244 , CVE-2026-10245 , CVE-2026-10246 , CVE-2026-10247 , CVE-2026-105808 , CVE-2026-15678 , CVE-2026-16155 , CVE-2026-16156 , CVE-2026-16202 , CVE-2026-16203 , CVE-2026-5810 , CVE-2026-84438 , CVE-2026-85022 , CVE-2026-86301 , CVE-2026-90695 , CVE-2026-90696 , CVE-2026-93956 , CVE-2025-10099 , CVE-2025-10234 , CVE-2025-10235 , CVE-2025-10940 , CVE-2025-11027 , CVE-2025-11289 , CVE-2025-12311 , CVE-2025-12312 , CVE-2025-13186 , CVE-2025-13412 , CVE-2025-14991 , CVE-2025-15188 , CVE-2025-15416 , CVE-2025-15451 , CVE-2025-15452 , CVE-2026-108908 , CVE-2026-112039 , CVE-2026-11434 , CVE-2026-11468 , CVE-2026-115981 , CVE-2026-5834 , CVE-2026-5835 , CVE-2026-5836 , CVE-2026-90850 , CVE-2026-94150 , CVE-2026-9564 , CVE-2025-15454 , CVE-2026-78187 , CVE-2025-14007 , CVE-2026-58038
CWE-80	CVE-2024-58355 , CVE-2025-39663 , CVE-2026-39344 , CVE-2026-24128 , CVE-2025-10128 , CVE-2023-23548 , CVE-2025-61583
CWE-83	CVE-2026-45118 , CVE-2026-8245
CWE-87	CVE-2026-34598 , CVE-2026-85293
CWE-89	CVE-2015-4669 , CVE-2025-63948
CWE-94	CVE-2026-34448 , CVE-2026-39311 , CVE-2026-73084 , CVE-2026-5808 , CVE-2025-10945 , CVE-2025-10946 , CVE-2025-12264 , CVE-2025-9655 , CVE-2026-100904 , CVE-2026-90567 , CVE-2026-90569 , CVE-2026-90570 , CVE-2025-10063 , CVE-2025-10067 , CVE-2025-10590 , CVE-2025-10614 , CVE-2025-10710 , CVE-2025-10711 , CVE-2025-10827 , CVE-2025-11112 , CVE-2025-11306 , CVE-2025-12244 , CVE-2025-12289 , CVE-2025-12290 , CVE-2025-15093 , CVE-2025-15094 , CVE-2025-15144 , CVE-2025-15220 , CVE-2025-9647 , CVE-2025-9755 , CVE-2025-9773 , CVE-2026-100313 , CVE-2026-10153 , CVE-2026-10173 , CVE-2026-10301 , CVE-2026-105288 , CVE-2026-105291 , CVE-2026-105708 , CVE-2026-105809 , CVE-2026-10810 , CVE-2026-108932 , CVE-2026-111877 , CVE-2026-111942 , CVE-2026-11337 , CVE-2026-113741 , CVE-2026-11436 , CVE-2026-11512 , CVE-2026-116047 , CVE-2026-13554 , CVE-2026-13556 , CVE-2026-13557 , CVE-2026-14656 , CVE-2026-14704 , CVE-2026-15595 , CVE-2026-15596 , CVE-2026-15715 , CVE-2026-16220 , CVE-2026-16229 , CVE-2026-16485 , CVE-2026-16486 , CVE-2026-18968 , CVE-2026-5825 , CVE-2026-5826 , CVE-2026-6032 , CVE-2026-75077 , CVE-2026-75078 , CVE-2026-78054 , CVE-2026-78055 , CVE-2026-79793 , CVE-2026-82601 , CVE-2026-82664 , CVE-2026-85021 , CVE-2026-86216 , CVE-2026-86244 , CVE-2026-86278 , CVE-2026-87926 , CVE-2026-90615 , CVE-2026-90795 , CVE-2026-9415 , CVE-2026-9416 , CVE-2026-9417 , CVE-2026-9418 , CVE-2026-9419 , CVE-2026-9448 , CVE-2026-9519 , CVE-2026-9520 , CVE-2026-9527 , CVE-2026-9566 , CVE-2025-10591 , CVE-2025-10837 , CVE-2025-11332 , CVE-2025-11433 , CVE-2025-11851 , CVE-2025-12224 , CVE-2025-13343 , CVE-2025-13450 , CVE-2025-14006 , CVE-2025-14194 , CVE-2025-15172 , CVE-2025-15173 , CVE-2025-7871 , CVE-2025-9657 , CVE-2025-9658 , CVE-2025-9659 , CVE-2025-9680 , CVE-2025-9681 , CVE-2025-9682 , CVE-2025-9683 , CVE-2025-9715 , CVE-2025-9716 , CVE-2025-9717 , CVE-2025-9718 , CVE-2025-9719 , CVE-2025-9734 , CVE-2025-9735 , CVE-2025-9737 , CVE-2026-101141 , CVE-2026-102264 , CVE-2026-10234 , CVE-2026-10244 , CVE-2026-10245 , CVE-2026-10246 , CVE-2026-10247 , CVE-2026-105808 , CVE-2026-15678 , CVE-2026-16155 , CVE-2026-16156 , CVE-2026-16202 , CVE-2026-16203 , CVE-2026-5810 , CVE-2026-82666 , CVE-2026-84438 , CVE-2026-85022 , CVE-2026-86301 , CVE-2026-90695 , CVE-2026-90696 , CVE-2026-93956 , CVE-2025-10099 , CVE-2025-10234 , CVE-2025-10235 , CVE-2025-10940 , CVE-2025-11027 , CVE-2025-11289 , CVE-2025-12311 , CVE-2025-12312 , CVE-2025-13186 , CVE-2025-13412 , CVE-2025-14991 , CVE-2025-15188 , CVE-2025-15416 , CVE-2025-15451 , CVE-2025-15452 , CVE-2026-108908 , CVE-2026-112039 , CVE-2026-11434 , CVE-2026-11468 , CVE-2026-115981 , CVE-2026-5834 , CVE-2026-5835 , CVE-2026-5836 , CVE-2026-90850 , CVE-2026-94150 , CVE-2026-9564 , CVE-2025-15454 , CVE-2026-78187 , CVE-2025-14007
CWE-113	CVE-2026-55486
CWE-116	CVE-2026-18516 , CVE-2026-12496 , CVE-2026-55659 , CVE-2026-107393 , CVE-2026-35208 , CVE-2025-34141
CWE-352	CVE-2025-56798 , CVE-2026-14234 , CVE-2026-14239
CWE-384	CVE-2022-31798
CWE-436	CVE-2026-48788
CWE-444	CVE-2026-55087
CWE-601	CVE-2026-53662 , CVE-2025-62716 , CVE-2015-4668 , CVE-2026-55087 , CVE-2025-64716
CWE-610	CVE-2023-30943
CWE-749	CVE-2025-59788
CWE-798	CVE-2015-4667
CWE-918	CVE-2026-82667
CWE-1188	CVE-2026-54067
CWE-1321	CVE-2021-20086 , CVE-2026-113659
CWE-1336	CVE-2026-55486

Atomicorp WAF Rule 340099

Rule Summary

Description

Selected Related CVEs

Observed CWEs