On this page

Atomicorp WAF Rule 340148

Rule Summary

Rule ID: 340148
Status: Active
Alert message: Atomicorp.com WAF Rules: Potential Cross Site Scripting Attack
Observed CWEs: CWE-20 (4), CWE-22 (5), CWE-73 (1), CWE-74 (5), CWE-78 (1), CWE-79 (737), CWE-80 (9), CWE-83 (3), CWE-87 (1), CWE-89 (8), CWE-94 (84), CWE-116 (7), CWE-183 (1), CWE-200 (5), CWE-264 (3), CWE-269 (1), CWE-287 (2), CWE-295 (2), CWE-306 (2), CWE-345 (3), CWE-352 (9), CWE-384 (1), CWE-425 (1), CWE-434 (7), CWE-444 (1), CWE-521 (1), CWE-601 (2), CWE-610 (1), CWE-611 (1), CWE-639 (2), CWE-640 (1), CWE-693 (1), CWE-732 (2), CWE-798 (2), CWE-862 (1), CWE-918 (2)
Revision: 162
Rule severity: Critical (2)
Phase: 2 (request body)
Request surfaces: Request headers, Request argument names, Request arguments, JSON request data, SOAP request data
Rule action: deny
HTTP status: 403
Logging: log, auditlog

Description

This rules detects when a potential cross site scripting attack may have occurred. For example, if javascript is included in a variable that appears to not be used for this purpose, or if web code is included in a portion of a request that is not known to be used for this purpose. This rule looks for encoded methods.

Troubleshooting

False Positives

This rule may produce a false positive if an application is used in a previously unknown or untested manner. The rules contain a large library of known trusted methods, however it is possible an application may be using a previously untested method. It is not recommended that you disable this rule if you have a false positive. If you believe this is a false positive, please report this to our security team to determine if this is a legitimate case, or if its clever attack on your system. Instructions to report false positives are detailed on the Reporting False Positives wiki page. If it is a false positive, we will fix the issue in the rules and get a release out to you promptly.

Tuning Guidance

See the Mod_security page for guidance on tuning this rule.

Additional Information

Similar Rules

WAF 340147

WAF 340149

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

CVE	Vulnerability	Product	CVSS	Severity
CVE-2016-9269	Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities	interscan web security virtual appliance	9.9 (v3.0)	Critical
CVE-2012-1259	Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities	scrutinizer netflow & sflow analyzer	9.8 (v3.1)	Critical
CVE-2012-5686	ZPanel 10.0.1 - Cross-Site Request Forgery / Cross-Site Scripting / SQL Injection / Password Reset	zpanel	9.8 (v3.1)	Critical
CVE-2015-4664	Xceedium Xsuite - Multiple Vulnerabilities	privileged access manager	9.8 (v3.0)	Critical
CVE-2015-4667	Xceedium Xsuite - Multiple Vulnerabilities	xsuite	9.8 (v3.0)	Critical
CVE-2018-17440	D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities	central wifimanager	9.8 (v3.0)	Critical
CVE-2018-6220	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	9.8 (v3.0)	Critical
CVE-2018-6223	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	9.8 (v3.0)	Critical
CVE-2018-6228	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	9.8 (v3.0)	Critical
CVE-2018-6229	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	9.8 (v3.0)	Critical
CVE-2020-24881	OsTicket < 1.14.3 - Server Side Request Forgery	osticket	9.8 (v3.1)	Critical
CVE-2022-29316	Complete Online Job Search System 1.0 - Cross-Site Scripting	complete online job search system	9.8 (v3.1)	Critical
CVE-2026-67688	ICS-Park Smart Park Management System v2.0 Arbitrary Code Execution Vulnerability	ICS-Park Smart Park Management System v2.0	9.8 (v3.1)	Critical
CVE-2020-20982	shadoweb wdja v1.5.1 - Cross-Site Scripting	wdja cms	9.6 (v3.1)	Critical
CVE-2021-32853	Erxes <0.23.0 - Cross-Site Scripting	erxes	9.6 (v3.1)	Critical
CVE-2026-54694	NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover	skills-service	9.6 (v3.1)	Critical
CVE-2026-55085	Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite	etherpad	9.6 (v3.1)	Critical
CVE-2026-73043	SiYuan before v3.7.4 Remote Code Execution via Template Calculation	siyuan	9.4 (v4.0)	Critical
CVE-2026-73044	SiYuan before v3.7.4 Stored Cross-Site Scripting via Column Width	siyuan	9.4 (v4.0)	Critical
CVE-2026-73050	SiYuan before v3.7.4 Stored XSS via select option color	siyuan	9.4 (v4.0)	Critical
CVE-2026-73052	SiYuan before v3.7.4 Stored XSS via Attribute-View Field Names	siyuan	9.4 (v4.0)	Critical
CVE-2026-73053	SiYuan before v3.7.4 Cross-Site Scripting via unicode2Emoji	siyuan	9.4 (v4.0)	Critical
CVE-2024-58355	Cal.com through 4.7.15 Cross-Site Scripting via booking questions	cal.diy	9.3 (v4.0)	Critical
CVE-2026-42849	authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover	authentik	9.3 (v3.1)	Critical
CVE-2026-45118	MyBB: Contact page reflected XSS	mybb	9.3 (v3.1)	Critical
CVE-2026-57858	Cal.com Cal.diy 6.2.0 Stored XSS via BookingPageTagManager Analytics Tracking ID	Cal.com Self-Hosted (Cal.diy)	9.3 (v4.0)	Critical
CVE-2026-66394	SiYuan before v3.7.3 Stored and Reflected XSS via SVG Sanitizer Bypass	siyuan	9.3 (v4.0)	Critical
CVE-2026-66396	SiYuan before v3.7.2 Stored XSS to RCE via title-img IAL	siyuan	9.3 (v4.0)	Critical
CVE-2026-66418	OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field	openclaw agent dashboard	9.3 (v4.0)	Critical
CVE-2026-74902	SiYuan before v3.7.4 XSS-to-RCE via malicious filename upload	siyuan	9.3 (v4.0)	Critical
CVE-2026-78997	UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314) Cross-Site Scripting Vulnerability	UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314)	9.3 (v3.1)	Critical
CVE-2026-84189	LibreNMS before 26.7.0 Stored XSS via Oxidized API	librenms	9.2 (v4.0)	Critical
CVE-2019-7671	Prima Access Control 2.3.35 - 'HwName' Persistent Cross-Site Scripting	flexair	9.0 (v3.1)	Critical
CVE-2023-34192	Zimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site Scripting	collaboration	9.0 (v3.1)	Critical
CVE-2026-34448	SiYuan: Stored XSS in Attribute View gallery/kanban cover rendering allows arbitrary command execution in the desktop cl	siyuan	9.0 (v3.1)	Critical
CVE-2026-42556	Postiz stored XSS in public preview page	postiz	9.0 (v3.1)	Critical
CVE-2026-43984	Tautulli has stored XSS in logFile via guest-controlled log_js_errors input	Tautulli	8.9 (v3.1)	High
CVE-2016-9315	Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities	interscan web security virtual appliance	8.8 (v3.0)	High
CVE-2018-11442	EasyService Billing 1.0 - Cross-Site Request Forgery	easyservice billing	8.8 (v3.0)	High
CVE-2018-11445	EasyService Billing 1.0 - Cross-Site Request Forgery	easyservice billing	8.8 (v3.0)	High
CVE-2018-1213	Dell EMC Isilon OneFS - Multiple Vulnerabilities	emc isilon onefs	8.8 (v3.0)	High
CVE-2018-17442	D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities	central wifimanager	8.8 (v3.0)	High
CVE-2018-6224	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	8.8 (v3.0)	High
CVE-2020-7991	Adive Framework 2.0.8 - Cross-Site Request Forgery (Change Admin Password)	framework	8.8 (v3.1)	High
CVE-2025-56798	Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier Cross-Site Request Forgery Vulnerability	Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier	8.8 (v3.1)	High
CVE-2026-12968	Product Addons – WowAddons < 1.6.15 - Unauthenticated Stored XSS via Arbitrary SVG Upload	Product Addons and Product Options With Custom Fields	8.8 (v3.1)	High
CVE-2026-41473	CyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner Endpoints	cyberpanel	8.8 (v4.0)	High
CVE-2021-47795	GeoVision GeoWebServer <= 5.3.3 - Local File Inclusion / Cross-Site Scripting	geowebserver	8.7 (v4.0)	High
CVE-2026-12496	Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server	LIP-ME20xC	8.7 (v4.0)	High
CVE-2026-15217	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab	gitlab	8.7 (v3.1)	High
CVE-2026-22200	osTicket - Arbitrary File Read	osticket	8.7 (v4.0)	High
CVE-2026-44667	Faction: Stored XSS in Remediation Verification Attachment Filename Preview Rendering	faction	8.7 (v3.1)	High
CVE-2026-44669	Faction: Stored XSS in Assessment Attachment Filename Preview Rendering	faction	8.7 (v3.1)	High
CVE-2026-44729	Twenty: Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers)	twenty	8.7 (v3.1)	High
CVE-2026-45115	MyBB: Buddy/ignore list username XSS	mybb	8.7 (v3.1)	High
CVE-2026-45116	MyBB: Profile field type confusion XSS	mybb	8.7 (v3.1)	High
CVE-2026-45270	CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule	ci4ms	8.7 (v3.1)	High
CVE-2026-46518	OpenEMR: Stored XSS in prescription CSS/HTML print view via patient demographics	openemr	8.7 (v3.1)	High
CVE-2026-47665	Penpot: Stored XSS via comment content, innerHTML renders unsanitized HTML	penpot	8.7 (v3.1)	High
CVE-2026-47743	Shopper: Multiple data integrity and disclosure issues in admin Livewire components	shopper	8.7 (v3.1)	High
CVE-2026-48026	lakeFS vulnerable to stored XSS in rendered markdown previews via raw HTML	lakeFS	8.7 (v3.1)	High
CVE-2026-53758	Emlog: Stored XSS via Parsedown Markdown Processing - Raw HTML Not Sanitized	emlog	8.7 (v4.0)	High
CVE-2026-54347	Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover	froxlor	8.7 (v3.1)	High
CVE-2026-68899	Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallback	wekan	8.7 (v3.1)	High
CVE-2026-70492	Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages	open-webui	8.7 (v3.1)	High
CVE-2025-66024	XWiki Blog Application home page vulnerable to Stored XSS via Post Title	blog application	8.6 (v4.0)	High
CVE-2026-34463	MantisBT has Stored HTML Injection/XSS via Clone Issue Form	mantisbt	8.6 (v4.0)	High
CVE-2026-49864	wetty vulnerable to DOM XSS via file-download filename	wetty	8.6 (v4.0)	High
CVE-2026-21618	Cross-site scripting (XSS) in OAuth Device Authorization screen	hexpm	8.5 (v4.0)	High
CVE-2026-34932	hoppscotch: Stored XSS via mock server responses on backend origin	hoppscotch	8.5 (v4.0)	High
CVE-2026-58113	Teamcenter V2412 Cross-site Scripting Vulnerability	Teamcenter V2412	8.5 (v4.0)	High
CVE-2026-63361	LimeSurvey Community Edition 7.0.5+260623 - Reflected XSS in HTML editor popup	LimeSurvey	8.5 (v4.0)	High
CVE-2026-64851	Grav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlers	grav-plugin-shortcode-core	8.5 (v4.0)	High
CVE-2026-15973	LimeSurvey 7.0.5 - Stored XSS in Survey Menu Entries	LimeSurvey	8.4 (v4.0)	High
CVE-2026-5385	GLPI 11.0.0 - Stored XSS in knowledge base	glpi	8.4 (v4.0)	High
CVE-2026-77072	n8n before 1.123.69 Stored XSS via Form Completion Page	n8n	8.4 (v4.0)	High
CVE-2026-77850	Stored XSS in AshAdmin relationship typeahead via unescaped label_field content	ash admin	8.4 (v4.0)	High
CVE-2026-85613	OpenPanel Unauthenticated XSS via SVG Favicon Proxy	openpanel	8.4 (v4.0)	High
CVE-2026-87814	SiYuan before v3.8.2 Stored XSS via Asset Preview	siyuan	8.4 (v4.0)	High
CVE-2024-5420	SEH utnserver Pro/ProMAX/INU-100 20.1.22 - Cross-Site Scripting	utnserver Pro	8.3 (v4.0)	High
CVE-2026-34725	dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration	dbgate	8.2 (v3.1)	High
CVE-2026-56670	ComfyUI: Stored XSS via SVG file upload on the /view endpoint	ComfyUI	8.2 (v3.1)	High
CVE-2016-1337	Cisco EPC 3928 - Multiple Vulnerabilities	epc3928 firmware	8.1 (v3.0)	High
CVE-2018-6221	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	8.1 (v3.0)	High
CVE-2026-33437	Stirling PDF: Stored XSS in Info Summary	Stirling-PDF	8.1 (v3.1)	High
CVE-2026-39344	Reflected XSS the login page through the 'username' parameter	churchcrm	8.1 (v3.0)	High
CVE-2026-48060	Litestar: HTML Injection Through CSRF Token	litestar	8.1 (v3.1)	High
CVE-2026-50758	DayuanJiang next-ai-draw-io 0.4.13 Arbitrary Code Execution Vulnerability	DayuanJiang next-ai-draw-io 0.4.13	8.1 (v3.1)	High
CVE-2026-65937	WhatsUp Gold versions prior to 26.0.2 contain multiple stored cross-site scripting (XSS) vulnerabilities across the web UI	whatsup gold	8.0 (v3.1)	High
CVE-2015-4669	Xceedium Xsuite - Multiple Vulnerabilities	xsuite	7.8 (v3.0)	High
CVE-2016-9314	Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities	interscan web security virtual appliance	7.8 (v3.0)	High
CVE-2018-6222	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	7.8 (v3.0)	High
CVE-2025-47783	Label Studio < 1.18.0 - Reflected XSS	label studio	7.6 (v4.0)	High
CVE-2026-16969	DFIR-IRIS Stored XSS in Assets	iris-web	7.6 (v3.1)	High
CVE-2026-18360	DFIR-IRIS Stored XSS in Custom Attributes	iris-web	7.6 (v3.1)	High
CVE-2026-18361	DFIR-IRIS Stored XSS in Datastore Upload	iris-web	7.6 (v3.1)	High
CVE-2002-1131	SquirrelMail 1.2.6/1.2.7 - Cross-Site Scripting	squirrelmail	7.5 (v2.0)	High
CVE-2011-4899	WordPress Core 3.3.1 - Multiple Vulnerabilities	WordPress	7.5 (v2.0)	High
CVE-2012-5685	ZPanel 10.0.1 - Cross-Site Request Forgery / Cross-Site Scripting / SQL Injection / Password Reset	zpanel	7.5 (v2.0)	High
CVE-2015-6401	Cisco EPC 3928 - Multiple Vulnerabilities	epc3928 docsis 3.0 8x4 wireless residential gateway with embedded digital voice adapter	7.5 (v2.0)	High
CVE-2016-1328	Cisco EPC 3928 - Multiple Vulnerabilities	epc3928 firmware	7.5 (v3.0)	High
CVE-2016-1336	Cisco EPC 3928 - Multiple Vulnerabilities	epc3928 firmware	7.5 (v3.0)	High
CVE-2026-44657	MantisBT: Stored XSS in File Download	mantisbt	7.5 (v4.0)	High
CVE-2026-7460	mailcow-dockerized 2026-03b - Stored XSS in Queue Manager via unescaped	mailcow-dockerized	7.4 (v4.0)	High
CVE-2026-87812	SiYuan before v3.8.2 Stored XSS via Bazaar iconURL	siyuan	7.4 (v4.0)	High
CVE-2026-30819	Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameter	iTop	7.3 (v3.1)	High
CVE-2026-6735	XSS within PHP-FPM status endpoint	php	7.3 (v4.0)	High
CVE-2026-8203	Concrete CMS 9.5.0 and below has Stored XSS on the height parameter	concrete cms	7.3 (v4.0)	High
CVE-2026-16809	LimeSurvey Community Edition 7.0.5 - Stored XSS in quota message rendering	LimeSurvey	7.2 (v4.0)	High
CVE-2026-18430	HumHub 1.18.4 - Stored XSS in comment-deletion notifications through unescaped administrator reason	HumHub	7.2 (v4.0)	High
CVE-2026-18756	HumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button rendering	HumHub	7.2 (v4.0)	High
CVE-2022-35499	In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint Cross-Site Scripting Vulnerability	-	7.1 (v3.1)	High
CVE-2024-12878	Lazy Blocks <= 3.8.2 - Cross-Site Scripting	lazy blocks	7.1 (v3.1)	High
CVE-2024-41357	phpIPAM 1.6 - Reflected-Cross-Site Scripting (XSS)	phpipam	7.1 (v3.1)	High
CVE-2026-12970	LearnPress < 4.4.1 - Reflected XSS via c_search	LearnPress	7.1 (v3.1)	High
CVE-2026-14239	Tourmaster < 5.4.8 - Stored XSS via CSRF	tourmaster	7.1 (v3.1)	High
CVE-2026-34598	YesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter"	yeswiki	7.1 (v4.0)	High
CVE-2026-6858	Transbank Webpay < 1.14.0 - Unauthenticated Stored XSS	Transbank Webpay	7.1 (v3.1)	High
CVE-2026-84192	LibreNMS before 26.3.1 Stored XSS via SNMP/Syslog Data	librenms	7.1 (v4.0)	High
CVE-2026-55746	Cotonti stored XSS via PFS folder title	Cotonti	7.0 (v4.0)	High
CVE-2026-58411	ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values	CRM	7.0 (v4.0)	High
CVE-2018-3238	Oracle Fusion Middleware WebCenter Sites 11.1.1.8.0 - Cross-Site Scripting	webcenter sites	6.9 (v3.0)	Medium
CVE-2025-4388	Liferay Portal - Cross-Site Scripting	digital experience platform	6.9 (v4.0)	Medium
CVE-2025-4576	Liferay Portal & DXP - Cross-Site Scripting	digital experience platform	6.9 (v4.0)	Medium
CVE-2025-62613	VDO.Ninja - DOM-Based Cross-Site Scripting	vdo.ninja	6.9 (v4.0)	Medium
CVE-2026-39838	ProofreadPage improperly sanitizes multiline styles using Sanitizer::checkCSS	MediaWiki - ProofreadPage Extension	6.9 (v4.0)	Medium
CVE-2026-39936	Stored XSS in Score due to usage of non-reserved data attributes	Mediawiki - Score Extension	6.9 (v4.0)	Medium
CVE-2026-40598	MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page	mantisbt	6.9 (v4.0)	Medium
CVE-2026-44651	SillyTavern: Reflected XSS vulnerability in the CORS proxy middleware	SillyTavern	6.9 (v4.0)	Medium
CVE-2026-59238	Stored XSS in Pentestify via unsanitized finding images and report client logo	Pentestify	6.9 (v4.0)	Medium
CVE-2026-69092	Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpoint	admidio	6.9 (v4.0)	Medium
CVE-2026-73848	Emlog: Stored XSS via Tag Name in Article Editor	emlog	6.9 (v4.0)	Medium
CVE-2026-86188	AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting	AVideo	6.9 (v4.0)	Medium
CVE-2007-0885	Jira Rainbow.Zen - Cross-Site Scripting	rainbow.zen	6.8 (v2.0)	Medium
CVE-2012-5683	ZPanel 10.0.1 - Cross-Site Request Forgery / Cross-Site Scripting / SQL Injection / Password Reset	zpanel	6.8 (v2.0)	Medium
CVE-2018-6230	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	6.8 (v3.0)	Medium
CVE-2026-13605	Photo Swipe <= 4.1.1.1 - Author+ Stored XSS via title Attribute	PhotoSwipe	6.8 (v3.1)	Medium
CVE-2026-14817	Element Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data Attributes	Element Pack Addons for Elementor	6.8 (v3.1)	Medium
CVE-2026-14833	Lightbox with PhotoSwipe < 5.9.0 - Author+ Stored XSS via data-lbwps-caption Attribute	Lightbox with PhotoSwipe	6.8 (v3.1)	Medium
CVE-2026-15047	s2Member < 260805 - Contributor+ Stored XSS via Shortcode	s2Member	6.8 (v3.1)	Medium
CVE-2026-16559	YMC Filter < 3.12.9 - Author+ Stored XSS via SVG Icon Upload	YMC Filter	6.8 (v3.1)	Medium
CVE-2026-33741	EspoCRM: Stored XSS via SVG attachment loading same-origin JavaScript	espocrm	6.8 (v3.1)	Medium
CVE-2026-67352	luci-app-https-dns-proxy Stored XSS via resolver_url	luci	6.8 (v4.0)	Medium
CVE-2018-1203	Dell EMC Isilon OneFS - Multiple Vulnerabilities	emc isilon onefs	6.7 (v3.0)	Medium
CVE-2018-1204	Dell EMC Isilon OneFS - Multiple Vulnerabilities	emc isilon onefs	6.7 (v3.0)	Medium
CVE-2012-1258	Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities	scrutinizer netflow & sflow analyzer	6.5 (v3.1)	Medium
CVE-2017-6338	Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities	interscan web security virtual appliance	6.5 (v3.0)	Medium
CVE-2017-6339	Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities	interscan web security virtual appliance	6.5 (v3.0)	Medium
CVE-2018-6219	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	6.5 (v3.0)	Medium
CVE-2019-7439	JioFi 4G M2S 1.0.2 - Denial of Service	jiofi 4g m2s firmware	6.5 (v3.0)	Medium
CVE-2021-31249	CHIYU TCP/IP Converter - Carriage Return Line Feed Injection	bf-430 firmware	6.5 (v3.1)	Medium
CVE-2021-41349	Microsoft Exchange Server Pre-Auth POST Based Cross-Site Scripting	exchange server	6.5 (v3.1)	Medium
CVE-2025-32430	XWiki Platform - Cross-Site Scripting	xwiki-platform	6.5 (v4.0)	Medium
CVE-2026-24128	XWiki Platform Distribution Flavor Main - Cross-Site Scripting	xwiki-platform-distribution-flavor-main	6.5 (v4.0)	Medium
CVE-2026-40105	XWiki - Cross-Site Scripting	xwiki-platform	6.5 (v4.0)	Medium
CVE-2026-55549	Yamcs: Reflected XSS in the URL of the Authorize Endpoint	yamcs	6.5 (v3.1)	Medium
CVE-2026-78838	the grid_datasource.php component of AppNitro MachForm v30 Cross-Site Scripting Vulnerability	the grid datasource.php component of AppNitro MachForm v30	6.5 (v3.1)	Medium
CVE-2026-0737	Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode	WP Shortcodes Plugin — Shortcodes Ultimate	6.4 (v3.1)	Medium
CVE-2026-0738	Shortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode	WP Shortcodes Plugin — Shortcodes Ultimate	6.4 (v3.1)	Medium
CVE-2026-3885	WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_bo	Shortcodes Ultimate – Content Elements	6.4 (v3.1)	Medium
CVE-2026-45797	HeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Upload	heyform	6.4 (v4.0)	Medium
CVE-2026-50592	Znuny Cross-Site Scripting Vulnerability	Znuny	6.4 (v3.1)	Medium
CVE-2026-87870	Ninja Forms - Scheduled Exports <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Paramete	Ninja Forms - Scheduled Exports	6.4 (v3.1)	Medium
CVE-2026-43980	Malla: Stored XSS via Meshtastic node names in multiple frontend pages	malla	6.3 (v3.1)	Medium
CVE-2012-1260	Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities	scrutinizer netflow & sflow analyzer	6.1 (v3.1)	Medium
CVE-2012-1261	Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities	scrutinizer netflow & sflow analyzer	6.1 (v3.1)	Medium
CVE-2012-5193	Bitweaver 2.8.1 - Multiple Vulnerabilities	bitweaver	6.1 (v3.1)	Medium
CVE-2014-4535	Import Legacy Media <= 0.1 - Cross-Site Scripting	import legacy media	6.1 (v3.1)	Medium
CVE-2014-4536	Infusionsoft Gravity Forms Add-on < 1.5.7 - Cross-Site Scripting	infusionsoft gravity forms	6.1 (v3.1)	Medium
CVE-2014-4539	Movies <= 0.6 - Cross-Site Scripting	movies	6.1 (v3.1)	Medium
CVE-2014-4544	Podcast Channels < 0.28 - Cross-Site Scripting	podcast channels	6.1 (v3.1)	Medium
CVE-2014-4558	WooCommerce Swipe <= 2.7.1 - Cross-Site Scripting	swipehq-payment-gateway-woocommerce	6.1 (v3.1)	Medium
CVE-2014-4561	Ultimate Weather Plugin <= 1.0 - Cross-Site Scripting	ultimate-weather	6.1 (v3.1)	Medium
CVE-2014-4592	WP Planet <= 0.1 - Cross-Site Scripting	wp-planet	6.1 (v3.1)	Medium
CVE-2014-9607	Netsweeper 4.0.4 - Cross-Site Scripting	netsweeper	6.1 (v3.1)	Medium
CVE-2015-4668	Xceedium Xsuite - Multiple Vulnerabilities	xsuite	6.1 (v3.0)	Medium
CVE-2015-6477	Nordex NC2 - Cross-Site Scripting	nordex control 2 scada	6.1 (v3.1)	Medium
CVE-2015-6544	Combodo iTop <2.2.0-2459 - Cross-Site Scripting	itop	6.1 (v3.0)	Medium
CVE-2015-8349	SourceBans <2.0 - Cross-Site Scripting	sourcebans	6.1 (v3.0)	Medium
CVE-2015-8350	WordPress Calls to Action <=2.4.3 - Authenticated Reflected XSS	call to action	6.1 (v3.0)	Medium
CVE-2015-9414	WordPress Symposium <=15.8.1 - Cross-Site Scripting	wp-symposium	6.1 (v3.1)	Medium
CVE-2016-1000126	WordPress Admin Font Editor <=1.8 - Cross-Site Scripting	admin-font-editor	6.1 (v3.0)	Medium
CVE-2016-1000127	WordPress AJAX Random Post <=2.00 - Cross-Site Scripting	ajax-random-post	6.1 (v3.0)	Medium
CVE-2016-1000128	WordPress anti-plagiarism <=3.60 - Cross-Site Scripting	anti-plagiarism	6.1 (v3.0)	Medium
CVE-2016-1000129	WordPress defa-online-image-protector <=3.3 - Cross-Site Scripting	defa-online-image-protector	6.1 (v3.0)	Medium
CVE-2016-1000130	WordPress e-search <=1.0 - Cross-Site Scripting	e-search	6.1 (v3.0)	Medium
CVE-2016-1000131	WordPress e-search <=1.0 - Cross-Site Scripting	esearch	6.1 (v3.0)	Medium
CVE-2016-1000132	WordPress enhanced-tooltipglossary 3.2.8 - Cross-Site Scripting	tooltip glossary	6.1 (v3.0)	Medium
CVE-2016-1000133	WordPress forget-about-shortcode-buttons 1.1.1 - Cross-Site Scripting	forget about shortcode buttons	6.1 (v3.0)	Medium
CVE-2016-1000134	WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting	hdw-tube	6.1 (v3.0)	Medium
CVE-2016-1000135	WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting	hdw-tube	6.1 (v3.0)	Medium
CVE-2016-1000136	WordPress heat-trackr 1.0 - Cross-Site Scripting	heat-trackr	6.1 (v3.0)	Medium
CVE-2016-1000137	WordPress Hero Maps Pro 2.1.0 - Cross-Site Scripting	hero-maps-pro	6.1 (v3.0)	Medium
CVE-2016-1000138	WordPress Admin Font Editor <=1.8 - Cross-Site Scripting	indexisto	6.1 (v3.0)	Medium
CVE-2016-1000141	WordPress Page Layout builder v1.9.3 - Cross-Site Scripting	page-layout-builder	6.1 (v3.0)	Medium
CVE-2016-1000142	WordPress MW Font Changer <=4.2.5 - Cross-Site Scripting	parsi-font	6.1 (v3.0)	Medium
CVE-2016-1000143	WordPress Photoxhibit 2.1.8 - Cross-Site Scripting	photoxhibit	6.1 (v3.0)	Medium
CVE-2016-1000146	WordPress Pondol Form to Mail <=1.1 - Cross-Site Scripting	pondol-formmail	6.1 (v3.0)	Medium
CVE-2016-1000148	WordPress S3 Video <=0.983 - Cross-Site Scripting	s3-video	6.1 (v3.0)	Medium
CVE-2016-1000153	WordPress Tidio Gallery <=1.1 - Cross-Site Scripting	tidio-gallery	6.1 (v3.0)	Medium
CVE-2016-1000154	WordPress WHIZZ <=1.0.7 - Cross-Site Scripting	whizz	6.1 (v3.0)	Medium
CVE-2016-8527	Aruba AirWave 8.2.3 - XML External Entity Injection / Cross-Site Scripting	airwave	6.1 (v3.0)	Medium
CVE-2017-11629	FineCMS <=5.0.10 - Cross-Site Scripting	finecms	6.1 (v3.0)	Medium
CVE-2017-12794	Django Debug Page - Cross-Site Scripting	django	6.1 (v3.0)	Medium
CVE-2017-17059	WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting	amtythumb	6.1 (v3.0)	Medium
CVE-2017-17451	WordPress Mailster <=1.5.4 - Cross-Site Scripting	wp mailster	6.1 (v3.0)	Medium
CVE-2017-18024	AvantFAX 3.3.3 - Cross-Site Scripting	avantfax	6.1 (v3.0)	Medium
CVE-2017-18536	WordPress Stop User Enumeration <=1.3.7 - Cross-Site Scripting	stop user enumeration	6.1 (v3.0)	Medium
CVE-2017-3132	Fortinet FortiOS < 5.6.0 - Cross-Site Scripting	fortios	6.1 (v3.0)	Medium
CVE-2017-3133	Fortinet FortiOS < 5.6.0 - Cross-Site Scripting	fortios	6.1 (v3.0)	Medium
CVE-2017-6443	EPSON TMNet WebConfig 1.00 - Cross-Site Scripting	tmnet webconfig	6.1 (v3.0)	Medium
CVE-2017-7855	IceWarp WebMail 11.3.1.5 - Cross-Site Scripting	server	6.1 (v3.0)	Medium
CVE-2017-9288	WordPress Raygun4WP <=1.8.0 - Cross-Site Scripting	raygun4wp	6.1 (v3.0)	Medium
CVE-2018-10095	Dolibarr <7.0.2 - Cross-Site Scripting	dolibarr	6.1 (v3.0)	Medium
CVE-2018-10230	Zend Server <9.13 - Cross-Site Scripting	zend server	6.1 (v3.0)	Medium
CVE-2018-11709	WordPress wpForo Forum <= 1.4.11 - Cross-Site Scripting	wpforo forum	6.1 (v3.0)	Medium
CVE-2018-12998	Zoho manageengine - Cross-Site Scripting	firewall analyzer	6.1 (v3.1)	Medium
CVE-2018-14013	Synacor Zimbra Collaboration Suite Collaboration <8.8.11 - Cross-Site Scripting	zimbra collaboration suite	6.1 (v3.0)	Medium
CVE-2018-16139	BIBLIOsoft BIBLIOpac 2008 - Cross-Site Scripting	bibliopac	6.1 (v3.0)	Medium
CVE-2018-17441	D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities	central wifimanager	6.1 (v3.0)	Medium
CVE-2018-17443	D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities	central wifimanager	6.1 (v3.0)	Medium
CVE-2018-19136	DomainMOD 4.11.01 - Cross-Site Scripting	domainmod	6.1 (v3.0)	Medium
CVE-2018-19137	DomainMOD 4.11.01 - Cross-Site Scripting	domainmod	6.1 (v3.0)	Medium
CVE-2018-19287	WordPress Ninja Forms <3.3.18 - Cross-Site Scripting	ninja forms	6.1 (v3.0)	Medium
CVE-2018-19439	Oracle Secure Global Desktop Administration Console 4.4 - Cross-Site Scripting	secure global desktop	6.1 (v3.0)	Medium
CVE-2018-19933	Bolt CMS < 3.6.2 - Cross-Site Scripting	bolt cms	6.1 (v3.0)	Medium
CVE-2018-20462	WordPress JSmol2WP <=1.07 - Cross-Site Scripting	jsmol2wp	6.1 (v3.0)	Medium
CVE-2018-20503	SirsiDynix e-Library 3.5.x - Cross-Site Scripting	8100l/8 firmware	6.1 (v3.0)	Medium
CVE-2018-5715	SugarCRM 3.5.1 - Cross-Site Scripting	sugarcrm	6.1 (v3.0)	Medium
CVE-2018-6882	zimbra collaboration suite Cross-Site Scripting Vulnerability	zimbra collaboration suite	6.1 (v3.1)	Medium
CVE-2018-7196	osTicket < 1.10.2 - Cross-Site Scripting	osticket	6.1 (v3.0)	Medium
CVE-2018-7203	TwonkyMedia Server 7.0.11-8.5 - Persistent Cross-Site Scripting	twonky server	6.1 (v3.0)	Medium
CVE-2018-7543	WordPress Plugin Duplicator 1.2.32 - Cross-Site Scripting	duplicator	6.1 (v3.1)	Medium
CVE-2018-7653	YzmCMS v3.6 - Cross-Site Scripting	yzmcms	6.1 (v3.0)	Medium
CVE-2018-8006	Apache ActiveMQ <=5.15.5 - Cross-Site Scripting	activemq	6.1 (v3.1)	Medium
CVE-2018-9238	Yahei PHP Prober 0.4.7 - Cross-Site Scripting	yahei php prober	6.1 (v3.0)	Medium
CVE-2019-0221	Apache Tomcat - Cross-Site Scripting	tomcat	6.1 (v3.0)	Medium
CVE-2019-12461	WebPort 1.19.1 - Cross-Site Scripting	web port	6.1 (v3.0)	Medium
CVE-2019-12935	Shopware < 5.5.8 - Cross-Site Scripting	shopware	6.1 (v3.0)	Medium
CVE-2019-14696	Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting	open-school	6.1 (v3.0)	Medium
CVE-2019-15501	L-Soft LISTSERV <16.5-2018a - Cross-Site Scripting	listserv	6.1 (v3.0)	Medium
CVE-2019-15713	WordPress My Calendar <= 3.1.9 - Cross-Site Scripting	my calendar	6.1 (v3.0)	Medium
CVE-2019-15889	WordPress Download Manager <2.9.94 - Cross-Site Scripting	wordpress download manager	6.1 (v3.0)	Medium
CVE-2019-16332	WordPress API Bearer Auth <20190907 - Cross-Site Scripting	api bearer auth	6.1 (v3.1)	Medium
CVE-2019-16525	WordPress Checklist <1.1.9 - Cross-Site Scripting	checklist	6.1 (v3.1)	Medium
CVE-2019-16931	WordPress Visualizer <3.3.1 - Cross-Site Scripting	visualizer	6.1 (v3.1)	Medium
CVE-2019-17504	Kirona-DRS 5.5.3.5 - Information Disclosure	dynamic resource scheduling	6.1 (v3.1)	Medium
CVE-2019-19134	WordPress Hero Maps Premium <=2.2.1 - Cross-Site Scripting	hero maps premium	6.1 (v3.1)	Medium
CVE-2019-19908	phpMyChat-Plus 1.98 - Cross-Site Scripting	phpmychat-plus	6.1 (v3.1)	Medium
CVE-2019-20210	WordPress CTHthemes - Cross-Site Scripting	citybook	6.1 (v3.1)	Medium
CVE-2019-3402	Jira < 8.1.1 - Cross-Site Scripting	jira	6.1 (v3.0)	Medium
CVE-2019-3911	LabKey Server Community Edition <18.3.0 - Cross-Site Scripting	labkey server	6.1 (v3.1)	Medium
CVE-2019-6112	WordPress Sell Media 2.4.1 - Cross-Site Scripting	sell media	6.1 (v3.1)	Medium
CVE-2019-8390	qdPM 9.1 - 'search[keywords]' Cross-Site Scripting	qdpm	6.1 (v3.0)	Medium
CVE-2019-8937	HotelDruid 2.3.0 - Cross-Site Scripting	hoteldruid	6.1 (v3.0)	Medium
CVE-2019-9553	Bolt CMS 3.6.4 - Cross-Site Scripting	bolt	6.1 (v3.1)	Medium
CVE-2020-1106	Microsoft Office SharePoint XSS Vulnerability	sharepoint enterprise server	6.1 (v3.1)	Medium
CVE-2020-12054	WordPress Catch Breadcrumb <1.5.4 - Cross-Site Scripting	catch breadcrumb	6.1 (v3.1)	Medium
CVE-2020-13258	Contentful <=2020-05-21 - Cross-Site Scripting	python example	6.1 (v3.1)	Medium
CVE-2020-14413	NeDi 1.9C - Cross-Site Scripting	nedi	6.1 (v3.1)	Medium
CVE-2020-15599	Victor CMS 1.0 - 'user_firstname' Persistent Cross-Site Scripting	victor cms	6.1 (v3.1)	Medium
CVE-2020-17362	Nova Lite < 1.3.9 - Cross-Site Scripting	nova lite	6.1 (v3.1)	Medium
CVE-2020-19283	Jeesns 1.4.2 - Cross-Site Scripting	jeesns	6.1 (v3.1)	Medium
CVE-2020-23517	Aryanic HighMail (High CMS) - Cross-Site Scripting	high cms	6.1 (v3.1)	Medium
CVE-2020-23814	XXL-JOB v2.2.0 — Stored Cross Site Scripting	xxl-job	6.1 (v3.1)	Medium
CVE-2020-24609	Savsoft Quiz 5 - Stored Cross-Site Scripting	savsoft quiz	6.1 (v3.1)	Medium
CVE-2020-24701	OX Appsuite - Cross-Site Scripting	open-xchange appsuite	6.1 (v3.1)	Medium
CVE-2020-27982	IceWarp WebMail 11.4.5.0 - Cross-Site Scripting	mail server	6.1 (v3.1)	Medium
CVE-2020-35416	PHPJabbers Appointment Scheduler 2.3 - Reflected XSS (Cross-Site Scripting)	phpjabbers appointment scheduler	6.1 (v3.1)	Medium
CVE-2020-6171	CLink Office 2.0 - Cross-Site Scripting	clink office	6.1 (v3.1)	Medium
CVE-2020-7107	WordPress Ultimate FAQ <1.8.30 - Cross-Site Scripting	ultimate faq	6.1 (v3.1)	Medium
CVE-2020-8191	Citrix ADC/Gateway - Cross-Site Scripting	application delivery controller firmware	6.1 (v3.1)	Medium
CVE-2020-9344	Jira Subversion ALM for Enterprise <8.8.2 - Cross-Site Scripting	subversion application lifecycle management	6.1 (v3.1)	Medium
CVE-2021-21799	Advantech R-SeeNet 2.4.12 - Cross-Site Scripting	r-seenet	6.1 (v3.1)	Medium
CVE-2021-21800	Advantech R-SeeNet 2.4.12 - Cross-Site Scripting	r-seenet	6.1 (v3.1)	Medium
CVE-2021-24213	GiveWP <= 2.9.7 - Cross-Site Scripting	givewp	6.1 (v3.1)	Medium
CVE-2021-24214	WordPress OpenID Connect Generic Client 3.8.0-3.8.1 - Cross-Site Scripting	openid connect generic client	6.1 (v3.1)	Medium
CVE-2021-24298	WordPress Simple Giveaways <2.36.2 - Cross-Site Scripting	simple giveaways	6.1 (v3.1)	Medium
CVE-2021-24316	WordPress Mediumish Theme <=1.0.47 - Cross-Site Scripting	mediumish	6.1 (v3.1)	Medium
CVE-2021-24320	WordPress Bello Directory & Listing Theme <1.6.0 - Cross-Site Scripting	bello	6.1 (v3.1)	Medium
CVE-2021-24335	WordPress Car Repair Services & Auto Mechanic Theme <4.0 - Cross-Site Scripting	car repair services & auto mechanic	6.1 (v3.1)	Medium
CVE-2021-24342	WordPress JNews Theme <8.0.6 - Cross-Site Scripting	jnews	6.1 (v3.1)	Medium
CVE-2021-24387	WordPress Pro Real Estate 7 Theme <3.1.1 - Cross-Site Scripting	real estate 7	6.1 (v3.1)	Medium
CVE-2021-24389	WordPress FoodBakery <2.2 - Cross-Site Scripting	foodbakery	6.1 (v3.1)	Medium
CVE-2021-24495	Wordpress Marmoset Viewer <1.9.3 - Cross-Site Scripting	marmoset viewer	6.1 (v3.1)	Medium
CVE-2021-24522	ProfilePress < 3.1.11 - Cross-Site Scripting	profilepress	6.1 (v3.1)	Medium
CVE-2021-25104	WordPress Ocean Extra <1.9.5 - Cross-Site Scripting	ocean extra	6.1 (v3.1)	Medium
CVE-2021-26247	Cacti - Cross-Site Scripting	cacti	6.1 (v3.1)	Medium
CVE-2021-26475	EPrints 3.4.2 - Cross-Site Scripting	eprints	6.1 (v3.1)	Medium
CVE-2021-26702	EPrints 3.4.2 - Cross-Site Scripting	eprints	6.1 (v3.1)	Medium
CVE-2021-26710	Redwood Report2Web 4.3.4.5 & 4.5.3 - Cross-Site Scripting	report2web	6.1 (v3.1)	Medium
CVE-2021-26947	Odoo <= 15.0 - Cross-Site Scripting	odoo	6.1 (v3.1)	Medium
CVE-2021-27309	Clansphere CMS 2011.4 - Cross-Site Scripting	clansphere	6.1 (v3.1)	Medium
CVE-2021-27310	Clansphere CMS 2011.4 - Cross-Site Scripting	clansphere	6.1 (v3.1)	Medium
CVE-2021-27695	openMAINT openMAINT 2.1-3.3-b - 'Multiple' Persistent Cross-Site Scripting	openmaint	6.1 (v3.1)	Medium
CVE-2021-29625	Adminer <=4.8.0 - Cross-Site Scripting	adminer	6.1 (v3.1)	Medium
CVE-2021-30049	SysAid Technologies 20.3.64 b14 - Cross-Site Scripting	sysaid	6.1 (v3.1)	Medium
CVE-2021-30203	Dzzoffice 2.02.1 - Cross-Site Scripting	dzzoffice	6.1 (v3.1)	Medium
CVE-2021-30213	Knowage Suite 7.3 - Cross-Site Scripting	knowage	6.1 (v3.1)	Medium
CVE-2021-31537	SIS Informatik REWE GO SP17 <7.7 - Cross-Site Scripting	sis-rewe go	6.1 (v3.1)	Medium
CVE-2021-31682	WebCTRL OEM <= 6.5 - Cross-Site Scripting	webctrl	6.1 (v3.1)	Medium
CVE-2021-31862	SysAid 20.4.74 - Cross-Site Scripting	sysaid	6.1 (v3.1)	Medium
CVE-2021-34630	GTranslate < 2.8.65 - Cross-Site Scripting	gtranslate	6.1 (v3.1)	Medium
CVE-2021-35488	Thruk 2.40-2 - Cross-Site Scripting	thruk	6.1 (v3.1)	Medium
CVE-2021-36646	KodExplorer - Cross-Site Scripting	kod-explorer	6.1 (v3.1)	Medium
CVE-2021-37416	Zoho ManageEngine ADSelfService Plus <=6103 - Cross-Site Scripting	manageengine adselfservice plus	6.1 (v3.1)	Medium
CVE-2021-37833	Hotel Druid 3.0.2 - Cross-Site Scripting	hoteldruid	6.1 (v3.1)	Medium
CVE-2021-3831	Gnuboard 5 - Cross-Site Scripting	gnuboard5	6.1 (v3.1)	Medium
CVE-2021-38702	Cyberoam NetGenie Cross-Site Scripting	netgenie c0101b1-20141120-ng11vo firmware	6.1 (v3.1)	Medium
CVE-2021-38704	ClinicCases 7.3.3 Cross-Site Scripting	cliniccases	6.1 (v3.1)	Medium
CVE-2021-39411	Hospital Management System 1.0 - Cross-Site Scripting	hospital management system	6.1 (v3.1)	Medium
CVE-2021-40868	Cloudron 6.2 Cross-Site Scripting	cloudron	6.1 (v3.1)	Medium
CVE-2021-41467	JustWriting - Cross-Site Scripting	justwriting	6.1 (v3.1)	Medium
CVE-2021-41951	Resourcespace - Cross-Site Scripting	resourcespace	6.1 (v3.1)	Medium
CVE-2021-42565	myfactory FMS - Cross-Site Scripting	fms	6.1 (v3.1)	Medium
CVE-2021-43725	Spotweb <= 1.5.1 - Cross Site Scripting (Reflected)	spotweb	6.1 (v3.1)	Medium
CVE-2021-45422	Reprise License Manager 14.2 - Cross-Site Scripting	reprise license manager	6.1 (v3.1)	Medium
CVE-2021-45425	SAFARI Montage 8.5 - Reflected Cross Site Scripting (XSS)	safari montage	6.1 (v3.1)	Medium
CVE-2021-46387	Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting (XSS)	zywall 2 plus internet security appliance firmware	6.1 (v3.1)	Medium
CVE-2022-0678	Microweber <1.2.11 - Cross-Site Scripting	microweber	6.1 (v3.1)	Medium
CVE-2022-1168	WordPress WP JobSearch <1.5.1 - Cross-Site Scripting	jobsearch wp job board	6.1 (v3.1)	Medium
CVE-2022-1170	JobMonster < 4.5.2.9 - Cross-Site Scripting	jobmonster	6.1 (v3.1)	Medium
CVE-2022-1221	WordPress Gwyn's Imagemap Selector <=0.3.3 - Cross-Site Scripting	gwyn's imagemap selector	6.1 (v3.1)	Medium
CVE-2022-2130	Microweber < 1.2.17 - Cross-Site Scripting	microweber	6.1 (v3.1)	Medium
CVE-2022-2168	WordPress Download Manager < 3.2.44 - Authenticated Cross-Site Scripting	download manager	6.1 (v3.1)	Medium
CVE-2022-2174	microweber 1.2.18 - Cross-site Scripting	microweber	6.1 (v3.1)	Medium
CVE-2022-22242	Juniper Web Device Manager - Cross-Site Scripting	junos	6.1 (v3.1)	Medium
CVE-2022-24384	SmarterTools SmarterTrack - Cross-Site Scripting	smartertrack	6.1 (v3.1)	Medium
CVE-2022-26564	HotelDruid Hotel Management Software 3.0.3 - Cross-Site Scripting	hoteldruid	6.1 (v3.1)	Medium
CVE-2022-2733	Openemr < 7.0.0.1 - Cross-Site Scripting	openemr	6.1 (v3.1)	Medium
CVE-2022-27926	Zimbra Collaboration (ZCS) - Cross Site Scripting	collaboration	6.1 (v3.1)	Medium
CVE-2022-28508	MantisBT < 2.25.2 - Cross-Site Scripting	mantisbt	6.1 (v3.1)	Medium
CVE-2022-29004	Diary Management System 1.0 - Cross-Site Scripting	e-diary management system	6.1 (v3.1)	Medium
CVE-2022-29005	Online Birth Certificate System 1.2 - Stored Cross-Site Scripting	online birth certificate system	6.1 (v3.1)	Medium
CVE-2022-30489	Wavlink WN-535G3 - Cross-Site Scripting	wn535g3 firmware	6.1 (v3.1)	Medium
CVE-2022-30776	Atmail 6.5.0 - Cross-Site Scripting	atmail	6.1 (v3.1)	Medium
CVE-2022-30777	Parallels H-Sphere 3.6.1713 - Cross-Site Scripting	h-sphere	6.1 (v3.1)	Medium
CVE-2022-30983	Support chatbot in Nopaperforms Niaa-Chatbot through 2022-05-17 Cross-Site Scripting Vulnerability	Support chatbot in Nopaperforms Niaa-Chatbot through 2022-05-17	6.1 (v3.1)	Medium
CVE-2022-31470	Axigen WebMail - Cross-Site Scripting	webmail	6.1 (v3.1)	Medium
CVE-2022-31798	Nortek Linear eMerge E3-Series - Cross-Site Scripting	emerge e3 firmware	6.1 (v3.1)	Medium
CVE-2022-3242	Microweber <1.3.2 - Cross-Site Scripting	microweber	6.1 (v3.1)	Medium
CVE-2022-32770	WWBN AVideo 11.6 - Cross-Site Scripting	avideo	6.1 (v3.1)	Medium
CVE-2022-32771	WWBN AVideo 11.6 - Cross-Site Scripting	avideo	6.1 (v3.1)	Medium
CVE-2022-34093	Software Publico Brasileiro i3geo v7.0.5 - Cross-Site Scripting	i3geo	6.1 (v3.1)	Medium
CVE-2022-34094	Software Publico Brasileiro i3geo v7.0.5 - Cross-Site Scripting	i3geo	6.1 (v3.1)	Medium
CVE-2022-34305	Apache Tomcat Examples Web Application - Cross-Site Scripting	tomcat	6.1 (v3.1)	Medium
CVE-2022-34328	PMB 7.3.10 - Cross-Site Scripting	pmb	6.1 (v3.1)	Medium
CVE-2022-3484	WordPress WPB Show Core - Cross-Site Scripting	wpb show core	6.1 (v3.1)	Medium
CVE-2022-35155	Bus Pass Management System 1.0 - Cross-Site Scripting (XSS)	bus pass management system	6.1 (v3.1)	Medium
CVE-2022-35493	eShop 3.0.4 - Cross-Site Scripting	eshop - ecommerce / store website	6.1 (v3.1)	Medium
CVE-2022-37153	Artica Proxy 4.30.000000 - Cross-Site Scripting	artica proxy	6.1 (v3.1)	Medium
CVE-2022-38295	Cuppa CMS v1.0 - Cross Site Scripting	cuppacms	6.1 (v3.1)	Medium
CVE-2022-39195	LISTSERV 17 - Cross-Site Scripting	listserv	6.1 (v3.1)	Medium
CVE-2022-41441	ReQlogic v11.3 - Cross Site Scripting	reqlogic	6.1 (v3.1)	Medium
CVE-2022-4301	WordPress Sunshine Photo Cart <2.9.15 - Cross-Site Scripting	sunshine photo cart	6.1 (v3.1)	Medium
CVE-2022-43016	OpenCATS 0.9.6 - Cross-Site Scripting	opencats	6.1 (v3.1)	Medium
CVE-2022-43018	OpenCATS 0.9.6 - Cross-Site Scripting	opencats	6.1 (v3.1)	Medium
CVE-2022-4321	PDF Generator for WordPress < 1.1.2 - Cross Site Scripting	pdf generator for wordpress	6.1 (v3.1)	Medium
CVE-2022-48012	OpenCATS 0.9.7 - Cross-Site Scripting	opencats	6.1 (v3.1)	Medium
CVE-2022-48197	Yahoo User Interface library (YUI2) TreeView v2.8.2 - Cross-Site Scripting	yui	6.1 (v3.1)	Medium
CVE-2023-0099	Simple URLs < 115 - Cross Site Scripting	simple urls	6.1 (v3.1)	Medium
CVE-2023-0334	ShortPixel Adaptive Images < 3.6.3 - Cross Site Scripting	shortpixel adaptive images	6.1 (v3.1)	Medium
CVE-2023-0527	Online Security Guards Hiring System - Cross-Site Scripting	online security guards hiring system	6.1 (v3.1)	Medium
CVE-2023-0676	phpIPAM 1.5.1 - Cross-site Scripting	phpipam	6.1 (v3.1)	Medium
CVE-2023-1119	WP-Optimize WordPress plugin < 3.2.13 - Cross-Site Scripting	wp-optimize,srbtranslatin	6.1 (v3.1)	Medium
CVE-2023-1880	Phpmyfaq v3.1.11 - Cross-Site Scripting	phpmyfaq	6.1 (v3.1)	Medium
CVE-2023-1890	Tablesome < 1.0.9 - Cross-Site Scripting	tablesome	6.1 (v3.1)	Medium
CVE-2023-2309	wpForo Forum <= 2.1.8 - Cross-Site Scripting	wpforo forum	6.1 (v3.1)	Medium
CVE-2023-23161	Art Gallery Management System Project v1.0 - Cross-Site Scripting	art gallery management system	6.1 (v3.1)	Medium
CVE-2023-24278	Squidex <7.4.0 - Cross-Site Scripting	squidex	6.1 (v3.1)	Medium
CVE-2023-24657	phpIPAM - 1.6 - Cross-Site Scripting	phpipam	6.1 (v3.1)	Medium
CVE-2023-25346	ChurchCRM 4.5.3 - Cross-Site Scripting	churchcrm	6.1 (v3.1)	Medium
CVE-2023-27641	L-Soft LISTSERV 16.5 - Cross-Site Scripting	listserv	6.1 (v3.1)	Medium
CVE-2023-2813	Wordpress Multiple Themes - Reflected Cross-Site Scripting	connections reloaded	6.1 (v3.1)	Medium
CVE-2023-2822	Ellucian Ethos Identity CAS - Cross-Site Scripting	ethos identity	6.1 (v3.1)	Medium
CVE-2023-2949	OpenEMR < 7.0.1 - Cross-site Scripting	openemr	6.1 (v3.1)	Medium
CVE-2023-29623	Purchase Order Management v1.0 - Cross Site Scripting (Reflected)	purchase order management	6.1 (v3.1)	Medium
CVE-2023-30210	OURPHP <= 7.2.0 - Cross Site Scripting	ourphp	6.1 (v3.1)	Medium
CVE-2023-30212	OURPHP <= 7.2.0 - Cross Site Scripting	ourphp	6.1 (v3.1)	Medium
CVE-2023-34599	Gibbon v25.0.0 - Cross-Site Scripting	gibbon	6.1 (v3.1)	Medium
CVE-2023-3479	Hestiacp <= 1.7.7 - Cross-Site Scripting	control panel	6.1 (v3.1)	Medium
CVE-2023-3521	FOSSBilling < 0.5.3 - Cross-Site Scripting	fossbilling	6.1 (v3.1)	Medium
CVE-2023-36306	Adiscon LogAnalyzer v.4.1.13 - Cross-Site Scripting	loganalyzer	6.1 (v3.1)	Medium
CVE-2023-36346	POS Codekop v2.0 - Cross Site Scripting	codekop	6.1 (v3.1)	Medium
CVE-2023-37580	Zimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site Scripting	zimbra	6.1 (v3.1)	Medium
CVE-2023-38192	SuperWebMailer 9.00.0.01710 - Cross-Site Scripting	superwebmailer	6.1 (v3.1)	Medium
CVE-2023-38194	SuperWebMailer - Cross-Site Scripting	superwebmailer	6.1 (v3.1)	Medium
CVE-2023-38501	CopyParty v1.8.6 - Cross Site Scripting	copyparty	6.1 (v3.1)	Medium
CVE-2023-38875	PHP Login System 2.0.1 - Cross-Site Scripting	php-login-system	6.1 (v3.1)	Medium
CVE-2023-39598	IceWarp Email Client - Cross Site Scripting	webclient	6.1 (v3.1)	Medium
CVE-2023-39600	IceWarp 11.4.6.0 - Cross-Site Scripting	icewarp	6.1 (v3.1)	Medium
CVE-2023-39700	IceWarp Mail Server v10.4.5 - Cross-Site Scripting	mail server	6.1 (v3.1)	Medium
CVE-2023-40750	PHPJabbers Yacht Listing Script v1.0 - Cross-Site Scripting	yacht listing script	6.1 (v3.1)	Medium
CVE-2023-40751	PHPJabbers Fundraising Script v1.0 - Cross-Site Scripting	fundraising script	6.1 (v3.1)	Medium
CVE-2023-40752	PHPJabbers Make an Offer Widget v1.0 - Cross-Site Scripting	make an offer widget	6.1 (v3.1)	Medium
CVE-2023-4110	PHPJabbers Availability Booking Calendar 5.0 - Cross-Site Scripting	availability booking calendar	6.1 (v3.1)	Medium
CVE-2023-4111	PHPJabbers Bus Reservation System 1.1 - Cross-Site Scripting	bus reservation system	6.1 (v3.1)	Medium
CVE-2023-4113	PHPJabbers Service Booking Script 1.0 - Cross Site Scripting	service booking script	6.1 (v3.1)	Medium
CVE-2023-4114	PHP Jabbers Night Club Booking 1.0 - Cross Site Scripting	night club booking software	6.1 (v3.1)	Medium
CVE-2023-4115	PHPJabbers Cleaning Business 1.0 - Cross-Site Scripting	cleaning business software	6.1 (v3.1)	Medium
CVE-2023-4116	PHPJabbers Taxi Booking 2.0 - Cross Site Scripting	taxi booking script	6.1 (v3.1)	Medium
CVE-2023-4136	CrafterCMS Engine - Cross-Site Scripting	craftercms	6.1 (v3.1)	Medium
CVE-2023-4148	Ditty < 3.1.25 - Cross-Site Scripting	ditty	6.1 (v3.1)	Medium
CVE-2023-41538	PHPJabbers PHP Forum Script 3.0 - Cross-Site Scripting	php forum script	6.1 (v3.1)	Medium
CVE-2023-41597	EyouCms v1.6.2 - Cross-Site Scripting	eyoucms	6.1 (v3.1)	Medium
CVE-2023-44812	mooSocial v.3.1.8 - Cross-Site Scripting	moosocial	6.1 (v3.1)	Medium
CVE-2023-4547	SPA-Cart eCommerce CMS 1.9.0.3 - Cross-Site Scripting	ecommerce cms	6.1 (v3.1)	Medium
CVE-2023-46732	XWiki < 14.10.14 - Cross-Site Scripting	xwiki	6.1 (v3.1)	Medium
CVE-2023-48728	WWBN AVideo 11.6 - Cross-Site Scripting	avideo	6.1 (v3.1)	Medium
CVE-2023-49293	Vite dev server - Cross-Site Scripting	vite	6.1 (v3.1)	Medium
CVE-2023-5558	LearnPress < 4.2.5.5 - Cross-Site Scripting	learnpress	6.1 (v3.1)	Medium
CVE-2023-5758	firefox mobile Cross-Site Scripting Vulnerability	firefox mobile	6.1 (v3.1)	Medium
CVE-2023-6275	TOTVS Fluig Platform - Cross-Site Scripting	fluig	6.1 (v3.1)	Medium
CVE-2023-6379	OpenCMS 14 & 15 - Cross Site Scripting	opencms	6.1 (v3.1)	Medium
CVE-2024-12724	WP DeskLite - Reflected XSS	wp desklite	6.1 (v3.1)	Medium
CVE-2024-13114	WP Projects Portfolio <= 3.0 - Cross-Site Scripting	wp projects portfolio with client testimonials	6.1 (v3.1)	Medium
CVE-2024-13331	WP Dream Carousel < 1.0.1b - Cross-Site Scripting	wp dream carousel	6.1 (v3.1)	Medium
CVE-2024-13619	LifterLMS < 8.0.1 - Cross-Site Scripting	lifterlms	6.1 (v3.1)	Medium
CVE-2024-13727	MemberSpace WordPress - Cross-Site Scripting	memberspace	6.1 (v3.1)	Medium
CVE-2024-13853	WordPress SEO Tools Plugin 4.0.7 - Cross-Site Scripting	seo-automatic-seo-tools	6.1 (v3.1)	Medium
CVE-2024-24494	Daily Habit Tracker 1.0 - Stored Cross-Site Scripting (XSS)	daily habit tracker	6.1 (v3.1)	Medium
CVE-2024-28734	Coda v.2024Q1 - Cross-Site Scripting	Unit4 Financials by Coda prior to 2023Q4	6.1 (v3.1)	Medium
CVE-2024-3231	Popup4Phone <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting	popup4phone	6.1 (v3.1)	Medium
CVE-2024-37259	WP Extended < 3.0.0 - Stored Cross-Site Scripting	wp extended	6.1 (v3.1)	Medium
CVE-2024-41810	Twisted - Open Redirect & XSS	twisted	6.1 (v3.1)	Medium
CVE-2025-25296	Label Studio < 1.16.0 - Cross-Site Scripting	label studio	6.1 (v3.1)	Medium
CVE-2025-2609	MagnusBilling Login Logs - Cross-Site Scripting	magnusbilling	6.1 (v3.1)	Medium
CVE-2025-4652	Broadstreet WordPress plugin - Reflected XSS	broadstreet	6.1 (v3.1)	Medium
CVE-2025-46550	YesWiki < 4.5.4 - Cross-Site Scripting	yeswiki	6.1 (v3.1)	Medium
CVE-2025-47204	Bootstrap Multiselect <= 1.1.2 - Cross-Site Scripting	bootstrap multiselect	6.1 (v3.1)	Medium
CVE-2025-51501	Microweber CMS2.0 - Cross-Site Scripting	microweber	6.1 (v3.1)	Medium
CVE-2025-5301	ONLYOFFICE Docs (DocumentServer) - Reflected Cross-Site Scripting	Docs (DocumentServer)	6.1 (v3.1)	Medium
CVE-2025-54589	Copyparty <=1.18.6 - Cross-Site Scripting	copyparty	6.1 (v3.1)	Medium
CVE-2025-63607	TechStore 1.0 Cross-Site Scripting Vulnerability	-	6.1 (v3.1)	Medium
CVE-2026-0561	Shield Security <= 21.0.8 - Unauthenticated Reflected XSS	shield-security	6.1 (v3.1)	Medium
CVE-2026-11588	EONSR AEO Agent <= 3.7.9 - Unauthenticated Stored XSS via Scheduled Post Creation	EONSR AEO Agent	6.1 (v3.1)	Medium
CVE-2026-11881	Fluent Forms < 6.2.6 - Contributor+ Stored XSS via Date/Time Field	Fluent Forms	6.1 (v3.1)	Medium
CVE-2026-13330	Animation Addons for Elementor < 2.7.0 - Author+ Stored XSS via SVG Upload	Animation Addons for Elementor	6.1 (v3.1)	Medium
CVE-2026-13400	Simply Schedule Appointments < 1.6.12.4 - Unauthenticated Stored XSS via Booking Customer Information	Simply Schedule Appointments	6.1 (v3.1)	Medium
CVE-2026-14921	Ultimate Addons for WPBakery Page Builder < 3.21.5 - Contributor+ Stored XSS via ult_buttons Shortcode	Ultimate Addons for WPBakery Page Builder	6.1 (v3.1)	Medium
CVE-2026-26028	CryptPad: Sanitizer Bypass in Diffmarked.js Allows Arbitrary HTML Injection and Potential XSS	cryptpad	6.1 (v3.1)	Medium
CVE-2026-3001	Gutenverse Plugin <= 3.4.6 - Cross-Site Scripting	gutenverse	6.1 (v3.1)	Medium
CVE-2026-30251	zenshare suite Cross-Site Scripting Vulnerability	zenshare suite	6.1 (v3.1)	Medium
CVE-2026-34206	Captcha Protect: Reflected XSS in challenge page via unsanitized destination rendered with text/template	captcha protect	6.1 (v3.1)	Medium
CVE-2026-34229	Emlog: Stored XSS in Comment Module via URI Scheme Validation Bypass	emlog	6.1 (v3.1)	Medium
CVE-2026-34396	AVideo: Stored XSS via Unescaped Plugin Configuration Values in Admin Panel	avideo	6.1 (v3.1)	Medium
CVE-2026-34739	AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php	avideo	6.1 (v3.1)	Medium
CVE-2026-36324	SourceCodester Doctor Appointment System 1.0 Cross-Site Scripting Vulnerability	-	6.1 (v3.1)	Medium
CVE-2026-37750	School Management System by mahmoudai1 Cross-Site Scripting Vulnerability	School Management System by mahmoudai1	6.1 (v3.1)	Medium
CVE-2026-38432	erpnext Cross-Site Scripting Vulnerability	erpnext	6.1 (v3.1)	Medium
CVE-2026-38446	Cross-Site Scripting	-	6.1 (v3.1)	Medium
CVE-2026-38472	forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 Cross-Site Scripting Vulnerability	forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449	6.1 (v3.1)	Medium
CVE-2026-41580	Stirling-PDF: Reflected XSS through crafted PDF metadata fields (Title and Author)	stirling pdf	6.1 (v3.1)	Medium
CVE-2026-50229	Apache Tomcat - Cross-Site Scripting	tomcat	6.1 (v3.1)	Medium
CVE-2026-51565	Modules/Docs/DocsController.php in Milk admin <=0.9.8 Cross-Site Scripting Vulnerability	Modules/Docs/DocsController.php in Milk admin <=0.9.8	6.1 (v3.1)	Medium
CVE-2026-52232	the /logo.asp component of FS Inc S3150-8T2F Switch 2.2.0D Build 118101 Cross-Site Scripting Vulnerability	the /logo.asp component of FS Inc S3150-8T2F Switch 2.2.0D Build 118101	6.1 (v3.1)	Medium
CVE-2026-52475	aiflowy <= 2.1.2 Cross-Site Scripting Vulnerability	aiflowy <= 2.1.2	6.1 (v3.1)	Medium
CVE-2026-52773	YesWiki Archived Revision - Cross-Site Scripting	yeswiki	6.1 (v3.1)	Medium
CVE-2026-55087	Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (ope	etherpad	6.1 (v3.1)	Medium
CVE-2026-5776	Email Encoder < 2.4.7 - Unauthenticated Stored XSS	Email Encoder	6.1 (v3.1)	Medium
CVE-2026-61526	AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler	http-server	6.1 (v3.1)	Medium
CVE-2026-73084	Activepieces: Reflected Cross-Site Scripting in OAuth Redirect Endpoint	activepieces	6.1 (v3.1)	Medium
CVE-2026-75170	the /loginController/doLogin endpoint of the HubCore platform (version 14.1.1) Cross-Site Scripting Vulnerability	the /loginController/doLogin endpoint of the HubCore platform (version 14.1.1)	6.1 (v3.1)	Medium
CVE-2026-78742	Silverpeas Core <=6.4.6 Cross-Site Scripting Vulnerability	-	6.1 (v3.1)	Medium
CVE-2026-8447	Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untruste	langflow	6.1 (v3.1)	Medium
CVE-2023-6717	Keycloak: xss via assertion consumer service url in saml post-binding flow	Red Hat AMQ Broker 7	6.0 (v3.1)	Medium
CVE-2026-8245	Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection	concrete cms	6.0 (v4.0)	Medium
CVE-2026-84193	LibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP	librenms	5.8 (v4.0)	Medium
CVE-2026-5827	code-projects Simple IT Discussion Forum question-function.php sql injection	Simple IT Discussion Forum	5.5 (v4.0)	Medium
CVE-2016-10993	ScoreMe Theme - Cross-Site Scripting	scoreme	5.4 (v3.1)	Medium
CVE-2016-9316	Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities	interscan web security virtual appliance	5.4 (v3.0)	Medium
CVE-2017-3131	Fortinet FortiOS < 5.6.0 - Cross-Site Scripting	fortios	5.4 (v3.0)	Medium
CVE-2017-6340	Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities	interscan web security virtual appliance	5.4 (v3.0)	Medium
CVE-2018-12095	OEcms 3.1 - Cross-Site Scripting	oecms	5.4 (v3.0)	Medium
CVE-2018-15917	Jorani Leave Management System 0.6.5 - Cross-Site Scripting	jorani	5.4 (v3.0)	Medium
CVE-2018-16736	Roundcube rcfilters plugin 2.1.6 - Cross-Site Scripting	rcfilters	5.4 (v3.0)	Medium
CVE-2018-6226	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	5.4 (v3.0)	Medium
CVE-2018-6227	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	5.4 (v3.0)	Medium
CVE-2018-8024	Apache Spark UI - Cross-Site Scripting	spark	5.4 (v3.0)	Medium
CVE-2019-9556	Fiberhome AN5506-04-F RP2669 - Persistent Cross-Site Scripting	an5506-04-f firmware	5.4 (v3.1)	Medium
CVE-2020-11456	LimeSurvey 4.1.11 - 'Survey Groups' Persistent Cross-Site Scripting	limesurvey	5.4 (v3.1)	Medium
CVE-2020-12256	rConfig 3.9.4 - Cross-Site Scripting	rconfig	5.4 (v3.1)	Medium
CVE-2020-12259	rConfig 3.9.4 - Cross-Site Scripting	rconfig	5.4 (v3.1)	Medium
CVE-2020-12706	php-fusion 9.03.50 - Persistent Cross-Site Scripting	php-fusion	5.4 (v3.1)	Medium
CVE-2020-20988	DomainMOD 4.13.0 - Cross-Site Scripting	domainmod	5.4 (v3.1)	Medium
CVE-2020-27533	DedeCMS v.5.8 - keyword Cross-Site Scripting	dedecms	5.4 (v3.1)	Medium
CVE-2020-35774	twitter-server Cross-Site Scripting	twitter-server	5.4 (v3.1)	Medium
CVE-2020-9467	Piwigo 2.10.1 - Cross Site Scripting	piwigo	5.4 (v3.1)	Medium
CVE-2021-31250	CHIYU TCP/IP Converter - Cross-Site Scripting	bf-430 firmware	5.4 (v3.1)	Medium
CVE-2021-40577	Online Enrollment Management System in PHP and PayPal 1.0 - 'U_NAME' Stored Cross-Site Scripting	online enrollment management system	5.4 (v3.1)	Medium
CVE-2021-46005	Sourcecodester Car Rental Management System 1.0 - Stored Cross-Site Scripting	car rental management system	5.4 (v3.1)	Medium
CVE-2022-0928	Microweber < 1.2.12 - Stored Cross-Site Scripting	microweber	5.4 (v3.1)	Medium
CVE-2022-0954	Microweber <1.2.11 - Stored Cross-Site Scripting	microweber	5.4 (v3.1)	Medium
CVE-2022-25489	Atom CMS v2.0 - Cross-Site Scripting	atomcms	5.4 (v3.1)	Medium
CVE-2022-48178	X2CRM v6.6/6.9 - Stored Cross-Site Scripting (XSS) (Authenticated)	x2crm	5.4 (v3.1)	Medium
CVE-2023-34537	Hoteldruid 3.0.5 - Cross-Site Scripting	hoteldruid	5.4 (v3.1)	Medium
CVE-2023-5452	SnipeIT 6.2.1 - Stored Cross Site Scripting	snipe-it	5.4 (v3.1)	Medium
CVE-2024-33724	SOPlanning 1.52.00 Cross Site Scripting	soplanning	5.4 (v3.1)	Medium
CVE-2024-48120	X2CRM 8.5 - Stored Cross-Site Scripting (XSS)	x2crm	5.4 (v3.1)	Medium
CVE-2024-52762	Ganglia Web Interface (v3.7.3 - v3.7.6) - Cross-Site Scripting	ganglia-web	5.4 (v3.1)	Medium
CVE-2025-2610	MagnusBilling Alarm Module - Cross-Site Scripting	magnusbilling	5.4 (v3.1)	Medium
CVE-2026-11569	Quay: quay: stored xss via filedrop svg upload	Red Hat Quay 3	5.4 (v3.1)	Medium
CVE-2026-15245	BNE Testimonials < 2.0.8.2 - Contributor+ Stored XSS via Slider Shortcode	BNE Testimonials	5.4 (v3.1)	Medium
CVE-2026-16063	Event Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event Timeline Content	Event Booking Manager for WooCommerce	5.4 (v3.1)	Medium
CVE-2026-16537	Slick Slider < 0.5.3 - Contributor+ Stored XSS via Gallery Shortcode	Slick Slider	5.4 (v3.1)	Medium
CVE-2026-16558	YMC Filter < 3.12.8 - Contributor+ Stored XSS via Layout Builder Schema	YMC Filter	5.4 (v3.1)	Medium
CVE-2026-18395	Child Pages Card < 1.09 - Contributor+ Stored XSS via Shortcode Attributes	Child Pages Card	5.4 (v3.1)	Medium
CVE-2026-34848	hoppscotch: Stored XSS in team member overflow tooltip via display name	hoppscotch	5.4 (v3.1)	Medium
CVE-2026-34974	phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding leads to Stored XSS and Privilege Escalation	phpmyfaq	5.4 (v3.1)	Medium
CVE-2026-35403	LORIS has potential cross-site scripting in survey_accounts module	loris	5.4 (v3.1)	Medium
CVE-2026-38473	the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 Cross-Site Scripting Vulnerability	the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449	5.4 (v3.1)	Medium
CVE-2026-39380	Open Source Point of Sale has Stored XSS in Stock Location (Configuration)	open source point of sale	5.4 (v3.1)	Medium
CVE-2026-39964	TypeBot: Stored XSS via javascript: URI in text bubble links — bot author executes JS on visitors' browsers	typebot.io	5.4 (v3.1)	Medium
CVE-2026-45138	CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule	ci4ms	5.4 (v3.1)	Medium
CVE-2026-45580	WWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute	avideo	5.4 (v3.1)	Medium
CVE-2026-45694	LibreNMS: Reflected XSS in the Proxmox app view via unsanitized instance/vmid parameters	librenms	5.4 (v3.1)	Medium
CVE-2026-72570	cube-root directory-serve - Stored Cross-Site Scripting via Malicious Filename	directory-serve	5.4 (v3.1)	Medium
CVE-2026-72583	fastschema - Stored Cross-Site Scripting via MIME Type Bypass in File Upload	fastschema	5.4 (v3.1)	Medium
CVE-2026-82396	Sulu: Stored XSS via media download inline-disposition override	sulu	5.4 (v3.1)	Medium
CVE-2026-9278	Form Builder CP < 1.2.47 - Editor+ Stored XSS via form_structure	Form Builder CP	5.4 (v3.1)	Medium
CVE-2019-17503	Kirona-DRS 5.5.3.5 - Information Disclosure	dynamic resource scheduling	5.3 (v3.1)	Medium
CVE-2019-25731	Zuz Music 2.1 Persistent Cross-site Scripting via zuzconsole Contact	Zuz Music	5.3 (v4.0)	Medium
CVE-2023-30943	Moodle - Cross-Site Scripting/Remote Code Execution	moodle	5.3 (v3.1)	Medium
CVE-2024-11587	idcCMS V1.60 - Cross-Site Scripting	idccms	5.3 (v4.0)	Medium
CVE-2024-9007	123Solar 1.8.4.5 - Cross-Site Scripting	123solar	5.3 (v4.0)	Medium
CVE-2025-2127	JoomlaUX JUX Real Estate 3.4.0 - Reflected XSS	jux real estate	5.3 (v4.0)	Medium
CVE-2025-2710	Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting	ufida erp-nc	5.3 (v4.0)	Medium
CVE-2025-2711	Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting	ufida erp-nc	5.3 (v4.0)	Medium
CVE-2025-2712	Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting	ufida erp-nc	5.3 (v4.0)	Medium
CVE-2026-35208	lichess.org has an Unsanitized Stream Title Injection on /streamer	lila	5.3 (v4.0)	Medium
CVE-2026-41472	CyberPanel < 2.4.5 Stored XSS via AI Scanner Dashboard	cyberpanel	5.3 (v4.0)	Medium
CVE-2026-48094	ShareOpenly has Cross-Site Scripting (XSS) via Missing esc_url() on Shared URL in Content Output	shareopenly	5.3 (v4.0)	Medium
CVE-2026-5808	openstatusHQ openstatus Onboarding Endpoint client.tsx cross site scripting	openstatus	5.3 (v4.0)	Medium
CVE-2026-59232	Stored Cross-site Scripting in Prospero Flow CRM lead name field	Prospero Flow CRM	5.3 (v4.0)	Medium
CVE-2026-69116	FlyEnv < 4.18.0 Cross-Site Scripting via v-html	FlyEnv	5.3 (v4.0)	Medium
CVE-2026-73038	NodeBB < 4.15.0 Stored XSS via ActivityPub emoji tag.icon.url and tag.name	NodeBB	5.3 (v4.0)	Medium
CVE-2026-73422	Astro: Reflected XSS via unescaped View Transition animation properties	astro	5.3 (v4.0)	Medium
CVE-2026-73628	Serendipity 2.3.5 Reflected XSS via search clean-URL route	Serendipity	5.3 (v4.0)	Medium
CVE-2026-76837	Baserow before 2.3.0 Stored Cross-Site Scripting via Rich Text Mention Display Name	Baserow	5.3 (v4.0)	Medium
CVE-2026-82646	WWBN AVideo Unauthenticated Reflected XSS via url2Embed.json.php	AVideo	5.3 (v4.0)	Medium
CVE-2026-84191	LibreNMS before 26.5.0 Stored XSS via SNMP VRF fields	librenms	5.3 (v4.0)	Medium
CVE-2026-85158	AVideo Reflected XSS via videoEmbeded.php link parameter	AVideo	5.3 (v4.0)	Medium
CVE-2026-85159	AVideo Reflected XSS via cancelUri in userLogin.php	AVideo	5.3 (v4.0)	Medium
CVE-2026-85577	AVideo userLogin.php Reflected XSS via error parameter	AVideo	5.3 (v4.0)	Medium
CVE-2018-25248	MyBB Downloads Plugin 2.0.3 Persistent XSS via downloads.php	mybb downloads	5.1 (v4.0)	Medium
CVE-2018-25349	userSpice 4.3.24 Cross-Site Scripting via X-Forwarded-For Header	userSpice	5.1 (v4.0)	Medium
CVE-2021-47931	Exponent CMS 2.6 Multiple Vulnerabilities Stored XSS Authentication	Exponent CMS	5.1 (v4.0)	Medium
CVE-2021-47947	Projectsend r1295 Stored Cross-Site Scripting via files-edit.php	Projectsend	5.1 (v4.0)	Medium
CVE-2022-50943	Moodle LMS 4.0 Cross-Site Scripting via course search.php	moodle	5.1 (v4.0)	Medium
CVE-2022-50961	WordPress Plugin IP2Location Country Blocker 2.26.7 Stored XSS	IP2Location Country Blocker	5.1 (v4.0)	Medium
CVE-2022-50962	uBidAuction 2.0.1 myOrders Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2022-50963	uBidAuction 2.0.1 myAuctions active Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2022-50964	uBidAuction 2.0.1 myAuctions loose Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2022-50965	uBidAuction 2.0.1 posts manage Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2022-50966	uBidAuction 2.0.1 news manage Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2022-50968	uBidAuction 2.0.1 auctions manage Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2022-50969	uBidAuction 2.0.1 mailingLog manage Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2025-34032	Moodle LMS Jmol Plugin <= 6.1 - Cross-Site Scripting	jmol	5.1 (v4.0)	Medium
CVE-2025-41393	Ricoh Web Image Monitor - Reflected XSS	Multiple laser printers and MFPs which implement Web Image Monitor	5.1 (v4.0)	Medium
CVE-2025-71404	better-auth before 1.1.16 Reflected XSS via error parameter	better-auth	5.1 (v4.0)	Medium
CVE-2026-19434	Stored Cross-site Scripting in Pentestify finding severity field	Pentestify	5.1 (v4.0)	Medium
CVE-2026-19716	Stored Cross-site Scripting in Pentestify user account deletion via unescaped username	Pentestify	5.1 (v4.0)	Medium
CVE-2026-22675	OCS Inventory NG Server Stored XSS via User-Agent	ocs inventory server	5.1 (v4.0)	Medium
CVE-2026-25557	Evoluted PHP Directory Listing Script 4.0.5 Reflected XSS via dir parameter	PHP Directory Listing Script	5.1 (v4.0)	Medium
CVE-2026-27176	MajorDoMo - Cross-Site Scripting	majordomo	5.1 (v4.0)	Medium
CVE-2026-32856	Ellucian Banner Self-Service Reflected XSS via dateConverter	Banner Self-Service	5.1 (v4.0)	Medium
CVE-2026-34416	OSCAL-GUI Reflected XSS via project parameter in oscal.php	OSCAL-GUI	5.1 (v4.0)	Medium
CVE-2026-34417	OSCAL-GUI Reflected XSS via project parameter in oscal-forms.php	OSCAL-GUI	5.1 (v4.0)	Medium
CVE-2026-34798	Endian Firewall /cgi-bin/routing.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34799	Endian Firewall /manage/dnsmasq/hosts/ remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34800	Endian Firewall /cgi-bin/uplinkeditor.cgi NAME Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34801	Endian Firewall /manage/dhcp/fixed_leases/ remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34802	Endian Firewall /cgi-bin/salearn.cgi remark user ham spam Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34803	Endian Firewall /manage/qos/classes/ name Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34804	Endian Firewall /manage/qos/rules/ dscp Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34805	Endian Firewall /cgi-bin/dnat.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34806	Endian Firewall /cgi-bin/snat.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34807	Endian Firewall /cgi-bin/incoming.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34808	Endian Firewall /cgi-bin/outgoingfw.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34809	Endian Firewall /cgi-bin/zonefw.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34810	Endian Firewall /cgi-bin/vpnfw.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34811	Endian Firewall /cgi-bin/xtaccess.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34812	Endian Firewall /cgi-bin/proxypolicy.cgi mimetypes Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34813	Endian Firewall /cgi-bin/proxyuser.cgi user Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34814	Endian Firewall /cgi-bin/proxygroup.cgi group Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34815	Endian Firewall /cgi-bin/smtpdomains.cgi DOMAIN Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34816	Endian Firewall /manage/smtpscan/domainrouting/ domain Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34817	Endian Firewall /cgi-bin/smtprouting.cgi ADDRESS BCC Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34818	Endian Firewall /manage/dnsmasq/localdomains/ remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34819	Endian Firewall /cgi-bin/openvpnclient.cgi REMARK Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34820	Endian Firewall /manage/ipsec/ remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34821	Endian Firewall /manage/vpnauthentication/user/ remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34822	Endian Firewall /manage/ca/certificate/ new_cert_name Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34823	Endian Firewall /manage/password/web/ remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-35007	Open ISES Tickets < 3.44.2 Reflected XSS via single_unit.php id Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35008	Open ISES Tickets < 3.44.2 Reflected XSS via single.php ticket_id Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35009	Open ISES Tickets < 3.44.2 Reflected XSS via add_note.php ticket_id Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35010	Open ISES Tickets < 3.44.2 Reflected XSS via patient_JF.php ticket_id Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35011	Open ISES Tickets < 3.44.2 Reflected XSS via opena.php frm_call Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35012	Open ISES Tickets < 3.44.2 Reflected XSS via add_facnote.php ticket_id Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35014	Open ISES Tickets < 3.44.2 Reflected XSS via routes_nm.php ticket_id Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35015	Open ISES Tickets < 3.44.2 Reflected XSS via do_unit_mail.php the_ticket Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35016	Open ISES Tickets < 3.44.2 Reflected XSS via search.php frm_query Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-40508	OpenEMR < 8.3.0 Stored XSS via Patient Portal Template Import Handler	openemr	5.1 (v4.0)	Medium
CVE-2026-42840	ERPNext 16.16.0 - Stored XSS in POS customer section via unescaped template literals	ERPNext	5.1 (v4.0)	Medium
CVE-2026-45551	Group-Office: Authenticated Stored XSS in Administrator Context via Arbitrary Cross-User Setting Write	groupoffice	5.1 (v4.0)	Medium
CVE-2026-47106	Ellucian Banner Self-Service Stored XSS via getFacultyMeetingTimes API	Banner Self-Service	5.1 (v4.0)	Medium
CVE-2026-48214	Open ISES Tickets < 3.44.2 Reflected XSS via add_nm.php ticket_id Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48215	Open ISES Tickets < 3.44.2 Reflected XSS via circle.php frm_id Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48218	Open ISES Tickets < 3.44.2 Reflected XSS via icons/buttons/landb.php frm_name and frm_id Parameters	Tickets	5.1 (v4.0)	Medium
CVE-2026-48219	Open ISES Tickets < 3.44.2 Reflected XSS via ics202.php frm_add_str Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48220	Open ISES Tickets < 3.44.2 Reflected XSS via ics205.php frm_add_str Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48221	Open ISES Tickets < 3.44.2 Reflected XSS via ics205a.php frm_add_str Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48222	Open ISES Tickets < 3.44.2 Reflected XSS via ics213.php frm_add_str Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48223	Open ISES Tickets < 3.44.2 Reflected XSS via ics213rr.php frm_add_str Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48224	Open ISES Tickets < 3.44.2 Reflected XSS via ics214.php frm_add_str Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48225	Open ISES Tickets < 3.44.2 Reflected XSS via landb.php _type Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48226	Open ISES Tickets < 3.44.2 Reflected XSS via os_watch.php ref and mode_orig Parameters	Tickets	5.1 (v4.0)	Medium
CVE-2026-48227	Open ISES Tickets < 3.44.2 Reflected XSS via patient.php id and ticket_id Parameters	Tickets	5.1 (v4.0)	Medium
CVE-2026-48228	Open ISES Tickets < 3.44.2 Reflected XSS via patient_w.php id and ticket_id Parameters	Tickets	5.1 (v4.0)	Medium
CVE-2026-48229	Open ISES Tickets < 3.44.2 Reflected XSS via routes_i.php ticket_id Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48530	GFI Archiver < 15.13 Stored XSS via CategorizationPolicyWizard.aspx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48531	GFI Archiver < 15.13 Stored XSS via RetentionPolicyWizard.aspx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48532	GFI Archiver < 15.13 Stored XSS via FAARetentionPolicyWizard.aspx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48534	GFI Archiver < 15.13 Stored XSS via ImapServerWizard.aspx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48535	GFI Archiver < 15.13 Stored XSS via CallHomeSettingsWizard.aspx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48536	GFI Archiver < 15.13 Stored XSS via GeneralSettingsWizard.aspx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48537	GFI Archiver < 15.13 Stored XSS via FileArchiveAssistantWizard.aspx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48538	GFI Archiver < 15.13 Stored XSS via ImportSettingsWizard.ashx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48539	GFI Archiver < 15.13 Stored XSS via MailInsights.aspx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48552	Nagios Core / XI DOM-based XSS via jsonquery.js	Nagios Core	5.1 (v4.0)	Medium
CVE-2026-48559	Lightweight Music Server 3.76.0 Stored XSS via Media File Metadata Tags	lms	5.1 (v4.0)	Medium
CVE-2026-50230	Lyrion Music Server <= 9.2.0 - Cross-Site Scripting	Lyrion Music Server	5.1 (v4.0)	Medium
CVE-2026-53992	Reflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date Parameters	ProjectSend	5.1 (v4.0)	Medium
CVE-2026-56126	pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php	pfSense Plus	5.1 (v4.0)	Medium
CVE-2026-57857	Flow Payment Plugin for WordPress Reflected Cross-Site Scripting via error_message Parameter	Flow Payment	5.1 (v4.0)	Medium
CVE-2026-64628	Grav Stored Cross-Site Scripting via Shortcode Attribute Handlers	grav	5.1 (v4.0)	Medium
CVE-2026-65697	Fathom Lite 1.3.1 Stored XSS via /collect Endpoint	fathom	5.1 (v4.0)	Medium
CVE-2026-66296	Reflected XSS in oaskit's default HTML error handler	oaskit	5.1 (v4.0)	Medium
CVE-2026-67333	better-auth before 1.6.13 Stored XSS via javascript redirect_uri	better-auth	5.1 (v4.0)	Medium
CVE-2026-68583	luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name	luci	5.1 (v4.0)	Medium
CVE-2026-71503	Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template	dolibarr	5.1 (v4.0)	Medium
CVE-2026-72743	SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html	SQLBot	5.1 (v4.0)	Medium
CVE-2026-72747	AVideo Stored Cross-Site Scripting via Unauthenticated Registration	AVideo	5.1 (v4.0)	Medium
CVE-2026-72821	Grav Form Plugin before 9.1.15 Stored XSS via Radio Toggle	grav	5.1 (v4.0)	Medium
CVE-2026-73319	XenForo < 2.3.13 XSS via Dynamic Redirect Handler	XenForo	5.1 (v4.0)	Medium
CVE-2026-75831	Grav before 2.0.15 Stored XSS via audio/video source URL	grav	5.1 (v4.0)	Medium
CVE-2026-84477	AVideo Stored XSS via Live Schedule Title Description	AVideo	5.1 (v4.0)	Medium
CVE-2026-85593	phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode	phpMyFAQ	5.1 (v4.0)	Medium
CVE-2026-85600	Grav Admin before 2.0.21 Stored XSS via username	grav-plugin-admin2	5.1 (v4.0)	Medium
CVE-2026-86197	Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox	grav	5.1 (v4.0)	Medium
CVE-2011-4898	WordPress Core 3.3.1 - Multiple Vulnerabilities	WordPress	5.0 (v2.0)	Medium
CVE-2012-5192	Bitweaver 2.8.1 - Multiple Vulnerabilities	bitweaver	5.0 (v2.0)	Medium
CVE-2015-4666	Xceedium Xsuite - Multiple Vulnerabilities	xsuite	5.0 (v2.0)	Medium
CVE-2017-14651	WSO2 Data Analytics Server 3.1.0 - Cross-Site Scripting	api manager	4.8 (v3.1)	Medium
CVE-2018-1000856	DomainMOD 4.11.01 - Cross-Site Scripting	domainmod	4.8 (v3.0)	Medium
CVE-2018-1186	Dell EMC Isilon OneFS - Multiple Vulnerabilities	emc isilon	4.8 (v3.0)	Medium
CVE-2018-1187	Dell EMC Isilon OneFS - Multiple Vulnerabilities	emc isilon	4.8 (v3.0)	Medium
CVE-2018-1188	Dell EMC Isilon OneFS - Multiple Vulnerabilities	emc isilon	4.8 (v3.0)	Medium
CVE-2018-1189	Dell EMC Isilon OneFS - Multiple Vulnerabilities	emc isilon	4.8 (v3.0)	Medium
CVE-2018-1201	Dell EMC Isilon OneFS - Multiple Vulnerabilities	emc isilon	4.8 (v3.0)	Medium
CVE-2018-1202	Dell EMC Isilon OneFS - Multiple Vulnerabilities	emc isilon	4.8 (v3.0)	Medium
CVE-2018-19749	DomainMOD 4.11.01 - Cross-Site Scripting	domainmod	4.8 (v3.0)	Medium
CVE-2018-19751	DomainMOD 4.11.01 - Cross-Site Scripting	domainmod	4.8 (v3.0)	Medium
CVE-2018-19752	DomainMOD 4.11.01 - Cross-Site Scripting	domainmod	4.8 (v3.0)	Medium
CVE-2018-19892	DomainMOD 4.11.01 - Cross-Site Scripting	domainmod	4.8 (v3.0)	Medium
CVE-2018-19914	DomainMOD 4.11.01 - Cross-Site Scripting	domainmod	4.8 (v3.0)	Medium
CVE-2018-19915	DomainMOD <=4.11.01 - Cross-Site Scripting	domainmod	4.8 (v3.0)	Medium
CVE-2018-20009	DomainMOD 4.11.01 - Cross-Site Scripting	domainmod	4.8 (v3.0)	Medium
CVE-2018-20010	DomainMOD 4.11.01 - Cross-Site Scripting	domainmod	4.8 (v3.0)	Medium
CVE-2018-20011	DomainMOD 4.11.01 - Cross-Site Scripting	domainmod	4.8 (v3.0)	Medium
CVE-2018-20418	Craft CMS 3.0.25 - Cross-Site Scripting	craft cms	4.8 (v3.0)	Medium
CVE-2019-19742	D-Link DIR-615 Wireless Router - Persistent Cross-Site Scripting	dir-615 firmware	4.8 (v3.1)	Medium
CVE-2020-29477	Invision Community 4.5.4 - 'Field Name' Stored Cross-Site Scripting	community	4.8 (v3.1)	Medium
CVE-2021-46068	Vehicle Service Management System - Stored Cross-Site Scripting	vehicle service management system	4.8 (v3.1)	Medium
CVE-2021-46069	Vehicle Service Management System 1.0 - Stored Cross Site Scripting	vehicle service management system	4.8 (v3.1)	Medium
CVE-2021-46071	ehicle Service Management System 1.0 - Cross-Site Scripting	vehicle service management system	4.8 (v3.1)	Medium
CVE-2021-46072	Vehicle Service Management System 1.0 - Stored Cross Site Scripting	vehicle service management system	4.8 (v3.1)	Medium
CVE-2021-46073	Vehicle Service Management System 1.0 - Cross Site Scripting	vehicle service management system	4.8 (v3.1)	Medium
CVE-2023-0563	Bank Locker Management System - Cross-Site Scripting	bank locker management system	4.8 (v3.1)	Medium
CVE-2024-3822	Base64 Encoder/Decoder <= 0.9.2 - Reflected XSS	base64 encoderdecoder	4.8 (v3.1)	Medium
CVE-2024-50857	GestioIP - Reflected Cross-Site Scripting	gestioip	4.8 (v3.1)	Medium
CVE-2025-15669	Bit Form < 3.1.4 - Admin+ Stored XSS via Conversational Form Progress Label	Bit Form	4.8 (v3.1)	Medium
CVE-2026-26211	Ekushey Project Manager CRM 5.0 Stored XSS via System Name Field	Ekushey Project Manager CRM	4.8 (v4.0)	Medium
CVE-2026-34246	CtrlPanel: Stored XSS in Admin Role Management via Unescaped DataTable HTML Output	panel	4.8 (v3.1)	Medium
CVE-2026-39390	CI4MS has Stored XSS via srcdoc attribute bypass in Google Maps iframe setting	ci4ms	4.8 (v3.1)	Medium
CVE-2026-39392	CI4MS has Stored XSS in Pages Content Due to Missing html_purify Sanitization	ci4ms	4.8 (v3.1)	Medium
CVE-2026-67612	OpenEMR 8.2.0 Stored XSS via import_template.php Template Management	openemr	4.8 (v4.0)	Medium
CVE-2026-67617	Microweber CMS 2.0.20 Stored XSS via tag_names Parameter	microweber	4.8 (v4.0)	Medium
CVE-2026-70560	Ultimate POS Stored XSS via First Name Field in Leave Notifications	Ultimate POS (Stock Management & Point of Sale)	4.8 (v4.0)	Medium
CVE-2026-79663	Ech0 before 4.7.3 Stored XSS via RSS feed tag names	Ech0	4.8 (v4.0)	Medium
CVE-2026-79670	Ech0 before 4.4.3 Stored XSS via SVG Upload	Ech0	4.8 (v4.0)	Medium
CVE-2026-84188	librenms before 26.7.0 Stored XSS via graph_descr settings	librenms	4.8 (v4.0)	Medium
CVE-2024-24050	Workout Journal App 1.0 - Stored XSS	workout journal app	4.7 (v3.1)	Medium
CVE-2026-3093	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab	gitlab	4.7 (v3.1)	Medium
CVE-2026-16273	Narrative Publisher <= 1.0.7 - Contributor+ Stored XSS via narrative_post_script Post Meta	Narrative Publisher	4.6 (v3.1)	Medium
CVE-2026-53468	Typemill has Stored HTML Attribute Injection in Metadata Fields	typemill	4.6 (v3.1)	Medium
CVE-2026-75331	tamguo 1.5.3 Cross-Site Scripting Vulnerability	-	4.6 (v3.1)	Medium
CVE-2005-3128	SquirrelMail Address Add 1.4.2 - Cross-Site Scripting	address add plugin	4.3 (v2.0)	Medium
CVE-2005-4385	Cofax <=2.0RC3 - Cross-Site Scripting	cofax	4.3 (v2.0)	Medium
CVE-2008-6982	Devalcms 1.4a - Cross-Site Scripting	devalcms	4.3 (v2.0)	Medium
CVE-2009-1872	Adobe Coldfusion <=8.0.1 - Cross-Site Scripting	coldfusion	4.3 (v2.0)	Medium
CVE-2011-4624	GRAND FlAGallery 1.57 - Cross-Site Scripting	grand flagallery	4.3 (v2.0)	Medium
CVE-2011-5106	WordPress Plugin Flexible Custom Post Type < 0.1.7 - Cross-Site Scripting	flexible custom post type	4.3 (v2.0)	Medium
CVE-2011-5107	Alert Before Your Post <= 0.1.1 - Cross-Site Scripting	alert before you post	4.3 (v2.0)	Medium
CVE-2011-5265	Featurific For WordPress 1.6.2 - Cross-Site Scripting	featurific-for-wordpress	4.3 (v2.0)	Medium
CVE-2012-0782	WordPress Core 3.3.1 - Multiple Vulnerabilities	WordPress	4.3 (v2.0)	Medium
CVE-2012-1835	WordPress Plugin All-in-One Event Calendar 1.4 - Cross-Site Scripting	all-in-one event calendar	4.3 (v2.0)	Medium
CVE-2012-2371	WP-FaceThumb 0.1 - Cross-Site Scripting	wp-facethumb	4.3 (v2.0)	Medium
CVE-2012-4242	WordPress Plugin MF Gig Calendar 0.9.2 - Cross-Site Scripting	mf gig calendar	4.3 (v2.0)	Medium
CVE-2012-4273	2 Click Socialmedia Buttons < 0.34 - Cross-Site Scripting	2-click-social-media-buttons	4.3 (v2.0)	Medium
CVE-2012-4547	AWStats 6.95/7.0 - 'awredir.pl' Cross-Site Scripting	awstats	4.3 (v2.0)	Medium
CVE-2012-4768	WordPress Plugin Download Monitor < 3.3.5.9 - Cross-Site Scripting	download monitor	4.3 (v2.0)	Medium
CVE-2012-4889	ManageEngine Firewall Analyzer 7.2 - Cross-Site Scripting	firewall analyzer	4.3 (v2.0)	Medium
CVE-2012-5684	ZPanel 10.0.1 - Cross-Site Request Forgery / Cross-Site Scripting / SQL Injection / Password Reset	zpanel	4.3 (v2.0)	Medium
CVE-2012-5913	WordPress Integrator 1.32 - Cross-Site Scripting	wordpress integrator	4.3 (v2.0)	Medium
CVE-2013-2287	WordPress Plugin Uploader 1.0.4 - Cross-Site Scripting	uploader	4.3 (v2.0)	Medium
CVE-2013-3526	WordPress Plugin Traffic Analyzer - 'aoid' Cross-Site Scripting	trafficanalyzer	4.3 (v2.0)	Medium
CVE-2013-4117	WordPress Plugin Category Grid View Gallery 2.3.1 - Cross-Site Scripting	category-grid-view-gallery	4.3 (v2.0)	Medium
CVE-2013-4625	WordPress Plugin Duplicator < 0.4.5 - Cross-Site Scripting	duplicator	4.3 (v2.0)	Medium
CVE-2014-2908	Siemens SIMATIC S7-1200 CPU - Cross-Site Scripting	simatic s7 cpu 1200 firmware	4.3 (v2.0)	Medium
CVE-2014-4513	ActiveHelper LiveHelp Server 3.1.0 - Cross-Site Scripting	activehelper livehelp live chat	4.3 (v2.0)	Medium
CVE-2014-9094	WordPress DZS-VideoGallery Plugin Cross-Site Scripting	video gallery	4.3 (v2.0)	Medium
CVE-2014-9444	Frontend Uploader <= 0.9.2 - Cross-Site Scripting	frontend uploader	4.3 (v2.0)	Medium
CVE-2015-1389	Aruba ClearPass Policy Manager - Persistent Cross-Site Scripting	clearpass policy manager	4.3 (v2.0)	Medium
CVE-2015-1880	Fortinet FortiOS <=5.2.3 - Cross-Site Scripting	fortios	4.3 (v2.0)	Medium
CVE-2015-2068	Magento Server Mass Importer - Cross-Site Scripting	magmi	4.3 (v2.0)	Medium
CVE-2015-2275	WoltLab Community Gallery - Persistent Cross-Site Scripting	community gallery	4.3 (v2.0)	Medium
CVE-2015-2807	Navis DocumentCloud <0.1.1 - Cross-Site Scripting	navis documentcloud	4.3 (v2.0)	Medium
CVE-2015-4127	WordPress Church Admin <0.810 - Cross-Site Scripting	church admin	4.3 (v2.0)	Medium
CVE-2015-4420	Opsview 4.6.2 - Multiple Cross-Site Scripting Vulnerabilities	opsview	4.3 (v2.0)	Medium
CVE-2015-4665	Xceedium Xsuite - Multiple Vulnerabilities	xsuite	4.3 (v2.0)	Medium
CVE-2015-6402	Cisco EPC 3928 - Multiple Vulnerabilities	epc3928 docsis 3.0 8x4 wireless residential gateway with embedded digital voice adapter	4.3 (v2.0)	Medium
CVE-2015-6920	WordPress sourceAFRICA <=0.1.3 - Cross-Site Scripting	sourceafrica	4.3 (v2.0)	Medium
CVE-2018-6225	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	4.3 (v3.0)	Medium
CVE-2024-34061	Changedetection.io <=v0.45.21 - Cross-Site Scripting	changedetection.io	4.3 (v3.1)	Medium
CVE-2024-4348	osCommerce v4.0 - Cross-site Scripting	oscommerce	4.3 (v3.1)	Medium
CVE-2025-41228	VMware vSphere Client 8.0.3.0 - Reflected Cross-Site Scripting (XSS)	vCenter Server	4.3 (v3.1)	Medium
CVE-2026-12724	Kirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-password	Kirki	4.3 (v3.1)	Medium
CVE-2026-32250	NamelessMC has Reflected Cross-Site Scripting (XSS) in id parameter of /index.php?route=/queries/user/	Nameless	4.3 (v3.1)	Medium
CVE-2026-55566	Yamcs: DOM XSS in Extension Routing	yamcs	4.3 (v3.1)	Medium
CVE-2026-17011	Nexter Blocks < 5.0.2 - Contributor+ Stored CSS Injection	Nexter Blocks	3.8 (v3.1)	Low
CVE-2026-10827	Spectra (Ultimate Addons for Gutenberg) < 2.20.0 - Contributor+ Stored CSS Injection via Block Attributes	Spectra Legacy	3.5 (v3.1)	Low
CVE-2026-13393	ElementsKit Lite < 3.10.01 - Subsite Administrator+ Stored XSS via Megamenu Menu-Item Settings (Multisite)	ElementsKit Elementor Addons	3.5 (v3.1)	Low
CVE-2025-0133	PAN-OS - Reflected Cross-Site Scripting	PAN-OS	2.7 (v4.0)	Low
CVE-2026-66300	SNOMED International Snowstorm reflected XSS	Snowstorm	2.3 (v4.0)	Low
CVE-2026-10153	westboy CicadasCMS AbstractCacheManager.java search cross site scripting	CicadasCMS	2.1 (v4.0)	Low
CVE-2026-10173	Orthanc Explorer 2 URL StudyList.vue cross site scripting	Explorer 2	2.1 (v4.0)	Low
CVE-2026-10289	code-projects Hotel and Tourism Reservation System tour.php cross site scripting	Hotel and Tourism Reservation System	2.1 (v4.0)	Low
CVE-2026-11436	Mage AI Sign-in Flow index.tsx useMutation cross site scripting	Mage AI	2.1 (v4.0)	Low
CVE-2026-11512	itsourcecode Hospital Management System billing.php cross site scripting	Hospital Management System	2.1 (v4.0)	Low
CVE-2026-11518	SourceCodester Inventory System User Management users.php cross site scripting	Inventory System	2.1 (v4.0)	Low
CVE-2026-16220	code-projects Online Examination System account.php cross site scripting	Online Examination System	2.1 (v4.0)	Low
CVE-2026-16485	SourceCodester Class and Exam Timetabling System class.php cross site scripting	Class and Exam Timetabling System	2.1 (v4.0)	Low
CVE-2026-16486	SourceCodester Class and Exam Timetabling System BSIS.php cross site scripting	Class and Exam Timetabling System	2.1 (v4.0)	Low
CVE-2026-18968	ttttonyhe OBlog tags.php cross site scripting	OBlog	2.1 (v4.0)	Low
CVE-2026-19378	code-projects Task Management System CommentSave.php cross site scripting	Task Management System	2.1 (v4.0)	Low
CVE-2026-19998	code-projects Online Shopping System offersmail.php cross site scripting	Online Shopping System	2.1 (v4.0)	Low
CVE-2026-5825	code-projects Simple Laundry System delmemberinfo.php cross site scripting	Simple Laundry System	2.1 (v4.0)	Low
CVE-2026-5826	code-projects Simple IT Discussion Forum edit-category.php cross site scripting	Simple IT Discussion Forum	2.1 (v4.0)	Low
CVE-2026-59727	Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands	astro	2.1 (v4.0)	Low
CVE-2026-66882	Reflected XSS in AshAuthentication confirmation and magic link interaction forms	ash authentication	2.1 (v4.0)	Low
CVE-2026-75077	SourceCodester Class and Exam Timetabling System BSCE2.php cross site scripting	Class and Exam Timetabling System	2.1 (v4.0)	Low
CVE-2026-75078	SourceCodester Class and Exam Timetabling System BSHRM1.php cross site scripting	Class and Exam Timetabling System	2.1 (v4.0)	Low
CVE-2026-78054	SourceCodester Class and Exam Timetabling System BSIS1.php cross site scripting	Class and Exam Timetabling System	2.1 (v4.0)	Low
CVE-2026-78055	SourceCodester Class and Exam Timetabling System BSIT2.php cross site scripting	Class and Exam Timetabling System	2.1 (v4.0)	Low
CVE-2026-78059	SourceCodester Stock Management System printOrder.php cross site scripting	Stock Management System	2.1 (v4.0)	Low
CVE-2026-78060	SourceCodester Stock Management System getOrderReport.php cross site scripting	Stock Management System	2.1 (v4.0)	Low
CVE-2026-79793	code-projects Online Shopping System sumit_form.php cross site scripting	Online Shopping System	2.1 (v4.0)	Low
CVE-2026-82625	code-projects Simple Inventory System User Registration register.php cross site scripting	Simple Inventory System	2.1 (v4.0)	Low
CVE-2026-82664	yaojingang GEOFlow JSON-LD Theme HomeController.php cross site scripting	GEOFlow	2.1 (v4.0)	Low
CVE-2026-82700	code-projects Online Shopping System Newsletter Subscription offersmail.php cross site scripting	Online Shopping System	2.1 (v4.0)	Low
CVE-2026-85021	langgenius dify Splash Layout splash.tsx router.replace cross site scripting	dify	2.1 (v4.0)	Low
CVE-2026-85382	light0011 cms Chapter Content Output oneChapter.tpl htmlspecialchars_decode cross site scripting	cms	2.1 (v4.0)	Low
CVE-2026-86216	code-projects Hotel and Tourism Reservation in PHP details.php cross site scripting	Hotel and Tourism Reservation in PHP	2.1 (v4.0)	Low
CVE-2026-86244	FastAdmin User Controller User.php login cross site scripting	FastAdmin	2.1 (v4.0)	Low
CVE-2026-86668	aircheng-org iWebShop-5 pic.php uploadFile cross site scripting	iWebShop-5	2.1 (v4.0)	Low
CVE-2026-9415	code-projects Employee Management System eloginwel.php cross site scripting	Employee Management System	2.1 (v4.0)	Low
CVE-2026-9416	code-projects Employee Management System myprofile.php cross site scripting	Employee Management System	2.1 (v4.0)	Low
CVE-2026-9417	code-projects Employee Management System myprofileup.php cross site scripting	Employee Management System	2.1 (v4.0)	Low
CVE-2026-9418	code-projects Employee Management System changepassemp.php cross site scripting	Employee Management System	2.1 (v4.0)	Low
CVE-2026-9419	code-projects Employee Management System empproject.php cross site scripting	Employee Management System	2.1 (v4.0)	Low
CVE-2026-9448	code-projects Employee Management System applyleave.php cross site scripting	Employee Management System	2.1 (v4.0)	Low
CVE-2026-9518	hemant6488 CodeIgniter-StudentManagementSystem Students Controller view_students.php addStudent cross site scripting	CodeIgniter-StudentManagementSystem	2.1 (v4.0)	Low
CVE-2026-9519	stonith404 pingvin-share Sign-in Auto-Redirect signIn.tsx getServerSideProps cross site scripting	pingvin-share	2.1 (v4.0)	Low
CVE-2026-9520	blitz-js blitz Sign-in LoginForm.tsx cross site scripting	blitz	2.1 (v4.0)	Low
CVE-2026-9527	itsourcecode Electronic Judging System judges.php cross site scripting	Electronic Judging System	2.1 (v4.0)	Low
CVE-2026-9566	teableio teable Sign-up LoginPage.tsx cross site scripting	teable	2.1 (v4.0)	Low
CVE-2026-10228	raisulislamg4 student_management_system_by_php admission_form_check.php cross site scripting	student management system by php	2.0 (v4.0)	Low
CVE-2026-10234	Mettle sendportal Campaign webview cross site scripting	sendportal	2.0 (v4.0)	Low
CVE-2026-10244	SourceCodester Pharmacy Sales and Inventory System main create_medicine_name cross site scripting	Pharmacy Sales and Inventory System	2.0 (v4.0)	Low
CVE-2026-10245	SourceCodester Pharmacy Sales and Inventory System main create_supplier cross site scripting	Pharmacy Sales and Inventory System	2.0 (v4.0)	Low
CVE-2026-10246	SourceCodester Pharmacy Sales and Inventory System main create_medicine_presentation cross site scripting	Pharmacy Sales and Inventory System	2.0 (v4.0)	Low
CVE-2026-10247	SourceCodester Pharmacy Sales and Inventory System main create_generic_name cross site scripting	Pharmacy Sales and Inventory System	2.0 (v4.0)	Low
CVE-2026-16155	SourceCodester Class and Exam Timetabling System schoolyr.php cross site scripting	Class and Exam Timetabling System	2.0 (v4.0)	Low
CVE-2026-16156	SourceCodester Class and Exam Timetabling System forexam.php cross site scripting	Class and Exam Timetabling System	2.0 (v4.0)	Low
CVE-2026-16202	SourceCodester Class and Exam Timetabling System CYS.php cross site scripting	Class and Exam Timetabling System	2.0 (v4.0)	Low
CVE-2026-16203	SourceCodester Class and Exam Timetabling System forCYS.php cross site scripting	Class and Exam Timetabling System	2.0 (v4.0)	Low
CVE-2026-19209	SourceCodester Photo Share Website index.php home cross site scripting	Photo Share Website	2.0 (v4.0)	Low
CVE-2026-19922	code-projects Online Shopping System checkout.php cross site scripting	Online Shopping System	2.0 (v4.0)	Low
CVE-2026-5810	SourceCodester Sales and Inventory System GET Parameter delete.php cross site scripting	Sales and Inventory System	2.0 (v4.0)	Low
CVE-2026-7222	code-projects Coaching Management System Complaint Form complaint.php cross site scripting	Coaching Management System	2.0 (v4.0)	Low
CVE-2026-8139	Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName	concrete cms	2.0 (v4.0)	Low
CVE-2026-82483	coppermine-gallery Coppermine Photo Gallery Hidden Album Update Endpoint db_input.php cross site scripting	Coppermine Photo Gallery	2.0 (v4.0)	Low
CVE-2026-82488	Beetel 450TC3 User Management cross site scripting	450TC3	2.0 (v4.0)	Low
CVE-2026-82622	code-projects Employee Leave Managing System Employee Profile Update editaction.php cross site scripting	Employee Leave Managing System	2.0 (v4.0)	Low
CVE-2026-82665	yaojingang GEOFlow Image Library Cleanup ImageLibraryController.php unlink path traversal	GEOFlow	2.0 (v4.0)	Low
CVE-2026-82666	yaojingang GEOFlow Superadmin Theme Editor SiteThemeEditorController.php preview code injection	GEOFlow	2.0 (v4.0)	Low
CVE-2026-82667	yaojingang GEOFlow GenericHttpEndpointResolver.php DistributionController.isValidHttpEndpoint server-side request forger	GEOFlow	2.0 (v4.0)	Low
CVE-2026-84437	OpenCart Autocomplete Workflow address.php cross site scripting	OpenCart	2.0 (v4.0)	Low
CVE-2026-84438	OpenCart Autocomplete Workflow edit.php cross site scripting	OpenCart	2.0 (v4.0)	Low
CVE-2026-85022	langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting	dify	2.0 (v4.0)	Low
CVE-2026-85207	itsourcecode Online Medicine Delivery System index.php cross site scripting	Online Medicine Delivery System	2.0 (v4.0)	Low
CVE-2026-86181	code-projects Task Management System User Profile Update UpdateUserProfile.php cross site scripting	Task Management System	2.0 (v4.0)	Low
CVE-2026-86301	code-projects Hospital Information System Patient Management editPatient.php cross site scripting	Hospital Information System	2.0 (v4.0)	Low
CVE-2026-86644	star7th showdoc API Page Save Endpoint editormd.js cross site scripting	showdoc	2.0 (v4.0)	Low
CVE-2026-10112	sambitraj STUDENT-MANAGEMENT-SYSTEM Dashboard cross site scripting	STUDENT-MANAGEMENT-SYSTEM	1.9 (v4.0)	Low
CVE-2026-10529	westboy CicadasCMS Task Scheduling Management ScheduleJobController.java cross site scripting	CicadasCMS	1.9 (v4.0)	Low
CVE-2026-11468	SourceCodester Hospitals Patient Records Management System page room_types cross site scripting	Hospitals Patient Records Management System	1.9 (v4.0)	Low
CVE-2026-16205	Pluck CMS Albums albums.admin.php htmlspecialchars_decode cross site scripting	CMS	1.9 (v4.0)	Low
CVE-2026-19110	DataGear Chart Name HtmlTplDashboardWidgetHtmlRenderer.java HtmlTplDashboardWidgetHtmlRenderer cross site scripting	DataGear	1.9 (v4.0)	Low
CVE-2026-19207	PHPGurukul Company Visitor Management System manage-newvisitors.php cross site scripting	Company Visitor Management System	1.9 (v4.0)	Low
CVE-2026-9564	SourceCodester/oretnom23 Hospitals Patient Records Management System view_patient cross site scripting	Hospitals Patient Records Management System	1.9 (v4.0)	Low
CVE-2026-78187	Piwigo Public Authentication cross site scripting	Piwigo	1.3 (v4.0)	Low
CVE-2023-46391	WEBIGniter v28.7.23 - Stored Cross Site Scripting (XSS)	-	N/A	N/A
CVE-2026-78849	Netgate pfSense Plus software versions <= 26.03 pfSense CE software versions <= 2.8.1 Arbitrary Code Execution Vulnerability	Netgate pfSense Plus software versions <= 26.03 pfSense CE software versions <= 2.8.1	N/A	N/A

Observed CWEs

These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.

CWE	Related Published CVEs
CWE-20	CVE-2015-4664 , CVE-2026-54694 , CVE-2016-1328 , CVE-2016-1336
CWE-22	CVE-2021-47795 , CVE-2018-1204 , CVE-2012-5192 , CVE-2015-4666 , CVE-2026-82665
CWE-73	CVE-2023-30943
CWE-74	CVE-2018-6220 , CVE-2026-22200 , CVE-2021-31249 , CVE-2026-5827 , CVE-2026-82666
CWE-78	CVE-2018-6222
CWE-79	CVE-2020-20982 , CVE-2021-32853 , CVE-2026-54694 , CVE-2026-55085 , CVE-2026-73043 , CVE-2026-73044 , CVE-2026-73050 , CVE-2026-73052 , CVE-2026-73053 , CVE-2026-42849 , CVE-2026-57858 , CVE-2026-66394 , CVE-2026-66396 , CVE-2026-66418 , CVE-2026-74902 , CVE-2026-78997 , CVE-2026-84189 , CVE-2019-7671 , CVE-2023-34192 , CVE-2026-34448 , CVE-2026-42556 , CVE-2026-43984 , CVE-2026-12968 , CVE-2026-12496 , CVE-2026-15217 , CVE-2026-44667 , CVE-2026-44669 , CVE-2026-44729 , CVE-2026-45115 , CVE-2026-45116 , CVE-2026-45270 , CVE-2026-46518 , CVE-2026-47665 , CVE-2026-47743 , CVE-2026-48026 , CVE-2026-53758 , CVE-2026-54347 , CVE-2026-70492 , CVE-2025-66024 , CVE-2026-34463 , CVE-2026-49864 , CVE-2026-21618 , CVE-2026-34932 , CVE-2026-58113 , CVE-2026-63361 , CVE-2026-64851 , CVE-2026-15973 , CVE-2026-5385 , CVE-2026-77072 , CVE-2026-77850 , CVE-2026-85613 , CVE-2026-87814 , CVE-2024-5420 , CVE-2026-34725 , CVE-2026-56670 , CVE-2026-33437 , CVE-2026-39344 , CVE-2026-48060 , CVE-2026-50758 , CVE-2026-65937 , CVE-2025-47783 , CVE-2026-16969 , CVE-2026-18360 , CVE-2026-18361 , CVE-2026-44657 , CVE-2026-7460 , CVE-2026-87812 , CVE-2026-30819 , CVE-2026-6735 , CVE-2026-8203 , CVE-2026-16809 , CVE-2026-18430 , CVE-2026-18756 , CVE-2022-35499 , CVE-2024-12878 , CVE-2024-41357 , CVE-2026-12970 , CVE-2026-14239 , CVE-2026-34598 , CVE-2026-6858 , CVE-2026-84192 , CVE-2026-55746 , CVE-2026-58411 , CVE-2025-4388 , CVE-2025-4576 , CVE-2025-62613 , CVE-2026-39838 , CVE-2026-39936 , CVE-2026-40598 , CVE-2026-44651 , CVE-2026-59238 , CVE-2026-69092 , CVE-2026-73848 , CVE-2026-86188 , CVE-2026-13605 , CVE-2026-14817 , CVE-2026-14833 , CVE-2026-15047 , CVE-2026-16559 , CVE-2026-33741 , CVE-2026-67352 , CVE-2025-32430 , CVE-2026-24128 , CVE-2026-55549 , CVE-2026-78838 , CVE-2026-0737 , CVE-2026-0738 , CVE-2026-3885 , CVE-2026-45797 , CVE-2026-50592 , CVE-2026-87870 , CVE-2026-43980 , CVE-2012-1260 , CVE-2012-1261 , CVE-2012-5193 , CVE-2014-4535 , CVE-2014-4536 , CVE-2014-4539 , CVE-2014-4544 , CVE-2014-4558 , CVE-2014-4561 , CVE-2014-4592 , CVE-2014-9607 , CVE-2015-6477 , CVE-2015-6544 , CVE-2015-8349 , CVE-2015-8350 , CVE-2015-9414 , CVE-2016-1000126 , CVE-2016-1000127 , CVE-2016-1000128 , CVE-2016-1000129 , CVE-2016-1000130 , CVE-2016-1000131 , CVE-2016-1000132 , CVE-2016-1000133 , CVE-2016-1000134 , CVE-2016-1000135 , CVE-2016-1000136 , CVE-2016-1000137 , CVE-2016-1000138 , CVE-2016-1000141 , CVE-2016-1000142 , CVE-2016-1000143 , CVE-2016-1000146 , CVE-2016-1000148 , CVE-2016-1000153 , CVE-2016-1000154 , CVE-2016-8527 , CVE-2017-11629 , CVE-2017-12794 , CVE-2017-17059 , CVE-2017-17451 , CVE-2017-18024 , CVE-2017-18536 , CVE-2017-3132 , CVE-2017-3133 , CVE-2017-6443 , CVE-2017-7855 , CVE-2017-9288 , CVE-2018-10095 , CVE-2018-10230 , CVE-2018-11709 , CVE-2018-12998 , CVE-2018-14013 , CVE-2018-16139 , CVE-2018-17441 , CVE-2018-17443 , CVE-2018-19136 , CVE-2018-19137 , CVE-2018-19287 , CVE-2018-19439 , CVE-2018-19933 , CVE-2018-20462 , CVE-2018-20503 , CVE-2018-5715 , CVE-2018-6882 , CVE-2018-7196 , CVE-2018-7203 , CVE-2018-7543 , CVE-2018-7653 , CVE-2018-8006 , CVE-2018-9238 , CVE-2019-0221 , CVE-2019-12461 , CVE-2019-12935 , CVE-2019-14696 , CVE-2019-15501 , CVE-2019-15713 , CVE-2019-15889 , CVE-2019-16332 , CVE-2019-16525 , CVE-2019-16931 , CVE-2019-17504 , CVE-2019-19134 , CVE-2019-19908 , CVE-2019-20210 , CVE-2019-3402 , CVE-2019-3911 , CVE-2019-6112 , CVE-2019-8390 , CVE-2019-8937 , CVE-2019-9553 , CVE-2020-1106 , CVE-2020-12054 , CVE-2020-13258 , CVE-2020-14413 , CVE-2020-15599 , CVE-2020-17362 , CVE-2020-19283 , CVE-2020-23517 , CVE-2020-23814 , CVE-2020-24609 , CVE-2020-24701 , CVE-2020-27982 , CVE-2020-35416 , CVE-2020-6171 , CVE-2020-7107 , CVE-2020-8191 , CVE-2020-9344 , CVE-2021-21799 , CVE-2021-21800 , CVE-2021-24213 , CVE-2021-24214 , CVE-2021-24298 , CVE-2021-24316 , CVE-2021-24320 , CVE-2021-24335 , CVE-2021-24342 , CVE-2021-24387 , CVE-2021-24389 , CVE-2021-24495 , CVE-2021-24522 , CVE-2021-25104 , CVE-2021-26247 , CVE-2021-26475 , CVE-2021-26702 , CVE-2021-26710 , CVE-2021-26947 , CVE-2021-27309 , CVE-2021-27310 , CVE-2021-27695 , CVE-2021-29625 , CVE-2021-30049 , CVE-2021-30203 , CVE-2021-30213 , CVE-2021-31537 , CVE-2021-31682 , CVE-2021-31862 , CVE-2021-34630 , CVE-2021-35488 , CVE-2021-36646 , CVE-2021-37416 , CVE-2021-37833 , CVE-2021-3831 , CVE-2021-38702 , CVE-2021-38704 , CVE-2021-39411 , CVE-2021-40868 , CVE-2021-41467 , CVE-2021-41951 , CVE-2021-42565 , CVE-2021-43725 , CVE-2021-45422 , CVE-2021-45425 , CVE-2021-46387 , CVE-2022-0678 , CVE-2022-1168 , CVE-2022-1170 , CVE-2022-1221 , CVE-2022-2130 , CVE-2022-2168 , CVE-2022-2174 , CVE-2022-22242 , CVE-2022-24384 , CVE-2022-26564 , CVE-2022-2733 , CVE-2022-27926 , CVE-2022-28508 , CVE-2022-29004 , CVE-2022-29005 , CVE-2022-30489 , CVE-2022-30776 , CVE-2022-30777 , CVE-2022-30983 , CVE-2022-31470 , CVE-2022-3242 , CVE-2022-32770 , CVE-2022-32771 , CVE-2022-34093 , CVE-2022-34094 , CVE-2022-34305 , CVE-2022-34328 , CVE-2022-3484 , CVE-2022-35155 , CVE-2022-35493 , CVE-2022-37153 , CVE-2022-38295 , CVE-2022-39195 , CVE-2022-41441 , CVE-2022-43016 , CVE-2022-43018 , CVE-2022-48012 , CVE-2022-48197 , CVE-2023-0527 , CVE-2023-0676 , CVE-2023-1880 , CVE-2023-23161 , CVE-2023-24278 , CVE-2023-24657 , CVE-2023-25346 , CVE-2023-27641 , CVE-2023-2822 , CVE-2023-2949 , CVE-2023-29623 , CVE-2023-30210 , CVE-2023-30212 , CVE-2023-34599 , CVE-2023-3479 , CVE-2023-3521 , CVE-2023-36306 , CVE-2023-36346 , CVE-2023-37580 , CVE-2023-38192 , CVE-2023-38194 , CVE-2023-38501 , CVE-2023-38875 , CVE-2023-39598 , CVE-2023-39600 , CVE-2023-39700 , CVE-2023-40750 , CVE-2023-40751 , CVE-2023-40752 , CVE-2023-4110 , CVE-2023-4111 , CVE-2023-4113 , CVE-2023-4114 , CVE-2023-4115 , CVE-2023-4116 , CVE-2023-4136 , CVE-2023-4148 , CVE-2023-41538 , CVE-2023-41597 , CVE-2023-44812 , CVE-2023-4547 , CVE-2023-46732 , CVE-2023-48728 , CVE-2023-49293 , CVE-2023-5558 , CVE-2023-5758 , CVE-2023-6275 , CVE-2023-6379 , CVE-2024-12724 , CVE-2024-13114 , CVE-2024-13331 , CVE-2024-13619 , CVE-2024-13727 , CVE-2024-13853 , CVE-2024-24494 , CVE-2024-28734 , CVE-2024-3231 , CVE-2024-37259 , CVE-2024-41810 , CVE-2025-25296 , CVE-2025-2609 , CVE-2025-4652 , CVE-2025-46550 , CVE-2025-51501 , CVE-2025-5301 , CVE-2025-54589 , CVE-2025-63607 , CVE-2026-0561 , CVE-2026-11588 , CVE-2026-11881 , CVE-2026-13330 , CVE-2026-13400 , CVE-2026-14921 , CVE-2026-26028 , CVE-2026-3001 , CVE-2026-30251 , CVE-2026-34206 , CVE-2026-34229 , CVE-2026-34396 , CVE-2026-34739 , CVE-2026-36324 , CVE-2026-37750 , CVE-2026-38432 , CVE-2026-38446 , CVE-2026-38472 , CVE-2026-41580 , CVE-2026-51565 , CVE-2026-52232 , CVE-2026-52475 , CVE-2026-55087 , CVE-2026-61526 , CVE-2026-73084 , CVE-2026-75170 , CVE-2026-78742 , CVE-2026-8447 , CVE-2023-6717 , CVE-2026-84193 , CVE-2016-10993 , CVE-2016-9316 , CVE-2017-3131 , CVE-2017-6340 , CVE-2018-12095 , CVE-2018-15917 , CVE-2018-16736 , CVE-2018-6226 , CVE-2018-6227 , CVE-2019-9556 , CVE-2020-11456 , CVE-2020-12256 , CVE-2020-12259 , CVE-2020-12706 , CVE-2020-20988 , CVE-2020-27533 , CVE-2020-35774 , CVE-2020-9467 , CVE-2021-31250 , CVE-2021-40577 , CVE-2021-46005 , CVE-2022-0928 , CVE-2022-0954 , CVE-2022-25489 , CVE-2022-48178 , CVE-2023-34537 , CVE-2023-5452 , CVE-2024-33724 , CVE-2024-48120 , CVE-2024-52762 , CVE-2025-2610 , CVE-2026-11569 , CVE-2026-15245 , CVE-2026-16063 , CVE-2026-16537 , CVE-2026-16558 , CVE-2026-18395 , CVE-2026-34848 , CVE-2026-34974 , CVE-2026-35403 , CVE-2026-38473 , CVE-2026-39380 , CVE-2026-39964 , CVE-2026-45138 , CVE-2026-45580 , CVE-2026-45694 , CVE-2026-72570 , CVE-2026-72583 , CVE-2026-82396 , CVE-2019-25731 , CVE-2024-11587 , CVE-2024-9007 , CVE-2025-2127 , CVE-2025-2710 , CVE-2025-2711 , CVE-2025-2712 , CVE-2026-35208 , CVE-2026-41472 , CVE-2026-48094 , CVE-2026-5808 , CVE-2026-59232 , CVE-2026-69116 , CVE-2026-73038 , CVE-2026-73422 , CVE-2026-73628 , CVE-2026-76837 , CVE-2026-82646 , CVE-2026-84191 , CVE-2026-85158 , CVE-2026-85159 , CVE-2026-85577 , CVE-2018-25248 , CVE-2018-25349 , CVE-2021-47931 , CVE-2021-47947 , CVE-2022-50943 , CVE-2022-50961 , CVE-2022-50962 , CVE-2022-50963 , CVE-2022-50964 , CVE-2022-50965 , CVE-2022-50966 , CVE-2022-50968 , CVE-2022-50969 , CVE-2025-34032 , CVE-2025-41393 , CVE-2025-71404 , CVE-2026-19434 , CVE-2026-19716 , CVE-2026-22675 , CVE-2026-25557 , CVE-2026-27176 , CVE-2026-32856 , CVE-2026-34416 , CVE-2026-34417 , CVE-2026-34798 , CVE-2026-34799 , CVE-2026-34800 , CVE-2026-34801 , CVE-2026-34802 , CVE-2026-34803 , CVE-2026-34804 , CVE-2026-34805 , CVE-2026-34806 , CVE-2026-34807 , CVE-2026-34808 , CVE-2026-34809 , CVE-2026-34810 , CVE-2026-34811 , CVE-2026-34812 , CVE-2026-34813 , CVE-2026-34814 , CVE-2026-34815 , CVE-2026-34816 , CVE-2026-34817 , CVE-2026-34818 , CVE-2026-34819 , CVE-2026-34820 , CVE-2026-34821 , CVE-2026-34822 , CVE-2026-34823 , CVE-2026-35007 , CVE-2026-35008 , CVE-2026-35009 , CVE-2026-35010 , CVE-2026-35011 , CVE-2026-35012 , CVE-2026-35014 , CVE-2026-35015 , CVE-2026-35016 , CVE-2026-40508 , CVE-2026-42840 , CVE-2026-45551 , CVE-2026-47106 , CVE-2026-48214 , CVE-2026-48215 , CVE-2026-48218 , CVE-2026-48219 , CVE-2026-48220 , CVE-2026-48221 , CVE-2026-48222 , CVE-2026-48223 , CVE-2026-48224 , CVE-2026-48225 , CVE-2026-48226 , CVE-2026-48227 , CVE-2026-48228 , CVE-2026-48229 , CVE-2026-48530 , CVE-2026-48531 , CVE-2026-48532 , CVE-2026-48534 , CVE-2026-48535 , CVE-2026-48536 , CVE-2026-48537 , CVE-2026-48538 , CVE-2026-48539 , CVE-2026-48552 , CVE-2026-48559 , CVE-2026-50230 , CVE-2026-53992 , CVE-2026-56126 , CVE-2026-57857 , CVE-2026-64628 , CVE-2026-65697 , CVE-2026-66296 , CVE-2026-67333 , CVE-2026-68583 , CVE-2026-71503 , CVE-2026-72743 , CVE-2026-72747 , CVE-2026-72821 , CVE-2026-73319 , CVE-2026-75831 , CVE-2026-84477 , CVE-2026-85593 , CVE-2026-85600 , CVE-2026-86197 , CVE-2017-14651 , CVE-2018-1000856 , CVE-2018-1186 , CVE-2018-1187 , CVE-2018-1188 , CVE-2018-1189 , CVE-2018-1201 , CVE-2018-1202 , CVE-2018-19749 , CVE-2018-19751 , CVE-2018-19752 , CVE-2018-19892 , CVE-2018-19914 , CVE-2018-19915 , CVE-2018-20009 , CVE-2018-20010 , CVE-2018-20011 , CVE-2018-20418 , CVE-2019-19742 , CVE-2020-29477 , CVE-2021-46068 , CVE-2021-46069 , CVE-2021-46071 , CVE-2021-46072 , CVE-2021-46073 , CVE-2023-0563 , CVE-2024-3822 , CVE-2024-50857 , CVE-2025-15669 , CVE-2026-26211 , CVE-2026-39390 , CVE-2026-39392 , CVE-2026-67612 , CVE-2026-67617 , CVE-2026-70560 , CVE-2026-79663 , CVE-2026-84188 , CVE-2024-24050 , CVE-2026-3093 , CVE-2026-16273 , CVE-2026-53468 , CVE-2008-6982 , CVE-2009-1872 , CVE-2011-4624 , CVE-2011-5106 , CVE-2011-5107 , CVE-2011-5265 , CVE-2012-0782 , CVE-2012-1835 , CVE-2012-2371 , CVE-2012-4242 , CVE-2012-4273 , CVE-2012-4547 , CVE-2012-4768 , CVE-2012-4889 , CVE-2012-5684 , CVE-2012-5913 , CVE-2013-2287 , CVE-2013-3526 , CVE-2013-4117 , CVE-2013-4625 , CVE-2014-2908 , CVE-2014-4513 , CVE-2014-9094 , CVE-2014-9444 , CVE-2015-1389 , CVE-2015-1880 , CVE-2015-2068 , CVE-2015-2275 , CVE-2015-2807 , CVE-2015-4127 , CVE-2015-4420 , CVE-2015-4665 , CVE-2015-6402 , CVE-2015-6920 , CVE-2024-34061 , CVE-2024-4348 , CVE-2025-41228 , CVE-2026-32250 , CVE-2026-55566 , CVE-2026-13393 , CVE-2025-0133 , CVE-2026-66300 , CVE-2026-10153 , CVE-2026-10173 , CVE-2026-10289 , CVE-2026-11436 , CVE-2026-11512 , CVE-2026-11518 , CVE-2026-16220 , CVE-2026-16485 , CVE-2026-16486 , CVE-2026-18968 , CVE-2026-19378 , CVE-2026-19998 , CVE-2026-5825 , CVE-2026-5826 , CVE-2026-59727 , CVE-2026-66882 , CVE-2026-75077 , CVE-2026-75078 , CVE-2026-78054 , CVE-2026-78055 , CVE-2026-78059 , CVE-2026-78060 , CVE-2026-79793 , CVE-2026-82625 , CVE-2026-82664 , CVE-2026-82700 , CVE-2026-85021 , CVE-2026-85382 , CVE-2026-86216 , CVE-2026-86244 , CVE-2026-86668 , CVE-2026-9415 , CVE-2026-9416 , CVE-2026-9417 , CVE-2026-9418 , CVE-2026-9419 , CVE-2026-9448 , CVE-2026-9518 , CVE-2026-9519 , CVE-2026-9520 , CVE-2026-9527 , CVE-2026-9566 , CVE-2026-10228 , CVE-2026-10234 , CVE-2026-10244 , CVE-2026-10245 , CVE-2026-10246 , CVE-2026-10247 , CVE-2026-16155 , CVE-2026-16156 , CVE-2026-16202 , CVE-2026-16203 , CVE-2026-19209 , CVE-2026-19922 , CVE-2026-5810 , CVE-2026-7222 , CVE-2026-8139 , CVE-2026-82483 , CVE-2026-82488 , CVE-2026-82622 , CVE-2026-84437 , CVE-2026-84438 , CVE-2026-85022 , CVE-2026-85207 , CVE-2026-86181 , CVE-2026-86301 , CVE-2026-86644 , CVE-2026-10112 , CVE-2026-10529 , CVE-2026-11468 , CVE-2026-16205 , CVE-2026-19110 , CVE-2026-19207 , CVE-2026-9564 , CVE-2026-78187
CWE-80	CVE-2024-58355 , CVE-2026-39344 , CVE-2026-24128 , CVE-2026-40105 , CVE-2024-41810 , CVE-2025-54589 , CVE-2026-50229 , CVE-2026-52773 , CVE-2026-34246
CWE-83	CVE-2026-45118 , CVE-2026-8245 , CVE-2026-59727
CWE-87	CVE-2026-34598
CWE-89	CVE-2012-1259 , CVE-2018-6228 , CVE-2018-6229 , CVE-2022-29316 , CVE-2015-4669 , CVE-2012-5685 , CVE-2018-6230 , CVE-2026-5827
CWE-94	CVE-2026-34448 , CVE-2026-34725 , CVE-2026-65937 , CVE-2022-3242 , CVE-2026-73084 , CVE-2024-11587 , CVE-2025-2127 , CVE-2025-2710 , CVE-2025-2711 , CVE-2025-2712 , CVE-2026-5808 , CVE-2026-10153 , CVE-2026-10173 , CVE-2026-10289 , CVE-2026-11436 , CVE-2026-11512 , CVE-2026-11518 , CVE-2026-16220 , CVE-2026-16485 , CVE-2026-16486 , CVE-2026-18968 , CVE-2026-19378 , CVE-2026-19998 , CVE-2026-5825 , CVE-2026-5826 , CVE-2026-75077 , CVE-2026-75078 , CVE-2026-78054 , CVE-2026-78055 , CVE-2026-78059 , CVE-2026-78060 , CVE-2026-79793 , CVE-2026-82625 , CVE-2026-82664 , CVE-2026-82700 , CVE-2026-85021 , CVE-2026-85382 , CVE-2026-86216 , CVE-2026-86244 , CVE-2026-86668 , CVE-2026-9415 , CVE-2026-9416 , CVE-2026-9417 , CVE-2026-9418 , CVE-2026-9419 , CVE-2026-9448 , CVE-2026-9518 , CVE-2026-9519 , CVE-2026-9520 , CVE-2026-9527 , CVE-2026-9566 , CVE-2026-10228 , CVE-2026-10234 , CVE-2026-10244 , CVE-2026-10245 , CVE-2026-10246 , CVE-2026-10247 , CVE-2026-16155 , CVE-2026-16156 , CVE-2026-16202 , CVE-2026-16203 , CVE-2026-19209 , CVE-2026-19922 , CVE-2026-5810 , CVE-2026-7222 , CVE-2026-82483 , CVE-2026-82488 , CVE-2026-82622 , CVE-2026-82666 , CVE-2026-84437 , CVE-2026-84438 , CVE-2026-85022 , CVE-2026-85207 , CVE-2026-86181 , CVE-2026-86301 , CVE-2026-86644 , CVE-2026-10112 , CVE-2026-10529 , CVE-2026-11468 , CVE-2026-16205 , CVE-2026-19110 , CVE-2026-19207 , CVE-2026-9564 , CVE-2026-78187
CWE-116	CVE-2026-54694 , CVE-2026-12496 , CVE-2021-34630 , CVE-2026-26028 , CVE-2026-35208 , CVE-2026-34246 , CVE-2026-59727
CWE-183	CVE-2026-54694
CWE-200	CVE-2026-47743 , CVE-2016-1337 , CVE-2016-9314 , CVE-2018-8024 , CVE-2011-4898
CWE-264	CVE-2016-9269 , CVE-2016-9315 , CVE-2016-1337
CWE-269	CVE-2017-6339
CWE-287	CVE-2015-6401 , CVE-2012-1258
CWE-295	CVE-2018-6221 , CVE-2018-6219
CWE-306	CVE-2018-6223 , CVE-2026-41473
CWE-345	CVE-2026-12724 , CVE-2026-17011 , CVE-2026-10827
CWE-352	CVE-2018-11442 , CVE-2018-11445 , CVE-2018-1213 , CVE-2018-6224 , CVE-2020-7991 , CVE-2025-56798 , CVE-2026-14239 , CVE-2012-5683 , CVE-2025-47204
CWE-384	CVE-2022-31798
CWE-425	CVE-2019-17503
CWE-434	CVE-2018-17440 , CVE-2026-67688 , CVE-2018-17442 , CVE-2026-68899 , CVE-2026-45797 , CVE-2026-79670 , CVE-2026-75331
CWE-444	CVE-2026-55087
CWE-521	CVE-2017-6339
CWE-601	CVE-2015-4668 , CVE-2026-55087
CWE-610	CVE-2023-30943
CWE-611	CVE-2018-6225
CWE-639	CVE-2026-47743 , CVE-2026-45551
CWE-640	CVE-2012-5686
CWE-693	CVE-2026-54694
CWE-732	CVE-2018-1203 , CVE-2017-6338
CWE-798	CVE-2012-5686 , CVE-2015-4667
CWE-862	CVE-2026-46518
CWE-918	CVE-2020-24881 , CVE-2026-82667

Documentation Source

Original wiki page: WAF 340148
Source revision: 3078
Source revision date: 2013-01-03