On this page

Atomicorp WAF Rule 341256

Rule Summary

Rule ID: 341256
Status: Active
Alert message: Atomicorp.com WAF Rules: Possible Cross Site Scripting attack (detectXSS)
Observed CWEs: CWE-20 (4), CWE-22 (6), CWE-73 (1), CWE-74 (4), CWE-78 (1), CWE-79 (742), CWE-80 (8), CWE-83 (2), CWE-87 (1), CWE-89 (8), CWE-91 (1), CWE-93 (1), CWE-94 (68), CWE-116 (5), CWE-183 (1), CWE-200 (4), CWE-264 (3), CWE-287 (3), CWE-295 (2), CWE-306 (2), CWE-345 (3), CWE-352 (7), CWE-384 (1), CWE-434 (8), CWE-444 (2), CWE-501 (1), CWE-502 (1), CWE-601 (2), CWE-610 (1), CWE-611 (4), CWE-639 (2), CWE-640 (1), CWE-665 (1), CWE-693 (1), CWE-732 (1), CWE-798 (2), CWE-862 (1), CWE-918 (2), CWE-1321 (1)
Revision: 5
Rule severity: Critical (2)
Phase: 2 (request body)
Request surfaces: Request argument names, Request arguments, JSON request data, SOAP request data
Rule action: deny
HTTP status: 403
Logging: log, auditlog

Description

This rule detects behavior identified by its current alert as “Possible Cross Site Scripting attack (detectXSS)” in the request argument names, request arguments, JSON request data, SOAP request data. It evaluates during the request body phase and denies matching traffic with HTTP status 403.

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

CVE	Vulnerability	Product	CVSS	Severity
CVE-2016-9269	Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities	interscan web security virtual appliance	9.9 (v3.0)	Critical
CVE-2012-1259	Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities	scrutinizer netflow & sflow analyzer	9.8 (v3.1)	Critical
CVE-2012-5686	ZPanel 10.0.1 - Cross-Site Request Forgery / Cross-Site Scripting / SQL Injection / Password Reset	zpanel	9.8 (v3.1)	Critical
CVE-2015-4664	Xceedium Xsuite - Multiple Vulnerabilities	privileged access manager	9.8 (v3.0)	Critical
CVE-2015-4667	Xceedium Xsuite - Multiple Vulnerabilities	xsuite	9.8 (v3.0)	Critical
CVE-2018-17440	D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities	central wifimanager	9.8 (v3.0)	Critical
CVE-2018-6220	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	9.8 (v3.0)	Critical
CVE-2018-6223	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	9.8 (v3.0)	Critical
CVE-2018-6228	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	9.8 (v3.0)	Critical
CVE-2018-6229	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	9.8 (v3.0)	Critical
CVE-2019-10068	Kentico CMS Insecure Deserialization Remote Code Execution	kentico	9.8 (v3.1)	Critical
CVE-2022-29316	Complete Online Job Search System 1.0 - Cross-Site Scripting	complete online job search system	9.8 (v3.1)	Critical
CVE-2023-1719	Bitrix Component - Cross-Site Scripting	bitrix24	9.8 (v3.1)	Critical
CVE-2025-44136	MapTiler Tileserver-php v2.0 - Unauthenticated XSS	tileserver php	9.8 (v3.1)	Critical
CVE-2026-67688	ICS-Park Smart Park Management System v2.0 Arbitrary Code Execution Vulnerability	ICS-Park Smart Park Management System v2.0	9.8 (v3.1)	Critical
CVE-2020-20982	shadoweb wdja v1.5.1 - Cross-Site Scripting	wdja cms	9.6 (v3.1)	Critical
CVE-2021-32853	Erxes <0.23.0 - Cross-Site Scripting	erxes	9.6 (v3.1)	Critical
CVE-2023-1892	Sidekiq < 7.0.8 - Cross-Site Scripting	sidekiq	9.6 (v3.1)	Critical
CVE-2026-54694	NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover	skills-service	9.6 (v3.1)	Critical
CVE-2026-55085	Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite	etherpad	9.6 (v3.1)	Critical
CVE-2026-73043	SiYuan before v3.7.4 Remote Code Execution via Template Calculation	siyuan	9.4 (v4.0)	Critical
CVE-2026-73044	SiYuan before v3.7.4 Stored Cross-Site Scripting via Column Width	siyuan	9.4 (v4.0)	Critical
CVE-2026-73050	SiYuan before v3.7.4 Stored XSS via select option color	siyuan	9.4 (v4.0)	Critical
CVE-2026-73052	SiYuan before v3.7.4 Stored XSS via Attribute-View Field Names	siyuan	9.4 (v4.0)	Critical
CVE-2026-73053	SiYuan before v3.7.4 Cross-Site Scripting via unicode2Emoji	siyuan	9.4 (v4.0)	Critical
CVE-2024-58355	Cal.com through 4.7.15 Cross-Site Scripting via booking questions	cal.diy	9.3 (v4.0)	Critical
CVE-2026-42849	authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover	authentik	9.3 (v3.1)	Critical
CVE-2026-57858	Cal.com Cal.diy 6.2.0 Stored XSS via BookingPageTagManager Analytics Tracking ID	Cal.com Self-Hosted (Cal.diy)	9.3 (v4.0)	Critical
CVE-2026-66394	SiYuan before v3.7.3 Stored and Reflected XSS via SVG Sanitizer Bypass	siyuan	9.3 (v4.0)	Critical
CVE-2026-66396	SiYuan before v3.7.2 Stored XSS to RCE via title-img IAL	siyuan	9.3 (v4.0)	Critical
CVE-2026-66418	OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field	openclaw agent dashboard	9.3 (v4.0)	Critical
CVE-2026-74902	SiYuan before v3.7.4 XSS-to-RCE via malicious filename upload	siyuan	9.3 (v4.0)	Critical
CVE-2026-78997	UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314) Cross-Site Scripting Vulnerability	UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314)	9.3 (v3.1)	Critical
CVE-2026-88866	WWBN AVideo LoginControl Stored XSS via User-Agent Header	AVideo	9.3 (v4.0)	Critical
CVE-2026-88867	WWBN AVideo Stored XSS via Category Name and Icon Class	AVideo	9.3 (v4.0)	Critical
CVE-2026-88868	AVideo LiveLinks Stored XSS via title and description fields	AVideo	9.3 (v4.0)	Critical
CVE-2026-88869	AVideo AD_Server Stored XSS via log.php label parameter	AVideo	9.3 (v4.0)	Critical
CVE-2026-89249	AVideo YPTWallet Stored XSS via CryptoWallet Configuration	AVideo	9.3 (v4.0)	Critical
CVE-2026-89253	AVideo Stored XSS via donationLink in watch page button	AVideo	9.3 (v4.0)	Critical
CVE-2026-89254	AVideo CustomizeUser Stored XSS via field_name Parameter	AVideo	9.3 (v4.0)	Critical
CVE-2026-89255	AVideo LoginControl Stored XSS via PGP Public Key	AVideo	9.3 (v4.0)	Critical
CVE-2026-89256	AVideo Bookmark Plugin Stored XSS via Chapter Names	AVideo	9.3 (v4.0)	Critical
CVE-2026-84189	LibreNMS before 26.7.0 Stored XSS via Oxidized API	librenms	9.2 (v4.0)	Critical
CVE-2026-89243	WWBN AVideo Stored XSS via UserGroups setGroup_name	AVideo	9.2 (v4.0)	Critical
CVE-2020-24589	WSO2 API Manager <=3.1.0 - Blind XML External Entity Injection	api manager	9.1 (v3.1)	Critical
CVE-2019-7671	Prima Access Control 2.3.35 - 'HwName' Persistent Cross-Site Scripting	flexair	9.0 (v3.1)	Critical
CVE-2023-34192	Zimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site Scripting	collaboration	9.0 (v3.1)	Critical
CVE-2026-34448	SiYuan: Stored XSS in Attribute View gallery/kanban cover rendering allows arbitrary command execution in the desktop cl	siyuan	9.0 (v3.1)	Critical
CVE-2026-42556	Postiz stored XSS in public preview page	postiz	9.0 (v3.1)	Critical
CVE-2026-43984	Tautulli has stored XSS in logFile via guest-controlled log_js_errors input	Tautulli	8.9 (v3.1)	High
CVE-2016-8526	Aruba AirWave 8.2.3 - XML External Entity Injection / Cross-Site Scripting	airwave	8.8 (v3.0)	High
CVE-2016-9315	Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities	interscan web security virtual appliance	8.8 (v3.0)	High
CVE-2018-11442	EasyService Billing 1.0 - Cross-Site Request Forgery	easyservice billing	8.8 (v3.0)	High
CVE-2018-11445	EasyService Billing 1.0 - Cross-Site Request Forgery	easyservice billing	8.8 (v3.0)	High
CVE-2018-1213	Dell EMC Isilon OneFS - Multiple Vulnerabilities	emc isilon onefs	8.8 (v3.0)	High
CVE-2018-17442	D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities	central wifimanager	8.8 (v3.0)	High
CVE-2018-6224	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	8.8 (v3.0)	High
CVE-2021-20086	Odoo Apps - Cross-Site Scripting via Prototype Pollution	jquery-bbq	8.8 (v3.1)	High
CVE-2025-56798	Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier Cross-Site Request Forgery Vulnerability	Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier	8.8 (v3.1)	High
CVE-2026-12968	Product Addons – WowAddons < 1.6.15 - Unauthenticated Stored XSS via Arbitrary SVG Upload	Product Addons and Product Options With Custom Fields	8.8 (v3.1)	High
CVE-2026-41473	CyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner Endpoints	cyberpanel	8.8 (v4.0)	High
CVE-2026-12496	Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server	LIP-ME20xC	8.7 (v4.0)	High
CVE-2026-15217	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab	gitlab	8.7 (v3.1)	High
CVE-2026-28445	Typebot: Stored XSS via Rating Block Custom Icon Bypasses isUnsafe Sandbox in Builder Preview	typebot.io	8.7 (v3.1)	High
CVE-2026-44667	Faction: Stored XSS in Remediation Verification Attachment Filename Preview Rendering	faction	8.7 (v3.1)	High
CVE-2026-44669	Faction: Stored XSS in Assessment Attachment Filename Preview Rendering	faction	8.7 (v3.1)	High
CVE-2026-44729	Twenty: Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers)	twenty	8.7 (v3.1)	High
CVE-2026-45115	MyBB: Buddy/ignore list username XSS	mybb	8.7 (v3.1)	High
CVE-2026-45116	MyBB: Profile field type confusion XSS	mybb	8.7 (v3.1)	High
CVE-2026-45270	CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule	ci4ms	8.7 (v3.1)	High
CVE-2026-46518	OpenEMR: Stored XSS in prescription CSS/HTML print view via patient demographics	openemr	8.7 (v3.1)	High
CVE-2026-47665	Penpot: Stored XSS via comment content, innerHTML renders unsanitized HTML	penpot	8.7 (v3.1)	High
CVE-2026-47743	Shopper: Multiple data integrity and disclosure issues in admin Livewire components	shopper	8.7 (v3.1)	High
CVE-2026-48026	lakeFS vulnerable to stored XSS in rendered markdown previews via raw HTML	lakeFS	8.7 (v3.1)	High
CVE-2026-53758	Emlog: Stored XSS via Parsedown Markdown Processing - Raw HTML Not Sanitized	emlog	8.7 (v4.0)	High
CVE-2026-54347	Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover	froxlor	8.7 (v3.1)	High
CVE-2026-68899	Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallback	wekan	8.7 (v3.1)	High
CVE-2026-70492	Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages	open-webui	8.7 (v3.1)	High
CVE-2025-66024	XWiki Blog Application home page vulnerable to Stored XSS via Post Title	blog application	8.6 (v4.0)	High
CVE-2026-34463	MantisBT has Stored HTML Injection/XSS via Clone Issue Form	mantisbt	8.6 (v4.0)	High
CVE-2026-49864	wetty vulnerable to DOM XSS via file-download filename	wetty	8.6 (v4.0)	High
CVE-2026-21618	Cross-site scripting (XSS) in OAuth Device Authorization screen	hexpm	8.5 (v4.0)	High
CVE-2026-34932	hoppscotch: Stored XSS via mock server responses on backend origin	hoppscotch	8.5 (v4.0)	High
CVE-2026-58113	Teamcenter V2412 Cross-site Scripting Vulnerability	Teamcenter V2412	8.5 (v4.0)	High
CVE-2026-64851	Grav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlers	grav-plugin-shortcode-core	8.5 (v4.0)	High
CVE-2026-65986	CVAT has stored XSS via annotation guide assets	cvat	8.5 (v4.0)	High
CVE-2026-5385	GLPI 11.0.0 - Stored XSS in knowledge base	glpi	8.4 (v4.0)	High
CVE-2026-77072	n8n before 1.123.69 Stored XSS via Form Completion Page	n8n	8.4 (v4.0)	High
CVE-2026-77850	Stored XSS in AshAdmin relationship typeahead via unescaped label_field content	ash admin	8.4 (v4.0)	High
CVE-2026-85613	OpenPanel Unauthenticated XSS via SVG Favicon Proxy	openpanel	8.4 (v4.0)	High
CVE-2026-87814	SiYuan before v3.8.2 Stored XSS via Asset Preview	siyuan	8.4 (v4.0)	High
CVE-2024-5420	SEH utnserver Pro/ProMAX/INU-100 20.1.22 - Cross-Site Scripting	utnserver Pro	8.3 (v4.0)	High
CVE-2017-10075	Oracle Content Server - Cross-Site Scripting	webcenter content	8.2 (v3.0)	High
CVE-2026-34725	dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration	dbgate	8.2 (v3.1)	High
CVE-2026-56670	ComfyUI: Stored XSS via SVG file upload on the /view endpoint	ComfyUI	8.2 (v3.1)	High
CVE-2016-1337	Cisco EPC 3928 - Multiple Vulnerabilities	epc3928 firmware	8.1 (v3.0)	High
CVE-2018-6221	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	8.1 (v3.0)	High
CVE-2026-33437	Stirling PDF: Stored XSS in Info Summary	Stirling-PDF	8.1 (v3.1)	High
CVE-2026-39344	Reflected XSS the login page through the 'username' parameter	churchcrm	8.1 (v3.0)	High
CVE-2026-48060	Litestar: HTML Injection Through CSRF Token	litestar	8.1 (v3.1)	High
CVE-2026-50758	DayuanJiang next-ai-draw-io 0.4.13 Arbitrary Code Execution Vulnerability	DayuanJiang next-ai-draw-io 0.4.13	8.1 (v3.1)	High
CVE-2015-4669	Xceedium Xsuite - Multiple Vulnerabilities	xsuite	7.8 (v3.0)	High
CVE-2016-9314	Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities	interscan web security virtual appliance	7.8 (v3.0)	High
CVE-2018-6222	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	7.8 (v3.0)	High
CVE-2026-16969	DFIR-IRIS Stored XSS in Assets	iris-web	7.6 (v3.1)	High
CVE-2026-18360	DFIR-IRIS Stored XSS in Custom Attributes	iris-web	7.6 (v3.1)	High
CVE-2026-18361	DFIR-IRIS Stored XSS in Datastore Upload	iris-web	7.6 (v3.1)	High
CVE-2002-1131	SquirrelMail 1.2.6/1.2.7 - Cross-Site Scripting	squirrelmail	7.5 (v2.0)	High
CVE-2012-5685	ZPanel 10.0.1 - Cross-Site Request Forgery / Cross-Site Scripting / SQL Injection / Password Reset	zpanel	7.5 (v2.0)	High
CVE-2015-6401	Cisco EPC 3928 - Multiple Vulnerabilities	epc3928 docsis 3.0 8x4 wireless residential gateway with embedded digital voice adapter	7.5 (v2.0)	High
CVE-2016-1328	Cisco EPC 3928 - Multiple Vulnerabilities	epc3928 firmware	7.5 (v3.0)	High
CVE-2016-1336	Cisco EPC 3928 - Multiple Vulnerabilities	epc3928 firmware	7.5 (v3.0)	High
CVE-2018-8033	Apache OFBiz - XML External Entity Injection	ofbiz	7.5 (v3.0)	High
CVE-2019-9757	LabKey Server 19.1.0 - XML External Entity (XXE)	labkey server	7.5 (v3.1)	High
CVE-2025-61884	Oracle E-Business Suite - Server-Side Request Forgery	configurator	7.5 (v3.1)	High
CVE-2026-44657	MantisBT: Stored XSS in File Download	mantisbt	7.5 (v4.0)	High
CVE-2026-7460	mailcow-dockerized 2026-03b - Stored XSS in Queue Manager via unescaped	mailcow-dockerized	7.4 (v4.0)	High
CVE-2026-87812	SiYuan before v3.8.2 Stored XSS via Bazaar iconURL	siyuan	7.4 (v4.0)	High
CVE-2026-30819	Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameter	iTop	7.3 (v3.1)	High
CVE-2026-6735	XSS within PHP-FPM status endpoint	php	7.3 (v4.0)	High
CVE-2026-8203	Concrete CMS 9.5.0 and below has Stored XSS on the height parameter	concrete cms	7.3 (v4.0)	High
CVE-2026-16809	LimeSurvey Community Edition 7.0.5 - Stored XSS in quota message rendering	LimeSurvey	7.2 (v4.0)	High
CVE-2026-18756	HumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button rendering	HumHub	7.2 (v4.0)	High
CVE-2026-19914	Welcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter	Welcart e-Commerce	7.2 (v3.1)	High
CVE-2022-35499	In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint Cross-Site Scripting Vulnerability	-	7.1 (v3.1)	High
CVE-2026-12970	LearnPress < 4.4.1 - Reflected XSS via c_search	LearnPress	7.1 (v3.1)	High
CVE-2026-34598	YesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter"	yeswiki	7.1 (v4.0)	High
CVE-2026-6858	Transbank Webpay < 1.14.0 - Unauthenticated Stored XSS	Transbank Webpay	7.1 (v3.1)	High
CVE-2026-84192	LibreNMS before 26.3.1 Stored XSS via SNMP/Syslog Data	librenms	7.1 (v4.0)	High
CVE-2026-55746	Cotonti stored XSS via PFS folder title	Cotonti	7.0 (v4.0)	High
CVE-2026-58411	ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values	CRM	7.0 (v4.0)	High
CVE-2018-3238	Oracle Fusion Middleware WebCenter Sites 11.1.1.8.0 - Cross-Site Scripting	webcenter sites	6.9 (v3.0)	Medium
CVE-2025-4388	Liferay Portal - Cross-Site Scripting	digital experience platform	6.9 (v4.0)	Medium
CVE-2025-4576	Liferay Portal & DXP - Cross-Site Scripting	digital experience platform	6.9 (v4.0)	Medium
CVE-2025-62613	VDO.Ninja - DOM-Based Cross-Site Scripting	vdo.ninja	6.9 (v4.0)	Medium
CVE-2026-39838	ProofreadPage improperly sanitizes multiline styles using Sanitizer::checkCSS	MediaWiki - ProofreadPage Extension	6.9 (v4.0)	Medium
CVE-2026-39936	Stored XSS in Score due to usage of non-reserved data attributes	Mediawiki - Score Extension	6.9 (v4.0)	Medium
CVE-2026-40598	MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page	mantisbt	6.9 (v4.0)	Medium
CVE-2026-44651	SillyTavern: Reflected XSS vulnerability in the CORS proxy middleware	SillyTavern	6.9 (v4.0)	Medium
CVE-2026-59238	Stored XSS in Pentestify via unsanitized finding images and report client logo	Pentestify	6.9 (v4.0)	Medium
CVE-2026-69092	Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpoint	admidio	6.9 (v4.0)	Medium
CVE-2026-86188	AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting	AVideo	6.9 (v4.0)	Medium
CVE-2007-0885	Jira Rainbow.Zen - Cross-Site Scripting	rainbow.zen	6.8 (v2.0)	Medium
CVE-2012-5683	ZPanel 10.0.1 - Cross-Site Request Forgery / Cross-Site Scripting / SQL Injection / Password Reset	zpanel	6.8 (v2.0)	Medium
CVE-2018-6230	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	6.8 (v3.0)	Medium
CVE-2026-13605	Photo Swipe <= 4.1.1.1 - Author+ Stored XSS via title Attribute	PhotoSwipe	6.8 (v3.1)	Medium
CVE-2026-14817	Element Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data Attributes	Element Pack Addons for Elementor	6.8 (v3.1)	Medium
CVE-2026-14833	Lightbox with PhotoSwipe < 5.9.0 - Author+ Stored XSS via data-lbwps-caption Attribute	Lightbox with PhotoSwipe	6.8 (v3.1)	Medium
CVE-2026-15047	s2Member < 260805 - Contributor+ Stored XSS via Shortcode	s2Member	6.8 (v3.1)	Medium
CVE-2026-16559	YMC Filter < 3.12.9 - Author+ Stored XSS via SVG Icon Upload	YMC Filter	6.8 (v3.1)	Medium
CVE-2026-33741	EspoCRM: Stored XSS via SVG attachment loading same-origin JavaScript	espocrm	6.8 (v3.1)	Medium
CVE-2018-1203	Dell EMC Isilon OneFS - Multiple Vulnerabilities	emc isilon onefs	6.7 (v3.0)	Medium
CVE-2018-1204	Dell EMC Isilon OneFS - Multiple Vulnerabilities	emc isilon onefs	6.7 (v3.0)	Medium
CVE-2012-1258	Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities	scrutinizer netflow & sflow analyzer	6.5 (v3.1)	Medium
CVE-2018-6219	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	6.5 (v3.0)	Medium
CVE-2019-7439	JioFi 4G M2S 1.0.2 - Denial of Service	jiofi 4g m2s firmware	6.5 (v3.0)	Medium
CVE-2021-31249	CHIYU TCP/IP Converter - Carriage Return Line Feed Injection	bf-430 firmware	6.5 (v3.1)	Medium
CVE-2025-32430	XWiki Platform - Cross-Site Scripting	xwiki-platform	6.5 (v4.0)	Medium
CVE-2026-24128	XWiki Platform Distribution Flavor Main - Cross-Site Scripting	xwiki-platform-distribution-flavor-main	6.5 (v4.0)	Medium
CVE-2026-40105	XWiki - Cross-Site Scripting	xwiki-platform	6.5 (v4.0)	Medium
CVE-2026-55549	Yamcs: Reflected XSS in the URL of the Authorize Endpoint	yamcs	6.5 (v3.1)	Medium
CVE-2026-78838	AppNitro MachForm v30 Cross-Site Scripting Vulnerability	AppNitro MachForm v30	6.5 (v3.1)	Medium
CVE-2026-0737	Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode	WP Shortcodes Plugin — Shortcodes Ultimate	6.4 (v3.1)	Medium
CVE-2026-3885	WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_bo	Shortcodes Ultimate – Content Elements	6.4 (v3.1)	Medium
CVE-2026-45797	HeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Upload	heyform	6.4 (v4.0)	Medium
CVE-2026-50592	Znuny Cross-Site Scripting Vulnerability	Znuny	6.4 (v3.1)	Medium
CVE-2026-87870	Ninja Forms - Scheduled Exports <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Paramete	Ninja Forms - Scheduled Exports	6.4 (v3.1)	Medium
CVE-2026-43980	Malla: Stored XSS via Meshtastic node names in multiple frontend pages	malla	6.3 (v3.1)	Medium
CVE-2012-1260	Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities	scrutinizer netflow & sflow analyzer	6.1 (v3.1)	Medium
CVE-2012-1261	Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities	scrutinizer netflow & sflow analyzer	6.1 (v3.1)	Medium
CVE-2012-5193	Bitweaver 2.8.1 - Multiple Vulnerabilities	bitweaver	6.1 (v3.1)	Medium
CVE-2014-4535	Import Legacy Media <= 0.1 - Cross-Site Scripting	import legacy media	6.1 (v3.1)	Medium
CVE-2014-4536	Infusionsoft Gravity Forms Add-on < 1.5.7 - Cross-Site Scripting	infusionsoft gravity forms	6.1 (v3.1)	Medium
CVE-2014-4539	Movies <= 0.6 - Cross-Site Scripting	movies	6.1 (v3.1)	Medium
CVE-2014-4544	Podcast Channels < 0.28 - Cross-Site Scripting	podcast channels	6.1 (v3.1)	Medium
CVE-2014-4558	WooCommerce Swipe <= 2.7.1 - Cross-Site Scripting	swipehq-payment-gateway-woocommerce	6.1 (v3.1)	Medium
CVE-2014-4561	Ultimate Weather Plugin <= 1.0 - Cross-Site Scripting	ultimate-weather	6.1 (v3.1)	Medium
CVE-2014-4592	WP Planet <= 0.1 - Cross-Site Scripting	wp-planet	6.1 (v3.1)	Medium
CVE-2014-9607	Netsweeper 4.0.4 - Cross-Site Scripting	netsweeper	6.1 (v3.1)	Medium
CVE-2015-4668	Xceedium Xsuite - Multiple Vulnerabilities	xsuite	6.1 (v3.0)	Medium
CVE-2015-6477	Nordex NC2 - Cross-Site Scripting	nordex control 2 scada	6.1 (v3.1)	Medium
CVE-2015-6544	Combodo iTop <2.2.0-2459 - Cross-Site Scripting	itop	6.1 (v3.0)	Medium
CVE-2015-8349	SourceBans <2.0 - Cross-Site Scripting	sourcebans	6.1 (v3.0)	Medium
CVE-2015-9414	WordPress Symposium <=15.8.1 - Cross-Site Scripting	wp-symposium	6.1 (v3.1)	Medium
CVE-2016-1000126	WordPress Admin Font Editor <=1.8 - Cross-Site Scripting	admin-font-editor	6.1 (v3.0)	Medium
CVE-2016-1000127	WordPress AJAX Random Post <=2.00 - Cross-Site Scripting	ajax-random-post	6.1 (v3.0)	Medium
CVE-2016-1000128	WordPress anti-plagiarism <=3.60 - Cross-Site Scripting	anti-plagiarism	6.1 (v3.0)	Medium
CVE-2016-1000129	WordPress defa-online-image-protector <=3.3 - Cross-Site Scripting	defa-online-image-protector	6.1 (v3.0)	Medium
CVE-2016-1000130	WordPress e-search <=1.0 - Cross-Site Scripting	e-search	6.1 (v3.0)	Medium
CVE-2016-1000131	WordPress e-search <=1.0 - Cross-Site Scripting	esearch	6.1 (v3.0)	Medium
CVE-2016-1000132	WordPress enhanced-tooltipglossary 3.2.8 - Cross-Site Scripting	tooltip glossary	6.1 (v3.0)	Medium
CVE-2016-1000133	WordPress forget-about-shortcode-buttons 1.1.1 - Cross-Site Scripting	forget about shortcode buttons	6.1 (v3.0)	Medium
CVE-2016-1000134	WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting	hdw-tube	6.1 (v3.0)	Medium
CVE-2016-1000135	WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting	hdw-tube	6.1 (v3.0)	Medium
CVE-2016-1000136	WordPress heat-trackr 1.0 - Cross-Site Scripting	heat-trackr	6.1 (v3.0)	Medium
CVE-2016-1000137	WordPress Hero Maps Pro 2.1.0 - Cross-Site Scripting	hero-maps-pro	6.1 (v3.0)	Medium
CVE-2016-1000138	WordPress Admin Font Editor <=1.8 - Cross-Site Scripting	indexisto	6.1 (v3.0)	Medium
CVE-2016-1000139	WordPress Infusionsoft Gravity Forms <=1.5.11 - Cross-Site Scripting	infusionsoft	6.1 (v3.0)	Medium
CVE-2016-1000141	WordPress Page Layout builder v1.9.3 - Cross-Site Scripting	page-layout-builder	6.1 (v3.0)	Medium
CVE-2016-1000142	WordPress MW Font Changer <=4.2.5 - Cross-Site Scripting	parsi-font	6.1 (v3.0)	Medium
CVE-2016-1000143	WordPress Photoxhibit 2.1.8 - Cross-Site Scripting	photoxhibit	6.1 (v3.0)	Medium
CVE-2016-1000146	WordPress Pondol Form to Mail <=1.1 - Cross-Site Scripting	pondol-formmail	6.1 (v3.0)	Medium
CVE-2016-1000148	WordPress S3 Video <=0.983 - Cross-Site Scripting	s3-video	6.1 (v3.0)	Medium
CVE-2016-1000153	WordPress Tidio Gallery <=1.1 - Cross-Site Scripting	tidio-gallery	6.1 (v3.0)	Medium
CVE-2016-1000154	WordPress WHIZZ <=1.0.7 - Cross-Site Scripting	whizz	6.1 (v3.0)	Medium
CVE-2016-7981	SPIP <3.1.2 - Cross-Site Scripting	spip	6.1 (v3.0)	Medium
CVE-2016-8527	Aruba AirWave 8.2.3 - XML External Entity Injection / Cross-Site Scripting	airwave	6.1 (v3.0)	Medium
CVE-2017-11107	phpLDAPadmin <= 1.2.3 - Reflected XSS	phpldapadmin	6.1 (v3.1)	Medium
CVE-2017-11629	FineCMS <=5.0.10 - Cross-Site Scripting	finecms	6.1 (v3.0)	Medium
CVE-2017-12794	Django Debug Page - Cross-Site Scripting	django	6.1 (v3.0)	Medium
CVE-2017-17451	WordPress Mailster <=1.5.4 - Cross-Site Scripting	wp mailster	6.1 (v3.0)	Medium
CVE-2017-18536	WordPress Stop User Enumeration <=1.3.7 - Cross-Site Scripting	stop user enumeration	6.1 (v3.0)	Medium
CVE-2017-3132	Fortinet FortiOS < 5.6.0 - Cross-Site Scripting	fortios	6.1 (v3.0)	Medium
CVE-2017-3133	Fortinet FortiOS < 5.6.0 - Cross-Site Scripting	fortios	6.1 (v3.0)	Medium
CVE-2017-6443	EPSON TMNet WebConfig 1.00 - Cross-Site Scripting	tmnet webconfig	6.1 (v3.0)	Medium
CVE-2017-7855	IceWarp WebMail 11.3.1.5 - Cross-Site Scripting	server	6.1 (v3.0)	Medium
CVE-2017-9140	Reflected XSS - Telerik Reporting Module	telerik reporting	6.1 (v3.0)	Medium
CVE-2017-9288	WordPress Raygun4WP <=1.8.0 - Cross-Site Scripting	raygun4wp	6.1 (v3.0)	Medium
CVE-2018-10095	Dolibarr <7.0.2 - Cross-Site Scripting	dolibarr	6.1 (v3.0)	Medium
CVE-2018-10230	Zend Server <9.13 - Cross-Site Scripting	zend server	6.1 (v3.0)	Medium
CVE-2018-10383	Lantronix SecureLinx Spider (SLS) 2.2+ - Cross-Site Scripting	securelinx spider firmware	6.1 (v3.0)	Medium
CVE-2018-12998	Zoho manageengine - Cross-Site Scripting	firewall analyzer	6.1 (v3.1)	Medium
CVE-2018-14013	Synacor Zimbra Collaboration Suite Collaboration <8.8.11 - Cross-Site Scripting	zimbra collaboration suite	6.1 (v3.0)	Medium
CVE-2018-16139	BIBLIOsoft BIBLIOpac 2008 - Cross-Site Scripting	bibliopac	6.1 (v3.0)	Medium
CVE-2018-17441	D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities	central wifimanager	6.1 (v3.0)	Medium
CVE-2018-17443	D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities	central wifimanager	6.1 (v3.0)	Medium
CVE-2018-19136	DomainMOD 4.11.01 - Cross-Site Scripting	domainmod	6.1 (v3.0)	Medium
CVE-2018-19137	DomainMOD 4.11.01 - Cross-Site Scripting	domainmod	6.1 (v3.0)	Medium
CVE-2018-19439	Oracle Secure Global Desktop Administration Console 4.4 - Cross-Site Scripting	secure global desktop	6.1 (v3.0)	Medium
CVE-2018-19933	Bolt CMS < 3.6.2 - Cross-Site Scripting	bolt cms	6.1 (v3.0)	Medium
CVE-2018-20462	WordPress JSmol2WP <=1.07 - Cross-Site Scripting	jsmol2wp	6.1 (v3.0)	Medium
CVE-2018-20503	SirsiDynix e-Library 3.5.x - Cross-Site Scripting	8100l/8 firmware	6.1 (v3.0)	Medium
CVE-2018-6882	zimbra collaboration suite Cross-Site Scripting Vulnerability	zimbra collaboration suite	6.1 (v3.1)	Medium
CVE-2018-7196	osTicket < 1.10.2 - Cross-Site Scripting	osticket	6.1 (v3.0)	Medium
CVE-2018-7203	TwonkyMedia Server 7.0.11-8.5 - Persistent Cross-Site Scripting	twonky server	6.1 (v3.0)	Medium
CVE-2018-7653	YzmCMS v3.6 - Cross-Site Scripting	yzmcms	6.1 (v3.0)	Medium
CVE-2018-9238	Yahei PHP Prober 0.4.7 - Cross-Site Scripting	yahei php prober	6.1 (v3.0)	Medium
CVE-2019-10475	Jenkins build-metrics 1.3 - Cross-Site Scripting	build-metrics	6.1 (v3.1)	Medium
CVE-2019-10685	Prinect Archive System 2015 Release 2.6 - Cross-Site Scripting	prinect archiver	6.1 (v3.0)	Medium
CVE-2019-11507	Pulse Secure Pulse Connect Secure - Cross-Site Scripting (Reflected)	connect secure	6.1 (v3.1)	Medium
CVE-2019-12461	WebPort 1.19.1 - Cross-Site Scripting	web port	6.1 (v3.0)	Medium
CVE-2019-12935	Shopware < 5.5.8 - Cross-Site Scripting	shopware	6.1 (v3.0)	Medium
CVE-2019-14696	Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting	open-school	6.1 (v3.0)	Medium
CVE-2019-15501	L-Soft LISTSERV <16.5-2018a - Cross-Site Scripting	listserv	6.1 (v3.0)	Medium
CVE-2019-15713	WordPress My Calendar <= 3.1.9 - Cross-Site Scripting	my calendar	6.1 (v3.0)	Medium
CVE-2019-15811	DomainMOD <=4.13.0 - Cross-Site Scripting	domainmod	6.1 (v3.0)	Medium
CVE-2019-15889	WordPress Download Manager <2.9.94 - Cross-Site Scripting	wordpress download manager	6.1 (v3.0)	Medium
CVE-2019-16332	WordPress API Bearer Auth <20190907 - Cross-Site Scripting	api bearer auth	6.1 (v3.1)	Medium
CVE-2019-16525	WordPress Checklist <1.1.9 - Cross-Site Scripting	checklist	6.1 (v3.1)	Medium
CVE-2019-16931	WordPress Visualizer <3.3.1 - Cross-Site Scripting	visualizer	6.1 (v3.1)	Medium
CVE-2019-19134	WordPress Hero Maps Premium <=2.2.1 - Cross-Site Scripting	hero maps premium	6.1 (v3.1)	Medium
CVE-2019-19908	phpMyChat-Plus 1.98 - Cross-Site Scripting	phpmychat-plus	6.1 (v3.1)	Medium
CVE-2019-20210	WordPress CTHthemes - Cross-Site Scripting	citybook	6.1 (v3.1)	Medium
CVE-2019-3402	Jira < 8.1.1 - Cross-Site Scripting	jira	6.1 (v3.0)	Medium
CVE-2019-3911	LabKey Server Community Edition <18.3.0 - Cross-Site Scripting	labkey server	6.1 (v3.1)	Medium
CVE-2019-6112	WordPress Sell Media 2.4.1 - Cross-Site Scripting	sell media	6.1 (v3.1)	Medium
CVE-2019-7438	JioFi 4G M2S 1.0.2 - 'mask' Cross-Site Scripting	jiofi 4g m2s firmware	6.1 (v3.0)	Medium
CVE-2019-8390	qdPM 9.1 - 'search[keywords]' Cross-Site Scripting	qdpm	6.1 (v3.0)	Medium
CVE-2019-8937	HotelDruid 2.3.0 - Cross-Site Scripting	hoteldruid	6.1 (v3.0)	Medium
CVE-2019-9553	Bolt CMS 3.6.4 - Cross-Site Scripting	bolt	6.1 (v3.1)	Medium
CVE-2020-1106	Microsoft Office SharePoint XSS Vulnerability	sharepoint enterprise server	6.1 (v3.1)	Medium
CVE-2020-12054	WordPress Catch Breadcrumb <1.5.4 - Cross-Site Scripting	catch breadcrumb	6.1 (v3.1)	Medium
CVE-2020-14413	NeDi 1.9C - Cross-Site Scripting	nedi	6.1 (v3.1)	Medium
CVE-2020-15500	TileServer GL <=3.0.0 - Cross-Site Scripting	tileservergl	6.1 (v3.1)	Medium
CVE-2020-15599	Victor CMS 1.0 - 'user_firstname' Persistent Cross-Site Scripting	victor cms	6.1 (v3.1)	Medium
CVE-2020-15718	RosarioSIS 6.7.2 - Cross-Site Scripting	rosariosis	6.1 (v3.1)	Medium
CVE-2020-17362	Nova Lite < 1.3.9 - Cross-Site Scripting	nova lite	6.1 (v3.1)	Medium
CVE-2020-19283	Jeesns 1.4.2 - Cross-Site Scripting	jeesns	6.1 (v3.1)	Medium
CVE-2020-23517	Aryanic HighMail (High CMS) - Cross-Site Scripting	high cms	6.1 (v3.1)	Medium
CVE-2020-23814	XXL-JOB v2.2.0 — Stored Cross Site Scripting	xxl-job	6.1 (v3.1)	Medium
CVE-2020-24609	Savsoft Quiz 5 - Stored Cross-Site Scripting	savsoft quiz	6.1 (v3.1)	Medium
CVE-2020-24701	OX Appsuite - Cross-Site Scripting	open-xchange appsuite	6.1 (v3.1)	Medium
CVE-2020-27982	IceWarp WebMail 11.4.5.0 - Cross-Site Scripting	mail server	6.1 (v3.1)	Medium
CVE-2020-35416	PHPJabbers Appointment Scheduler 2.3 - Reflected XSS (Cross-Site Scripting)	phpjabbers appointment scheduler	6.1 (v3.1)	Medium
CVE-2020-3580	Cisco ASA/FTD Software - Cross-Site Scripting	firepower threat defense	6.1 (v3.1)	Medium
CVE-2020-6171	CLink Office 2.0 - Cross-Site Scripting	clink office	6.1 (v3.1)	Medium
CVE-2020-7107	WordPress Ultimate FAQ <1.8.30 - Cross-Site Scripting	ultimate faq	6.1 (v3.1)	Medium
CVE-2020-8191	Citrix ADC/Gateway - Cross-Site Scripting	application delivery controller firmware	6.1 (v3.1)	Medium
CVE-2020-8512	IceWarp WebMail Server <=11.4.4.1 - Cross-Site Scripting	icewarp server	6.1 (v3.1)	Medium
CVE-2020-9344	Jira Subversion ALM for Enterprise <8.8.2 - Cross-Site Scripting	subversion application lifecycle management	6.1 (v3.1)	Medium
CVE-2021-20137	Gryphon Tower - Cross-Site Scripting	gryphon tower	6.1 (v3.1)	Medium
CVE-2021-21799	Advantech R-SeeNet 2.4.12 - Cross-Site Scripting	r-seenet	6.1 (v3.1)	Medium
CVE-2021-21800	Advantech R-SeeNet 2.4.12 - Cross-Site Scripting	r-seenet	6.1 (v3.1)	Medium
CVE-2021-21801	Advantech R-SeeNet - Cross-Site Scripting	r-seenet	6.1 (v3.1)	Medium
CVE-2021-21802	Advantech R-SeeNet - Cross-Site Scripting	r-seenet	6.1 (v3.1)	Medium
CVE-2021-21803	Advantech R-SeeNet - Cross-Site Scripting	r-seenet	6.1 (v3.1)	Medium
CVE-2021-24214	WordPress OpenID Connect Generic Client 3.8.0-3.8.1 - Cross-Site Scripting	openid connect generic client	6.1 (v3.1)	Medium
CVE-2021-24235	WordPress Goto Tour & Travel Theme <2.0 - Cross-Site Scripting	goto	6.1 (v3.1)	Medium
CVE-2021-24237	WordPress Realteo <=1.2.3 - Cross-Site Scripting	findeo	6.1 (v3.1)	Medium
CVE-2021-24245	WordPress Plugin Stop Spammers 2021.8 - 'log' Reflected Cross-site Scripting (XSS)	stop spammers	6.1 (v3.1)	Medium
CVE-2021-24298	WordPress Simple Giveaways <2.36.2 - Cross-Site Scripting	simple giveaways	6.1 (v3.1)	Medium
CVE-2021-24316	WordPress Mediumish Theme <=1.0.47 - Cross-Site Scripting	mediumish	6.1 (v3.1)	Medium
CVE-2021-24320	WordPress Bello Directory & Listing Theme <1.6.0 - Cross-Site Scripting	bello	6.1 (v3.1)	Medium
CVE-2021-24335	WordPress Car Repair Services & Auto Mechanic Theme <4.0 - Cross-Site Scripting	car repair services & auto mechanic	6.1 (v3.1)	Medium
CVE-2021-24342	WordPress JNews Theme <8.0.6 - Cross-Site Scripting	jnews	6.1 (v3.1)	Medium
CVE-2021-24387	WordPress Pro Real Estate 7 Theme <3.1.1 - Cross-Site Scripting	real estate 7	6.1 (v3.1)	Medium
CVE-2021-24389	WordPress FoodBakery <2.2 - Cross-Site Scripting	foodbakery	6.1 (v3.1)	Medium
CVE-2021-24435	WordPress Titan Framework plugin <= 1.12.1 - Cross-Site Scripting	titan framework	6.1 (v3.1)	Medium
CVE-2021-24495	Wordpress Marmoset Viewer <1.9.3 - Cross-Site Scripting	marmoset viewer	6.1 (v3.1)	Medium
CVE-2021-24498	WordPress Calendar Event Multi View <1.4.01 - Cross-Site Scripting	calendar event multi view	6.1 (v3.1)	Medium
CVE-2021-24522	ProfilePress < 3.1.11 - Cross-Site Scripting	profilepress	6.1 (v3.1)	Medium
CVE-2021-26247	Cacti - Cross-Site Scripting	cacti	6.1 (v3.1)	Medium
CVE-2021-26475	EPrints 3.4.2 - Cross-Site Scripting	eprints	6.1 (v3.1)	Medium
CVE-2021-26702	EPrints 3.4.2 - Cross-Site Scripting	eprints	6.1 (v3.1)	Medium
CVE-2021-26710	Redwood Report2Web 4.3.4.5 & 4.5.3 - Cross-Site Scripting	report2web	6.1 (v3.1)	Medium
CVE-2021-26947	Odoo <= 15.0 - Cross-Site Scripting	odoo	6.1 (v3.1)	Medium
CVE-2021-27309	Clansphere CMS 2011.4 - Cross-Site Scripting	clansphere	6.1 (v3.1)	Medium
CVE-2021-27310	Clansphere CMS 2011.4 - Cross-Site Scripting	clansphere	6.1 (v3.1)	Medium
CVE-2021-27519	FUDForum 3.1.0 - Cross-Site Scripting	fudforum	6.1 (v3.1)	Medium
CVE-2021-27520	FUDForum 3.1.0 - Cross-Site Scripting	fudforum	6.1 (v3.1)	Medium
CVE-2021-27695	openMAINT openMAINT 2.1-3.3-b - 'Multiple' Persistent Cross-Site Scripting	openmaint	6.1 (v3.1)	Medium
CVE-2021-29625	Adminer <=4.8.0 - Cross-Site Scripting	adminer	6.1 (v3.1)	Medium
CVE-2021-30049	SysAid Technologies 20.3.64 b14 - Cross-Site Scripting	sysaid	6.1 (v3.1)	Medium
CVE-2021-30203	Dzzoffice 2.02.1 - Cross-Site Scripting	dzzoffice	6.1 (v3.1)	Medium
CVE-2021-30213	Knowage Suite 7.3 - Cross-Site Scripting	knowage	6.1 (v3.1)	Medium
CVE-2021-31537	SIS Informatik REWE GO SP17 <7.7 - Cross-Site Scripting	sis-rewe go	6.1 (v3.1)	Medium
CVE-2021-31589	BeyondTrust Secure Remote Access Base <=6.0.1 - Cross-Site Scripting	appliance base software	6.1 (v3.1)	Medium
CVE-2021-31682	WebCTRL OEM <= 6.5 - Cross-Site Scripting	webctrl	6.1 (v3.1)	Medium
CVE-2021-31862	SysAid 20.4.74 - Cross-Site Scripting	sysaid	6.1 (v3.1)	Medium
CVE-2021-35488	Thruk 2.40-2 - Cross-Site Scripting	thruk	6.1 (v3.1)	Medium
CVE-2021-36646	KodExplorer - Cross-Site Scripting	kod-explorer	6.1 (v3.1)	Medium
CVE-2021-37416	Zoho ManageEngine ADSelfService Plus <=6103 - Cross-Site Scripting	manageengine adselfservice plus	6.1 (v3.1)	Medium
CVE-2021-37833	Hotel Druid 3.0.2 - Cross-Site Scripting	hoteldruid	6.1 (v3.1)	Medium
CVE-2021-3831	Gnuboard 5 - Cross-Site Scripting	gnuboard5	6.1 (v3.1)	Medium
CVE-2021-38702	Cyberoam NetGenie Cross-Site Scripting	netgenie c0101b1-20141120-ng11vo firmware	6.1 (v3.1)	Medium
CVE-2021-38704	ClinicCases 7.3.3 Cross-Site Scripting	cliniccases	6.1 (v3.1)	Medium
CVE-2021-40868	Cloudron 6.2 Cross-Site Scripting	cloudron	6.1 (v3.1)	Medium
CVE-2021-41467	JustWriting - Cross-Site Scripting	justwriting	6.1 (v3.1)	Medium
CVE-2021-41951	Resourcespace - Cross-Site Scripting	resourcespace	6.1 (v3.1)	Medium
CVE-2021-42565	myfactory FMS - Cross-Site Scripting	fms	6.1 (v3.1)	Medium
CVE-2021-42567	Apereo CAS Cross-Site Scripting	central authentication service	6.1 (v3.1)	Medium
CVE-2021-43062	Fortinet FortiMail 7.0.1 - Cross-Site Scripting	fortimail	6.1 (v3.1)	Medium
CVE-2021-43725	Spotweb <= 1.5.1 - Cross Site Scripting (Reflected)	spotweb	6.1 (v3.1)	Medium
CVE-2021-45422	Reprise License Manager 14.2 - Cross-Site Scripting	reprise license manager	6.1 (v3.1)	Medium
CVE-2021-45425	SAFARI Montage 8.5 - Reflected Cross Site Scripting (XSS)	safari montage	6.1 (v3.1)	Medium
CVE-2021-46387	Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting (XSS)	zywall 2 plus internet security appliance firmware	6.1 (v3.1)	Medium
CVE-2022-0201	WordPress Permalink Manager <2.2.15 - Cross-Site Scripting	permalink manager lite	6.1 (v3.1)	Medium
CVE-2022-0208	WordPress Plugin MapPress <2.73.4 - Cross-Site Scripting	mappress	6.1 (v3.1)	Medium
CVE-2022-0346	WordPress XML Sitemap Generator for Google <2.0.4 - Cross-Site Scripting/Remote Code Execution	xml sitemap generator	6.1 (v3.1)	Medium
CVE-2022-0678	Microweber <1.2.11 - Cross-Site Scripting	microweber	6.1 (v3.1)	Medium
CVE-2022-0879	Caldera Forms < 1.9.7 - Reflected Cross-Site Scripting	caldera forms	6.1 (v3.1)	Medium
CVE-2022-1168	WordPress WP JobSearch <1.5.1 - Cross-Site Scripting	jobsearch wp job board	6.1 (v3.1)	Medium
CVE-2022-1170	JobMonster < 4.5.2.9 - Cross-Site Scripting	jobmonster	6.1 (v3.1)	Medium
CVE-2022-1221	WordPress Gwyn's Imagemap Selector <=0.3.3 - Cross-Site Scripting	gwyn's imagemap selector	6.1 (v3.1)	Medium
CVE-2022-2130	Microweber < 1.2.17 - Cross-Site Scripting	microweber	6.1 (v3.1)	Medium
CVE-2022-2174	microweber 1.2.18 - Cross-site Scripting	microweber	6.1 (v3.1)	Medium
CVE-2022-22242	Juniper Web Device Manager - Cross-Site Scripting	junos	6.1 (v3.1)	Medium
CVE-2022-23397	Cedar Gate EZ-NET <= 6.8.0 - Cross-Site Scripting	ez-net portal	6.1 (v3.1)	Medium
CVE-2022-24384	SmarterTools SmarterTrack - Cross-Site Scripting	smartertrack	6.1 (v3.1)	Medium
CVE-2022-26564	HotelDruid Hotel Management Software 3.0.3 - Cross-Site Scripting	hoteldruid	6.1 (v3.1)	Medium
CVE-2022-2733	Openemr < 7.0.0.1 - Cross-Site Scripting	openemr	6.1 (v3.1)	Medium
CVE-2022-27926	Zimbra Collaboration (ZCS) - Cross Site Scripting	collaboration	6.1 (v3.1)	Medium
CVE-2022-28363	Reprise License Manager 14.2 - Cross-Site Scripting	reprise license manager	6.1 (v3.1)	Medium
CVE-2022-28508	MantisBT < 2.25.2 - Cross-Site Scripting	mantisbt	6.1 (v3.1)	Medium
CVE-2022-29004	Diary Management System 1.0 - Cross-Site Scripting	e-diary management system	6.1 (v3.1)	Medium
CVE-2022-29005	Online Birth Certificate System 1.2 - Stored Cross-Site Scripting	online birth certificate system	6.1 (v3.1)	Medium
CVE-2022-30489	Wavlink WN-535G3 - Cross-Site Scripting	wn535g3 firmware	6.1 (v3.1)	Medium
CVE-2022-30777	Parallels H-Sphere 3.6.1713 - Cross-Site Scripting	h-sphere	6.1 (v3.1)	Medium
CVE-2022-30983	Support chatbot in Nopaperforms Niaa-Chatbot through 2022-05-17 Cross-Site Scripting Vulnerability	Support chatbot in Nopaperforms Niaa-Chatbot through 2022-05-17	6.1 (v3.1)	Medium
CVE-2022-31470	Axigen WebMail - Cross-Site Scripting	webmail	6.1 (v3.1)	Medium
CVE-2022-31798	Nortek Linear eMerge E3-Series - Cross-Site Scripting	emerge e3 firmware	6.1 (v3.1)	Medium
CVE-2022-32195	Open edX <2022-06-06 - Cross-Site Scripting	open edx	6.1 (v3.1)	Medium
CVE-2022-32770	WWBN AVideo 11.6 - Cross-Site Scripting	avideo	6.1 (v3.1)	Medium
CVE-2022-32771	WWBN AVideo 11.6 - Cross-Site Scripting	avideo	6.1 (v3.1)	Medium
CVE-2022-34093	Software Publico Brasileiro i3geo v7.0.5 - Cross-Site Scripting	i3geo	6.1 (v3.1)	Medium
CVE-2022-34094	Software Publico Brasileiro i3geo v7.0.5 - Cross-Site Scripting	i3geo	6.1 (v3.1)	Medium
CVE-2022-34305	Apache Tomcat Examples Web Application - Cross-Site Scripting	tomcat	6.1 (v3.1)	Medium
CVE-2022-34328	PMB 7.3.10 - Cross-Site Scripting	pmb	6.1 (v3.1)	Medium
CVE-2022-3484	WordPress WPB Show Core - Cross-Site Scripting	wpb show core	6.1 (v3.1)	Medium
CVE-2022-35155	Bus Pass Management System 1.0 - Cross-Site Scripting (XSS)	bus pass management system	6.1 (v3.1)	Medium
CVE-2022-35493	eShop 3.0.4 - Cross-Site Scripting	eshop - ecommerce / store website	6.1 (v3.1)	Medium
CVE-2022-3766	phpMyFAQ < 3.1.8 - Cross-Site Scripting	phpmyfaq	6.1 (v3.1)	Medium
CVE-2022-38295	Cuppa CMS v1.0 - Cross Site Scripting	cuppacms	6.1 (v3.1)	Medium
CVE-2022-38467	CRM Perks Forms < 1.1.1 - Cross Site Scripting	crm perks forms	6.1 (v3.1)	Medium
CVE-2022-39195	LISTSERV 17 - Cross-Site Scripting	listserv	6.1 (v3.1)	Medium
CVE-2022-41441	ReQlogic v11.3 - Cross Site Scripting	reqlogic	6.1 (v3.1)	Medium
CVE-2022-4301	WordPress Sunshine Photo Cart <2.9.15 - Cross-Site Scripting	sunshine photo cart	6.1 (v3.1)	Medium
CVE-2022-43016	OpenCATS 0.9.6 - Cross-Site Scripting	opencats	6.1 (v3.1)	Medium
CVE-2022-43018	OpenCATS 0.9.6 - Cross-Site Scripting	opencats	6.1 (v3.1)	Medium
CVE-2022-4321	PDF Generator for WordPress < 1.1.2 - Cross Site Scripting	pdf generator for wordpress	6.1 (v3.1)	Medium
CVE-2022-45836	WordPress Download Manager <= 3.2.59 - Reflected XSS	download manager	6.1 (v3.1)	Medium
CVE-2022-46381	Linear eMerge E3-Series - Cross-Site Scripting	linear emerge e3 access control firmware	6.1 (v3.1)	Medium
CVE-2022-48012	OpenCATS 0.9.7 - Cross-Site Scripting	opencats	6.1 (v3.1)	Medium
CVE-2022-48197	Yahoo User Interface library (YUI2) TreeView v2.8.2 - Cross-Site Scripting	yui	6.1 (v3.1)	Medium
CVE-2023-0236	WordPress Tutor LMS <2.0.10 - Cross Site Scripting	tutor lms	6.1 (v3.1)	Medium
CVE-2023-0334	ShortPixel Adaptive Images < 3.6.3 - Cross Site Scripting	shortpixel adaptive images	6.1 (v3.1)	Medium
CVE-2023-0527	Online Security Guards Hiring System - Cross-Site Scripting	online security guards hiring system	6.1 (v3.1)	Medium
CVE-2023-0676	phpIPAM 1.5.1 - Cross-site Scripting	phpipam	6.1 (v3.1)	Medium
CVE-2023-1119	WP-Optimize WordPress plugin < 3.2.13 - Cross-Site Scripting	wp-optimize,srbtranslatin	6.1 (v3.1)	Medium
CVE-2023-1880	Phpmyfaq v3.1.11 - Cross-Site Scripting	phpmyfaq	6.1 (v3.1)	Medium
CVE-2023-2309	wpForo Forum <= 2.1.8 - Cross-Site Scripting	wpforo forum	6.1 (v3.1)	Medium
CVE-2023-23161	Art Gallery Management System Project v1.0 - Cross-Site Scripting	art gallery management system	6.1 (v3.1)	Medium
CVE-2023-24278	Squidex <7.4.0 - Cross-Site Scripting	squidex	6.1 (v3.1)	Medium
CVE-2023-24657	phpIPAM - 1.6 - Cross-Site Scripting	phpipam	6.1 (v3.1)	Medium
CVE-2023-25346	ChurchCRM 4.5.3 - Cross-Site Scripting	churchcrm	6.1 (v3.1)	Medium
CVE-2023-2813	Wordpress Multiple Themes - Reflected Cross-Site Scripting	connections reloaded	6.1 (v3.1)	Medium
CVE-2023-2822	Ellucian Ethos Identity CAS - Cross-Site Scripting	ethos identity	6.1 (v3.1)	Medium
CVE-2023-2949	OpenEMR < 7.0.1 - Cross-site Scripting	openemr	6.1 (v3.1)	Medium
CVE-2023-30210	OURPHP <= 7.2.0 - Cross Site Scripting	ourphp	6.1 (v3.1)	Medium
CVE-2023-30212	OURPHP <= 7.2.0 - Cross Site Scripting	ourphp	6.1 (v3.1)	Medium
CVE-2023-30256	Webkul QloApps 1.5.2 - Cross-site Scripting	qloapps	6.1 (v3.1)	Medium
CVE-2023-34599	Gibbon v25.0.0 - Cross-Site Scripting	gibbon	6.1 (v3.1)	Medium
CVE-2023-3479	Hestiacp <= 1.7.7 - Cross-Site Scripting	control panel	6.1 (v3.1)	Medium
CVE-2023-35155	XWiki - Cross-Site Scripting	xwiki	6.1 (v3.1)	Medium
CVE-2023-3521	FOSSBilling < 0.5.3 - Cross-Site Scripting	fossbilling	6.1 (v3.1)	Medium
CVE-2023-36289	Webkul QloApps 1.6.0 - Cross-site Scripting	qloapps	6.1 (v3.1)	Medium
CVE-2023-36306	Adiscon LogAnalyzer v.4.1.13 - Cross-Site Scripting	loganalyzer	6.1 (v3.1)	Medium
CVE-2023-36346	POS Codekop v2.0 - Cross Site Scripting	codekop	6.1 (v3.1)	Medium
CVE-2023-37580	Zimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site Scripting	zimbra	6.1 (v3.1)	Medium
CVE-2023-37728	IceWarp Webmail Server v10.2.1 - Cross Site Scripting	icewarp	6.1 (v3.1)	Medium
CVE-2023-38040	Revive Adserver 5.4.1 - Cross-Site Scripting	revive adserver	6.1 (v3.1)	Medium
CVE-2023-38194	SuperWebMailer - Cross-Site Scripting	superwebmailer	6.1 (v3.1)	Medium
CVE-2023-38501	CopyParty v1.8.6 - Cross Site Scripting	copyparty	6.1 (v3.1)	Medium
CVE-2023-38875	PHP Login System 2.0.1 - Cross-Site Scripting	php-login-system	6.1 (v3.1)	Medium
CVE-2023-39598	IceWarp Email Client - Cross Site Scripting	webclient	6.1 (v3.1)	Medium
CVE-2023-39600	IceWarp 11.4.6.0 - Cross-Site Scripting	icewarp	6.1 (v3.1)	Medium
CVE-2023-39700	IceWarp Mail Server v10.4.5 - Cross-Site Scripting	mail server	6.1 (v3.1)	Medium
CVE-2023-40750	PHPJabbers Yacht Listing Script v1.0 - Cross-Site Scripting	yacht listing script	6.1 (v3.1)	Medium
CVE-2023-40751	PHPJabbers Fundraising Script v1.0 - Cross-Site Scripting	fundraising script	6.1 (v3.1)	Medium
CVE-2023-40752	PHPJabbers Make an Offer Widget v1.0 - Cross-Site Scripting	make an offer widget	6.1 (v3.1)	Medium
CVE-2023-4110	PHPJabbers Availability Booking Calendar 5.0 - Cross-Site Scripting	availability booking calendar	6.1 (v3.1)	Medium
CVE-2023-4111	PHPJabbers Bus Reservation System 1.1 - Cross-Site Scripting	bus reservation system	6.1 (v3.1)	Medium
CVE-2023-4113	PHPJabbers Service Booking Script 1.0 - Cross Site Scripting	service booking script	6.1 (v3.1)	Medium
CVE-2023-4114	PHP Jabbers Night Club Booking 1.0 - Cross Site Scripting	night club booking software	6.1 (v3.1)	Medium
CVE-2023-4115	PHPJabbers Cleaning Business 1.0 - Cross-Site Scripting	cleaning business software	6.1 (v3.1)	Medium
CVE-2023-4116	PHPJabbers Taxi Booking 2.0 - Cross Site Scripting	taxi booking script	6.1 (v3.1)	Medium
CVE-2023-4136	CrafterCMS Engine - Cross-Site Scripting	craftercms	6.1 (v3.1)	Medium
CVE-2023-41538	PHPJabbers PHP Forum Script 3.0 - Cross-Site Scripting	php forum script	6.1 (v3.1)	Medium
CVE-2023-42343	OpenCMS - Cross-Site Scripting	opencms	6.1 (v3.1)	Medium
CVE-2023-44012	mojoPortal v.2.7.0.0 - Cross-Site Scripting	mojoportal	6.1 (v3.1)	Medium
CVE-2023-4547	SPA-Cart eCommerce CMS 1.9.0.3 - Cross-Site Scripting	ecommerce cms	6.1 (v3.1)	Medium
CVE-2023-46020	Blood Bank v1.0 - Stored Cross Site Scripting (XSS)	blood bank	6.1 (v3.1)	Medium
CVE-2023-46732	XWiki < 14.10.14 - Cross-Site Scripting	xwiki	6.1 (v3.1)	Medium
CVE-2023-48728	WWBN AVideo 11.6 - Cross-Site Scripting	avideo	6.1 (v3.1)	Medium
CVE-2023-49494	DedeCMS v5.7.111 - Cross-Site Scripting	dedecms	6.1 (v3.1)	Medium
CVE-2023-5758	firefox mobile Cross-Site Scripting Vulnerability	firefox mobile	6.1 (v3.1)	Medium
CVE-2023-6275	TOTVS Fluig Platform - Cross-Site Scripting	fluig	6.1 (v3.1)	Medium
CVE-2023-6379	OpenCMS 14 & 15 - Cross Site Scripting	opencms	6.1 (v3.1)	Medium
CVE-2024-13853	WordPress SEO Tools Plugin 4.0.7 - Cross-Site Scripting	seo-automatic-seo-tools	6.1 (v3.1)	Medium
CVE-2024-24494	Daily Habit Tracker 1.0 - Stored Cross-Site Scripting (XSS)	daily habit tracker	6.1 (v3.1)	Medium
CVE-2024-28734	Coda v.2024Q1 - Cross-Site Scripting	Unit4 Financials by Coda prior to 2023Q4	6.1 (v3.1)	Medium
CVE-2024-3231	Popup4Phone <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting	popup4phone	6.1 (v3.1)	Medium
CVE-2024-35693	WordPress 12 Step Meeting List Plugin <= 3.14.33 - Cross-Site Scripting	12 step meeting list	6.1 (v3.1)	Medium
CVE-2024-37259	WP Extended < 3.0.0 - Stored Cross-Site Scripting	wp extended	6.1 (v3.1)	Medium
CVE-2024-41810	Twisted - Open Redirect & XSS	twisted	6.1 (v3.1)	Medium
CVE-2024-55218	IceWarp Server 10.2.1 - Cross-Site Scripting	mail server	6.1 (v3.1)	Medium
CVE-2025-25296	Label Studio < 1.16.0 - Cross-Site Scripting	label studio	6.1 (v3.1)	Medium
CVE-2025-2609	MagnusBilling Login Logs - Cross-Site Scripting	magnusbilling	6.1 (v3.1)	Medium
CVE-2025-46349	YesWiki Reflected XSS via File Upload	yeswiki	6.1 (v3.1)	Medium
CVE-2025-4652	Broadstreet WordPress plugin - Reflected XSS	broadstreet	6.1 (v3.1)	Medium
CVE-2025-46550	YesWiki < 4.5.4 - Cross-Site Scripting	yeswiki	6.1 (v3.1)	Medium
CVE-2025-47204	Bootstrap Multiselect <= 1.1.2 - Cross-Site Scripting	bootstrap multiselect	6.1 (v3.1)	Medium
CVE-2025-48954	Discourse OAuth Social Login - Cross-site Scripting	discourse	6.1 (v3.1)	Medium
CVE-2025-51501	Microweber CMS2.0 - Cross-Site Scripting	microweber	6.1 (v3.1)	Medium
CVE-2025-5301	ONLYOFFICE Docs (DocumentServer) - Reflected Cross-Site Scripting	Docs (DocumentServer)	6.1 (v3.1)	Medium
CVE-2025-54589	Copyparty <=1.18.6 - Cross-Site Scripting	copyparty	6.1 (v3.1)	Medium
CVE-2025-63607	TechStore 1.0 Cross-Site Scripting Vulnerability	-	6.1 (v3.1)	Medium
CVE-2026-0594	WordPress List Site Contributors < 1.1.8 - Reflected XSS	List Site Contributors	6.1 (v3.1)	Medium
CVE-2026-11588	EONSR AEO Agent <= 3.7.9 - Unauthenticated Stored XSS via Scheduled Post Creation	EONSR AEO Agent	6.1 (v3.1)	Medium
CVE-2026-11881	Fluent Forms < 6.2.6 - Contributor+ Stored XSS via Date/Time Field	Fluent Forms	6.1 (v3.1)	Medium
CVE-2026-13330	Animation Addons for Elementor < 2.7.0 - Author+ Stored XSS via SVG Upload	Animation Addons for Elementor	6.1 (v3.1)	Medium
CVE-2026-13400	Simply Schedule Appointments < 1.6.12.4 - Unauthenticated Stored XSS via Booking Customer Information	Simply Schedule Appointments	6.1 (v3.1)	Medium
CVE-2026-17505	WordPress TranslatePress < 3.2.6 - Cross-Site Scripting	translatepress-multilingual	6.1 (v3.1)	Medium
CVE-2026-26028	CryptPad: Sanitizer Bypass in Diffmarked.js Allows Arbitrary HTML Injection and Potential XSS	cryptpad	6.1 (v3.1)	Medium
CVE-2026-3001	Gutenverse Plugin <= 3.4.6 - Cross-Site Scripting	gutenverse	6.1 (v3.1)	Medium
CVE-2026-30251	zenshare suite Cross-Site Scripting Vulnerability	zenshare suite	6.1 (v3.1)	Medium
CVE-2026-34206	Captcha Protect: Reflected XSS in challenge page via unsanitized destination rendered with text/template	captcha protect	6.1 (v3.1)	Medium
CVE-2026-34229	Emlog: Stored XSS in Comment Module via URI Scheme Validation Bypass	emlog	6.1 (v3.1)	Medium
CVE-2026-34739	AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php	avideo	6.1 (v3.1)	Medium
CVE-2026-36324	SourceCodester Doctor Appointment System 1.0 Cross-Site Scripting Vulnerability	-	6.1 (v3.1)	Medium
CVE-2026-37750	School Management System by mahmoudai1 Cross-Site Scripting Vulnerability	School Management System by mahmoudai1	6.1 (v3.1)	Medium
CVE-2026-38432	erpnext Cross-Site Scripting Vulnerability	erpnext	6.1 (v3.1)	Medium
CVE-2026-38446	Cross-Site Scripting	-	6.1 (v3.1)	Medium
CVE-2026-38472	forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 Cross-Site Scripting Vulnerability	forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449	6.1 (v3.1)	Medium
CVE-2026-41580	Stirling-PDF: Reflected XSS through crafted PDF metadata fields (Title and Author)	stirling pdf	6.1 (v3.1)	Medium
CVE-2026-50229	Apache Tomcat - Cross-Site Scripting	tomcat	6.1 (v3.1)	Medium
CVE-2026-51565	Modules/Docs/DocsController.php in Milk admin <=0.9.8 Cross-Site Scripting Vulnerability	Modules/Docs/DocsController.php in Milk admin <=0.9.8	6.1 (v3.1)	Medium
CVE-2026-52232	FS Inc S3150-8T2F Switch 2.2.0D Build 118101 Cross-Site Scripting Vulnerability	FS Inc S3150-8T2F Switch 2.2.0D Build 118101	6.1 (v3.1)	Medium
CVE-2026-52475	aiflowy <= 2.1.2 Cross-Site Scripting Vulnerability	aiflowy <= 2.1.2	6.1 (v3.1)	Medium
CVE-2026-52774	YesWiki Bazar Widget - Reflected XSS via 'id' Parameter	yeswiki	6.1 (v3.1)	Medium
CVE-2026-55087	Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (ope	etherpad	6.1 (v3.1)	Medium
CVE-2026-61526	AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler	http-server	6.1 (v3.1)	Medium
CVE-2026-73084	Activepieces: Reflected Cross-Site Scripting in OAuth Redirect Endpoint	activepieces	6.1 (v3.1)	Medium
CVE-2026-75170	the HubCore platform (version 14.1.1) Cross-Site Scripting Vulnerability	the HubCore platform (version 14.1.1)	6.1 (v3.1)	Medium
CVE-2026-75307	zhitan-ems 1.0.0 Cross-Site Scripting Vulnerability	-	6.1 (v3.1)	Medium
CVE-2026-78742	Silverpeas Core <=6.4.6 Cross-Site Scripting Vulnerability	-	6.1 (v3.1)	Medium
CVE-2026-8447	Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untruste	langflow	6.1 (v3.1)	Medium
CVE-2023-6717	Keycloak: xss via assertion consumer service url in saml post-binding flow	Red Hat AMQ Broker 7	6.0 (v3.1)	Medium
CVE-2026-8245	Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection	concrete cms	6.0 (v4.0)	Medium
CVE-2026-84193	LibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP	librenms	5.8 (v4.0)	Medium
CVE-2026-5827	code-projects Simple IT Discussion Forum question-function.php sql injection	Simple IT Discussion Forum	5.5 (v4.0)	Medium
CVE-2016-10993	ScoreMe Theme - Cross-Site Scripting	scoreme	5.4 (v3.1)	Medium
CVE-2016-9316	Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities	interscan web security virtual appliance	5.4 (v3.0)	Medium
CVE-2017-3131	Fortinet FortiOS < 5.6.0 - Cross-Site Scripting	fortios	5.4 (v3.0)	Medium
CVE-2018-15917	Jorani Leave Management System 0.6.5 - Cross-Site Scripting	jorani	5.4 (v3.0)	Medium
CVE-2018-16736	Roundcube rcfilters plugin 2.1.6 - Cross-Site Scripting	rcfilters	5.4 (v3.0)	Medium
CVE-2018-6226	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	5.4 (v3.0)	Medium
CVE-2018-6227	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	5.4 (v3.0)	Medium
CVE-2019-9556	Fiberhome AN5506-04-F RP2669 - Persistent Cross-Site Scripting	an5506-04-f firmware	5.4 (v3.1)	Medium
CVE-2020-12256	rConfig 3.9.4 - Cross-Site Scripting	rconfig	5.4 (v3.1)	Medium
CVE-2020-12259	rConfig 3.9.4 - Cross-Site Scripting	rconfig	5.4 (v3.1)	Medium
CVE-2020-12706	php-fusion 9.03.50 - Persistent Cross-Site Scripting	php-fusion	5.4 (v3.1)	Medium
CVE-2020-20988	DomainMOD 4.13.0 - Cross-Site Scripting	domainmod	5.4 (v3.1)	Medium
CVE-2020-27533	DedeCMS v.5.8 - keyword Cross-Site Scripting	dedecms	5.4 (v3.1)	Medium
CVE-2020-9467	Piwigo 2.10.1 - Cross Site Scripting	piwigo	5.4 (v3.1)	Medium
CVE-2021-31250	CHIYU TCP/IP Converter - Cross-Site Scripting	bf-430 firmware	5.4 (v3.1)	Medium
CVE-2021-35956	AKCP sensorProbe SPX476 - 'Multiple' Cross-Site Scripting (XSS)	sensorprobe2 firmware	5.4 (v3.1)	Medium
CVE-2022-0020	Palo Alto Cortex XSOAR 6.5.0 - Stored Cross-Site Scripting (XSS)	cortex xsoar	5.4 (v3.1)	Medium
CVE-2022-0378	Microweber Cross-Site Scripting	microweber	5.4 (v3.1)	Medium
CVE-2022-0928	Microweber < 1.2.12 - Stored Cross-Site Scripting	microweber	5.4 (v3.1)	Medium
CVE-2022-0954	Microweber <1.2.11 - Stored Cross-Site Scripting	microweber	5.4 (v3.1)	Medium
CVE-2022-25489	Atom CMS v2.0 - Cross-Site Scripting	atomcms	5.4 (v3.1)	Medium
CVE-2022-48178	X2CRM v6.6/6.9 - Stored Cross-Site Scripting (XSS) (Authenticated)	x2crm	5.4 (v3.1)	Medium
CVE-2023-26842	ChurchCRM 4.5.3 - Cross-Site Scripting	churchcrm	5.4 (v3.1)	Medium
CVE-2023-31548	ChurchCRM v4.5.3 - Cross-Site Scripting	churchcrm	5.4 (v3.1)	Medium
CVE-2023-34537	Hoteldruid 3.0.5 - Cross-Site Scripting	hoteldruid	5.4 (v3.1)	Medium
CVE-2023-5452	SnipeIT 6.2.1 - Stored Cross Site Scripting	snipe-it	5.4 (v3.1)	Medium
CVE-2024-33724	SOPlanning 1.52.00 Cross Site Scripting	soplanning	5.4 (v3.1)	Medium
CVE-2024-48120	X2CRM 8.5 - Stored Cross-Site Scripting (XSS)	x2crm	5.4 (v3.1)	Medium
CVE-2024-52762	Ganglia Web Interface (v3.7.3 - v3.7.6) - Cross-Site Scripting	ganglia-web	5.4 (v3.1)	Medium
CVE-2024-52763	Ganglia Web Interface (v3.7.3 - v3.7.5) - Cross-Site Scripting	ganglia-web	5.4 (v3.1)	Medium
CVE-2025-2610	MagnusBilling Alarm Module - Cross-Site Scripting	magnusbilling	5.4 (v3.1)	Medium
CVE-2026-11569	Quay: quay: stored xss via filedrop svg upload	Red Hat Quay 3	5.4 (v3.1)	Medium
CVE-2026-15245	BNE Testimonials < 2.0.8.2 - Contributor+ Stored XSS via Slider Shortcode	BNE Testimonials	5.4 (v3.1)	Medium
CVE-2026-16063	Event Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event Timeline Content	Event Booking Manager for WooCommerce	5.4 (v3.1)	Medium
CVE-2026-16537	Slick Slider < 0.5.3 - Contributor+ Stored XSS via Gallery Shortcode	Slick Slider	5.4 (v3.1)	Medium
CVE-2026-16558	YMC Filter < 3.12.8 - Contributor+ Stored XSS via Layout Builder Schema	YMC Filter	5.4 (v3.1)	Medium
CVE-2026-18395	Child Pages Card < 1.09 - Contributor+ Stored XSS via Shortcode Attributes	Child Pages Card	5.4 (v3.1)	Medium
CVE-2026-34848	hoppscotch: Stored XSS in team member overflow tooltip via display name	hoppscotch	5.4 (v3.1)	Medium
CVE-2026-35403	LORIS has potential cross-site scripting in survey_accounts module	loris	5.4 (v3.1)	Medium
CVE-2026-35455	immich has Stored XSS via OCR Text in 360° Panorama Viewer	immich	5.4 (v3.1)	Medium
CVE-2026-36392	FairSketch Rise CRM Version 3.9.6 Cross-Site Scripting Vulnerability	-	5.4 (v3.1)	Medium
CVE-2026-38473	the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 Cross-Site Scripting Vulnerability	the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449	5.4 (v3.1)	Medium
CVE-2026-39380	Open Source Point of Sale has Stored XSS in Stock Location (Configuration)	open source point of sale	5.4 (v3.1)	Medium
CVE-2026-39960	MantisBT is Vulnerable to Stored XSS through Custom Field Textarea Values	mantisbt	5.4 (v3.1)	Medium
CVE-2026-39964	TypeBot: Stored XSS via javascript: URI in text bubble links — bot author executes JS on visitors' browsers	typebot.io	5.4 (v3.1)	Medium
CVE-2026-45138	CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule	ci4ms	5.4 (v3.1)	Medium
CVE-2026-45580	WWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute	avideo	5.4 (v3.1)	Medium
CVE-2026-45694	LibreNMS: Reflected XSS in the Proxmox app view via unsanitized instance/vmid parameters	librenms	5.4 (v3.1)	Medium
CVE-2026-72570	cube-root directory-serve - Stored Cross-Site Scripting via Malicious Filename	directory-serve	5.4 (v3.1)	Medium
CVE-2026-72583	fastschema - Stored Cross-Site Scripting via MIME Type Bypass in File Upload	fastschema	5.4 (v3.1)	Medium
CVE-2026-82396	Sulu: Stored XSS via media download inline-disposition override	sulu	5.4 (v3.1)	Medium
CVE-2026-9278	Form Builder CP < 1.2.47 - Editor+ Stored XSS via form_structure	Form Builder CP	5.4 (v3.1)	Medium
CVE-2019-25731	Zuz Music 2.1 Persistent Cross-site Scripting via zuzconsole Contact	Zuz Music	5.3 (v4.0)	Medium
CVE-2023-30943	Moodle - Cross-Site Scripting/Remote Code Execution	moodle	5.3 (v3.1)	Medium
CVE-2024-11587	idcCMS V1.60 - Cross-Site Scripting	idccms	5.3 (v4.0)	Medium
CVE-2024-9007	123Solar 1.8.4.5 - Cross-Site Scripting	123solar	5.3 (v4.0)	Medium
CVE-2025-2127	JoomlaUX JUX Real Estate 3.4.0 - Reflected XSS	jux real estate	5.3 (v4.0)	Medium
CVE-2025-2709	Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting	ufida erp-nc	5.3 (v4.0)	Medium
CVE-2025-2710	Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting	ufida erp-nc	5.3 (v4.0)	Medium
CVE-2025-2711	Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting	ufida erp-nc	5.3 (v4.0)	Medium
CVE-2025-2712	Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting	ufida erp-nc	5.3 (v4.0)	Medium
CVE-2026-35208	lichess.org has an Unsanitized Stream Title Injection on /streamer	lila	5.3 (v4.0)	Medium
CVE-2026-41472	CyberPanel < 2.4.5 Stored XSS via AI Scanner Dashboard	cyberpanel	5.3 (v4.0)	Medium
CVE-2026-48094	ShareOpenly has Cross-Site Scripting (XSS) via Missing esc_url() on Shared URL in Content Output	shareopenly	5.3 (v4.0)	Medium
CVE-2026-5808	openstatusHQ openstatus Onboarding Endpoint client.tsx cross site scripting	openstatus	5.3 (v4.0)	Medium
CVE-2026-59232	Stored Cross-site Scripting in Prospero Flow CRM lead name field	Prospero Flow CRM	5.3 (v4.0)	Medium
CVE-2026-69116	FlyEnv < 4.18.0 Cross-Site Scripting via v-html	FlyEnv	5.3 (v4.0)	Medium
CVE-2026-73038	NodeBB < 4.15.0 Stored XSS via ActivityPub emoji tag.icon.url and tag.name	NodeBB	5.3 (v4.0)	Medium
CVE-2026-73422	Astro: Reflected XSS via unescaped View Transition animation properties	astro	5.3 (v4.0)	Medium
CVE-2026-73628	Serendipity 2.3.5 Reflected XSS via search clean-URL route	Serendipity	5.3 (v4.0)	Medium
CVE-2026-76837	Baserow before 2.3.0 Stored Cross-Site Scripting via Rich Text Mention Display Name	Baserow	5.3 (v4.0)	Medium
CVE-2026-82646	WWBN AVideo Unauthenticated Reflected XSS via url2Embed.json.php	AVideo	5.3 (v4.0)	Medium
CVE-2026-84191	LibreNMS before 26.5.0 Stored XSS via SNMP VRF fields	librenms	5.3 (v4.0)	Medium
CVE-2026-85158	AVideo Reflected XSS via videoEmbeded.php link parameter	AVideo	5.3 (v4.0)	Medium
CVE-2026-85159	AVideo Reflected XSS via cancelUri in userLogin.php	AVideo	5.3 (v4.0)	Medium
CVE-2026-85577	AVideo userLogin.php Reflected XSS via error parameter	AVideo	5.3 (v4.0)	Medium
CVE-2026-89240	WWBN AVideo Reflected XSS via confirmLivePassword.php	AVideo	5.3 (v4.0)	Medium
CVE-2026-89241	WWBN AVideo Reflected XSS via confirmLivePassword.php	AVideo	5.3 (v4.0)	Medium
CVE-2026-89244	WWBN AVideo Reflected XSS via Gallery Category getBackURL	AVideo	5.3 (v4.0)	Medium
CVE-2026-89247	WWBN AVideo XML Injection via plugin/AD_Server/VMAP.php	AVideo	5.3 (v4.0)	Medium
CVE-2018-25248	MyBB Downloads Plugin 2.0.3 Persistent XSS via downloads.php	mybb downloads	5.1 (v4.0)	Medium
CVE-2018-25349	userSpice 4.3.24 Cross-Site Scripting via X-Forwarded-For Header	userSpice	5.1 (v4.0)	Medium
CVE-2021-47931	Exponent CMS 2.6 Multiple Vulnerabilities Stored XSS Authentication	Exponent CMS	5.1 (v4.0)	Medium
CVE-2021-47947	Projectsend r1295 Stored Cross-Site Scripting via files-edit.php	Projectsend	5.1 (v4.0)	Medium
CVE-2022-50962	uBidAuction 2.0.1 myOrders Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2022-50963	uBidAuction 2.0.1 myAuctions active Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2022-50964	uBidAuction 2.0.1 myAuctions loose Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2022-50965	uBidAuction 2.0.1 posts manage Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2022-50966	uBidAuction 2.0.1 news manage Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2022-50968	uBidAuction 2.0.1 auctions manage Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2022-50969	uBidAuction 2.0.1 mailingLog manage Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2025-34032	Moodle LMS Jmol Plugin <= 6.1 - Cross-Site Scripting	jmol	5.1 (v4.0)	Medium
CVE-2025-41393	Ricoh Web Image Monitor - Reflected XSS	Multiple laser printers and MFPs which implement Web Image Monitor	5.1 (v4.0)	Medium
CVE-2025-71404	better-auth before 1.1.16 Reflected XSS via error parameter	better-auth	5.1 (v4.0)	Medium
CVE-2026-19434	Stored Cross-site Scripting in Pentestify finding severity field	Pentestify	5.1 (v4.0)	Medium
CVE-2026-19716	Stored Cross-site Scripting in Pentestify user account deletion via unescaped username	Pentestify	5.1 (v4.0)	Medium
CVE-2026-22675	OCS Inventory NG Server Stored XSS via User-Agent	ocs inventory server	5.1 (v4.0)	Medium
CVE-2026-25557	Evoluted PHP Directory Listing Script 4.0.5 Reflected XSS via dir parameter	PHP Directory Listing Script	5.1 (v4.0)	Medium
CVE-2026-27176	MajorDoMo - Cross-Site Scripting	majordomo	5.1 (v4.0)	Medium
CVE-2026-32856	Ellucian Banner Self-Service Reflected XSS via dateConverter	Banner Self-Service	5.1 (v4.0)	Medium
CVE-2026-34416	OSCAL-GUI Reflected XSS via project parameter in oscal.php	OSCAL-GUI	5.1 (v4.0)	Medium
CVE-2026-34417	OSCAL-GUI Reflected XSS via project parameter in oscal-forms.php	OSCAL-GUI	5.1 (v4.0)	Medium
CVE-2026-34798	Endian Firewall /cgi-bin/routing.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34799	Endian Firewall /manage/dnsmasq/hosts/ remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34800	Endian Firewall /cgi-bin/uplinkeditor.cgi NAME Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34801	Endian Firewall /manage/dhcp/fixed_leases/ remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34802	Endian Firewall /cgi-bin/salearn.cgi remark user ham spam Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34803	Endian Firewall /manage/qos/classes/ name Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34804	Endian Firewall /manage/qos/rules/ dscp Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34805	Endian Firewall /cgi-bin/dnat.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34806	Endian Firewall /cgi-bin/snat.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34807	Endian Firewall /cgi-bin/incoming.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34808	Endian Firewall /cgi-bin/outgoingfw.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34809	Endian Firewall /cgi-bin/zonefw.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34810	Endian Firewall /cgi-bin/vpnfw.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34811	Endian Firewall /cgi-bin/xtaccess.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34812	Endian Firewall /cgi-bin/proxypolicy.cgi mimetypes Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34813	Endian Firewall /cgi-bin/proxyuser.cgi user Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34814	Endian Firewall /cgi-bin/proxygroup.cgi group Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34815	Endian Firewall /cgi-bin/smtpdomains.cgi DOMAIN Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34816	Endian Firewall /manage/smtpscan/domainrouting/ domain Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34817	Endian Firewall /cgi-bin/smtprouting.cgi ADDRESS BCC Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34818	Endian Firewall /manage/dnsmasq/localdomains/ remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34819	Endian Firewall /cgi-bin/openvpnclient.cgi REMARK Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34820	Endian Firewall /manage/ipsec/ remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34821	Endian Firewall /manage/vpnauthentication/user/ remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34822	Endian Firewall /manage/ca/certificate/ new_cert_name Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34823	Endian Firewall /manage/password/web/ remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-35007	Open ISES Tickets < 3.44.2 Reflected XSS via single_unit.php id Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35008	Open ISES Tickets < 3.44.2 Reflected XSS via single.php ticket_id Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35009	Open ISES Tickets < 3.44.2 Reflected XSS via add_note.php ticket_id Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35010	Open ISES Tickets < 3.44.2 Reflected XSS via patient_JF.php ticket_id Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35011	Open ISES Tickets < 3.44.2 Reflected XSS via opena.php frm_call Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35012	Open ISES Tickets < 3.44.2 Reflected XSS via add_facnote.php ticket_id Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35014	Open ISES Tickets < 3.44.2 Reflected XSS via routes_nm.php ticket_id Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35015	Open ISES Tickets < 3.44.2 Reflected XSS via do_unit_mail.php the_ticket Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-40508	OpenEMR < 8.3.0 Stored XSS via Patient Portal Template Import Handler	openemr	5.1 (v4.0)	Medium
CVE-2026-42840	ERPNext 16.16.0 - Stored XSS in POS customer section via unescaped template literals	ERPNext	5.1 (v4.0)	Medium
CVE-2026-45551	Group-Office: Authenticated Stored XSS in Administrator Context via Arbitrary Cross-User Setting Write	groupoffice	5.1 (v4.0)	Medium
CVE-2026-47106	Ellucian Banner Self-Service Stored XSS via getFacultyMeetingTimes API	Banner Self-Service	5.1 (v4.0)	Medium
CVE-2026-48214	Open ISES Tickets < 3.44.2 Reflected XSS via add_nm.php ticket_id Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48215	Open ISES Tickets < 3.44.2 Reflected XSS via circle.php frm_id Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48218	Open ISES Tickets < 3.44.2 Reflected XSS via icons/buttons/landb.php frm_name and frm_id Parameters	Tickets	5.1 (v4.0)	Medium
CVE-2026-48219	Open ISES Tickets < 3.44.2 Reflected XSS via ics202.php frm_add_str Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48220	Open ISES Tickets < 3.44.2 Reflected XSS via ics205.php frm_add_str Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48221	Open ISES Tickets < 3.44.2 Reflected XSS via ics205a.php frm_add_str Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48222	Open ISES Tickets < 3.44.2 Reflected XSS via ics213.php frm_add_str Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48223	Open ISES Tickets < 3.44.2 Reflected XSS via ics213rr.php frm_add_str Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48224	Open ISES Tickets < 3.44.2 Reflected XSS via ics214.php frm_add_str Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48225	Open ISES Tickets < 3.44.2 Reflected XSS via landb.php _type Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48226	Open ISES Tickets < 3.44.2 Reflected XSS via os_watch.php ref and mode_orig Parameters	Tickets	5.1 (v4.0)	Medium
CVE-2026-48227	Open ISES Tickets < 3.44.2 Reflected XSS via patient.php id and ticket_id Parameters	Tickets	5.1 (v4.0)	Medium
CVE-2026-48228	Open ISES Tickets < 3.44.2 Reflected XSS via patient_w.php id and ticket_id Parameters	Tickets	5.1 (v4.0)	Medium
CVE-2026-48229	Open ISES Tickets < 3.44.2 Reflected XSS via routes_i.php ticket_id Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48530	GFI Archiver < 15.13 Stored XSS via CategorizationPolicyWizard.aspx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48531	GFI Archiver < 15.13 Stored XSS via RetentionPolicyWizard.aspx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48532	GFI Archiver < 15.13 Stored XSS via FAARetentionPolicyWizard.aspx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48534	GFI Archiver < 15.13 Stored XSS via ImapServerWizard.aspx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48535	GFI Archiver < 15.13 Stored XSS via CallHomeSettingsWizard.aspx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48536	GFI Archiver < 15.13 Stored XSS via GeneralSettingsWizard.aspx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48537	GFI Archiver < 15.13 Stored XSS via FileArchiveAssistantWizard.aspx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48538	GFI Archiver < 15.13 Stored XSS via ImportSettingsWizard.ashx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48539	GFI Archiver < 15.13 Stored XSS via MailInsights.aspx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48552	Nagios Core / XI DOM-based XSS via jsonquery.js	Nagios Core	5.1 (v4.0)	Medium
CVE-2026-48559	Lightweight Music Server 3.76.0 Stored XSS via Media File Metadata Tags	lms	5.1 (v4.0)	Medium
CVE-2026-50230	Lyrion Music Server <= 9.2.0 - Cross-Site Scripting	Lyrion Music Server	5.1 (v4.0)	Medium
CVE-2026-53992	Reflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date Parameters	ProjectSend	5.1 (v4.0)	Medium
CVE-2026-56126	pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php	pfSense Plus	5.1 (v4.0)	Medium
CVE-2026-57857	Flow Payment Plugin for WordPress Reflected Cross-Site Scripting via error_message Parameter	Flow Payment	5.1 (v4.0)	Medium
CVE-2026-64628	Grav Stored Cross-Site Scripting via Shortcode Attribute Handlers	grav	5.1 (v4.0)	Medium
CVE-2026-65697	Fathom Lite 1.3.1 Stored XSS via /collect Endpoint	fathom	5.1 (v4.0)	Medium
CVE-2026-67333	better-auth before 1.6.13 Stored XSS via javascript redirect_uri	better-auth	5.1 (v4.0)	Medium
CVE-2026-71503	Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template	dolibarr	5.1 (v4.0)	Medium
CVE-2026-72743	SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html	SQLBot	5.1 (v4.0)	Medium
CVE-2026-72747	AVideo Stored Cross-Site Scripting via Unauthenticated Registration	AVideo	5.1 (v4.0)	Medium
CVE-2026-72821	Grav Form Plugin before 9.1.15 Stored XSS via Radio Toggle	grav	5.1 (v4.0)	Medium
CVE-2026-73319	XenForo < 2.3.13 XSS via Dynamic Redirect Handler	xenforo	5.1 (v4.0)	Medium
CVE-2026-75831	Grav before 2.0.15 Stored XSS via audio/video source URL	grav	5.1 (v4.0)	Medium
CVE-2026-84477	AVideo Stored XSS via Live Schedule Title Description	AVideo	5.1 (v4.0)	Medium
CVE-2026-85593	phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode	phpMyFAQ	5.1 (v4.0)	Medium
CVE-2026-85600	Grav Admin before 2.0.21 Stored XSS via username	grav-plugin-admin2	5.1 (v4.0)	Medium
CVE-2026-86197	Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox	grav	5.1 (v4.0)	Medium
CVE-2012-5192	Bitweaver 2.8.1 - Multiple Vulnerabilities	bitweaver	5.0 (v2.0)	Medium
CVE-2015-4666	Xceedium Xsuite - Multiple Vulnerabilities	xsuite	5.0 (v2.0)	Medium
CVE-2017-14651	WSO2 Data Analytics Server 3.1.0 - Cross-Site Scripting	api manager	4.8 (v3.1)	Medium
CVE-2018-1000856	DomainMOD 4.11.01 - Cross-Site Scripting	domainmod	4.8 (v3.0)	Medium
CVE-2018-1186	Dell EMC Isilon OneFS - Multiple Vulnerabilities	emc isilon	4.8 (v3.0)	Medium
CVE-2018-1187	Dell EMC Isilon OneFS - Multiple Vulnerabilities	emc isilon	4.8 (v3.0)	Medium
CVE-2018-1188	Dell EMC Isilon OneFS - Multiple Vulnerabilities	emc isilon	4.8 (v3.0)	Medium
CVE-2018-1189	Dell EMC Isilon OneFS - Multiple Vulnerabilities	emc isilon	4.8 (v3.0)	Medium
CVE-2018-1201	Dell EMC Isilon OneFS - Multiple Vulnerabilities	emc isilon	4.8 (v3.0)	Medium
CVE-2018-1202	Dell EMC Isilon OneFS - Multiple Vulnerabilities	emc isilon	4.8 (v3.0)	Medium
CVE-2018-19749	DomainMOD 4.11.01 - Cross-Site Scripting	domainmod	4.8 (v3.0)	Medium
CVE-2018-19752	DomainMOD 4.11.01 - Cross-Site Scripting	domainmod	4.8 (v3.0)	Medium
CVE-2018-19914	DomainMOD 4.11.01 - Cross-Site Scripting	domainmod	4.8 (v3.0)	Medium
CVE-2018-19915	DomainMOD <=4.11.01 - Cross-Site Scripting	domainmod	4.8 (v3.0)	Medium
CVE-2018-20009	DomainMOD 4.11.01 - Cross-Site Scripting	domainmod	4.8 (v3.0)	Medium
CVE-2018-20010	DomainMOD 4.11.01 - Cross-Site Scripting	domainmod	4.8 (v3.0)	Medium
CVE-2018-20418	Craft CMS 3.0.25 - Cross-Site Scripting	craft cms	4.8 (v3.0)	Medium
CVE-2019-19742	D-Link DIR-615 Wireless Router - Persistent Cross-Site Scripting	dir-615 firmware	4.8 (v3.1)	Medium
CVE-2020-29240	LEPTON CMS 4.7.0 - 'URL' Persistent Cross-Site Scripting	leptoncms	4.8 (v3.1)	Medium
CVE-2021-46068	Vehicle Service Management System - Stored Cross-Site Scripting	vehicle service management system	4.8 (v3.1)	Medium
CVE-2021-46069	Vehicle Service Management System 1.0 - Stored Cross Site Scripting	vehicle service management system	4.8 (v3.1)	Medium
CVE-2021-46071	ehicle Service Management System 1.0 - Cross-Site Scripting	vehicle service management system	4.8 (v3.1)	Medium
CVE-2021-46072	Vehicle Service Management System 1.0 - Stored Cross Site Scripting	vehicle service management system	4.8 (v3.1)	Medium
CVE-2021-46073	Vehicle Service Management System 1.0 - Cross Site Scripting	vehicle service management system	4.8 (v3.1)	Medium
CVE-2023-0563	Bank Locker Management System - Cross-Site Scripting	bank locker management system	4.8 (v3.1)	Medium
CVE-2024-3822	Base64 Encoder/Decoder <= 0.9.2 - Reflected XSS	base64 encoderdecoder	4.8 (v3.1)	Medium
CVE-2024-50857	GestioIP - Reflected Cross-Site Scripting	gestioip	4.8 (v3.1)	Medium
CVE-2025-15669	Bit Form < 3.1.4 - Admin+ Stored XSS via Conversational Form Progress Label	Bit Form	4.8 (v3.1)	Medium
CVE-2026-26211	Ekushey Project Manager CRM 5.0 Stored XSS via System Name Field	Ekushey Project Manager CRM	4.8 (v4.0)	Medium
CVE-2026-39390	CI4MS has Stored XSS via srcdoc attribute bypass in Google Maps iframe setting	ci4ms	4.8 (v3.1)	Medium
CVE-2026-39392	CI4MS has Stored XSS in Pages Content Due to Missing html_purify Sanitization	ci4ms	4.8 (v3.1)	Medium
CVE-2026-67612	OpenEMR 8.2.0 Stored XSS via import_template.php Template Management	openemr	4.8 (v4.0)	Medium
CVE-2026-67617	Microweber CMS 2.0.20 Stored XSS via tag_names Parameter	microweber	4.8 (v4.0)	Medium
CVE-2026-70560	Ultimate POS Stored XSS via First Name Field in Leave Notifications	Ultimate POS (Stock Management & Point of Sale)	4.8 (v4.0)	Medium
CVE-2026-79663	Ech0 before 4.7.3 Stored XSS via RSS feed tag names	Ech0	4.8 (v4.0)	Medium
CVE-2026-79670	Ech0 before 4.4.3 Stored XSS via SVG Upload	Ech0	4.8 (v4.0)	Medium
CVE-2026-84188	librenms before 26.7.0 Stored XSS via graph_descr settings	librenms	4.8 (v4.0)	Medium
CVE-2024-24050	Workout Journal App 1.0 - Stored XSS	workout journal app	4.7 (v3.1)	Medium
CVE-2026-3093	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab	gitlab	4.7 (v3.1)	Medium
CVE-2026-16273	Narrative Publisher <= 1.0.7 - Contributor+ Stored XSS via narrative_post_script Post Meta	Narrative Publisher	4.6 (v3.1)	Medium
CVE-2026-53468	Typemill has Stored HTML Attribute Injection in Metadata Fields	typemill	4.6 (v3.1)	Medium
CVE-2026-75331	tamguo 1.5.3 Cross-Site Scripting Vulnerability	-	4.6 (v3.1)	Medium
CVE-2005-3128	SquirrelMail Address Add 1.4.2 - Cross-Site Scripting	address add plugin	4.3 (v2.0)	Medium
CVE-2005-4385	Cofax <=2.0RC3 - Cross-Site Scripting	cofax	4.3 (v2.0)	Medium
CVE-2008-2398	AppServ Open Project <=2.5.10 - Cross-Site Scripting	appserv	4.3 (v2.0)	Medium
CVE-2008-6982	Devalcms 1.4a - Cross-Site Scripting	devalcms	4.3 (v2.0)	Medium
CVE-2011-4624	GRAND FlAGallery 1.57 - Cross-Site Scripting	grand flagallery	4.3 (v2.0)	Medium
CVE-2011-5106	WordPress Plugin Flexible Custom Post Type < 0.1.7 - Cross-Site Scripting	flexible custom post type	4.3 (v2.0)	Medium
CVE-2011-5107	Alert Before Your Post <= 0.1.1 - Cross-Site Scripting	alert before you post	4.3 (v2.0)	Medium
CVE-2011-5265	Featurific For WordPress 1.6.2 - Cross-Site Scripting	featurific-for-wordpress	4.3 (v2.0)	Medium
CVE-2012-1835	WordPress Plugin All-in-One Event Calendar 1.4 - Cross-Site Scripting	all-in-one event calendar	4.3 (v2.0)	Medium
CVE-2012-2371	WP-FaceThumb 0.1 - Cross-Site Scripting	wp-facethumb	4.3 (v2.0)	Medium
CVE-2012-4273	2 Click Socialmedia Buttons < 0.34 - Cross-Site Scripting	2-click-social-media-buttons	4.3 (v2.0)	Medium
CVE-2012-4547	AWStats 6.95/7.0 - 'awredir.pl' Cross-Site Scripting	awstats	4.3 (v2.0)	Medium
CVE-2012-4768	WordPress Plugin Download Monitor < 3.3.5.9 - Cross-Site Scripting	download monitor	4.3 (v2.0)	Medium
CVE-2012-4889	ManageEngine Firewall Analyzer 7.2 - Cross-Site Scripting	firewall analyzer	4.3 (v2.0)	Medium
CVE-2012-5684	ZPanel 10.0.1 - Cross-Site Request Forgery / Cross-Site Scripting / SQL Injection / Password Reset	zpanel	4.3 (v2.0)	Medium
CVE-2012-5913	WordPress Integrator 1.32 - Cross-Site Scripting	wordpress integrator	4.3 (v2.0)	Medium
CVE-2013-2287	WordPress Plugin Uploader 1.0.4 - Cross-Site Scripting	uploader	4.3 (v2.0)	Medium
CVE-2013-3526	WordPress Plugin Traffic Analyzer - 'aoid' Cross-Site Scripting	trafficanalyzer	4.3 (v2.0)	Medium
CVE-2013-4117	WordPress Plugin Category Grid View Gallery 2.3.1 - Cross-Site Scripting	category-grid-view-gallery	4.3 (v2.0)	Medium
CVE-2013-4625	WordPress Plugin Duplicator < 0.4.5 - Cross-Site Scripting	duplicator	4.3 (v2.0)	Medium
CVE-2014-2908	Siemens SIMATIC S7-1200 CPU - Cross-Site Scripting	simatic s7 cpu 1200 firmware	4.3 (v2.0)	Medium
CVE-2014-3110	Honeywell XL Web Controller - Cross-Site Scripting	falcon xlweb linux controller	4.3 (v2.0)	Medium
CVE-2014-4513	ActiveHelper LiveHelp Server 3.1.0 - Cross-Site Scripting	activehelper livehelp live chat	4.3 (v2.0)	Medium
CVE-2014-9094	WordPress DZS-VideoGallery Plugin Cross-Site Scripting	video gallery	4.3 (v2.0)	Medium
CVE-2014-9444	Frontend Uploader <= 0.9.2 - Cross-Site Scripting	frontend uploader	4.3 (v2.0)	Medium
CVE-2015-1389	Aruba ClearPass Policy Manager - Persistent Cross-Site Scripting	clearpass policy manager	4.3 (v2.0)	Medium
CVE-2015-1880	Fortinet FortiOS <=5.2.3 - Cross-Site Scripting	fortios	4.3 (v2.0)	Medium
CVE-2015-2068	Magento Server Mass Importer - Cross-Site Scripting	magmi	4.3 (v2.0)	Medium
CVE-2015-2275	WoltLab Community Gallery - Persistent Cross-Site Scripting	community gallery	4.3 (v2.0)	Medium
CVE-2015-2807	Navis DocumentCloud <0.1.1 - Cross-Site Scripting	navis documentcloud	4.3 (v2.0)	Medium
CVE-2015-4127	WordPress Church Admin <0.810 - Cross-Site Scripting	church admin	4.3 (v2.0)	Medium
CVE-2015-4420	Opsview 4.6.2 - Multiple Cross-Site Scripting Vulnerabilities	opsview	4.3 (v2.0)	Medium
CVE-2015-4665	Xceedium Xsuite - Multiple Vulnerabilities	xsuite	4.3 (v2.0)	Medium
CVE-2015-6402	Cisco EPC 3928 - Multiple Vulnerabilities	epc3928 docsis 3.0 8x4 wireless residential gateway with embedded digital voice adapter	4.3 (v2.0)	Medium
CVE-2015-6920	WordPress sourceAFRICA <=0.1.3 - Cross-Site Scripting	sourceafrica	4.3 (v2.0)	Medium
CVE-2018-6225	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	4.3 (v3.0)	Medium
CVE-2020-7318	McAfee ePolicy Orchestrator <5.10.9 Update 9 - Cross-Site Scripting	epolicy orchestrator	4.3 (v3.1)	Medium
CVE-2024-34061	Changedetection.io <=v0.45.21 - Cross-Site Scripting	changedetection.io	4.3 (v3.1)	Medium
CVE-2026-12724	Kirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-password	Kirki	4.3 (v3.1)	Medium
CVE-2026-32250	NamelessMC has Reflected Cross-Site Scripting (XSS) in id parameter of /index.php?route=/queries/user/	Nameless	4.3 (v3.1)	Medium
CVE-2026-55566	Yamcs: DOM XSS in Extension Routing	yamcs	4.3 (v3.1)	Medium
CVE-2026-17011	Nexter Blocks < 5.0.2 - Contributor+ Stored CSS Injection	Nexter Blocks	3.8 (v3.1)	Low
CVE-2026-10827	Spectra (Ultimate Addons for Gutenberg) < 2.20.0 - Contributor+ Stored CSS Injection via Block Attributes	Spectra Legacy	3.5 (v3.1)	Low
CVE-2026-13393	ElementsKit Lite < 3.10.01 - Subsite Administrator+ Stored XSS via Megamenu Menu-Item Settings (Multisite)	ElementsKit Elementor Addons	3.5 (v3.1)	Low
CVE-2024-55550	Mitel MiCollab - Arbitary File Read	cmg suite	2.7 (v3.1)	Low
CVE-2025-0133	PAN-OS - Reflected Cross-Site Scripting	PAN-OS	2.7 (v4.0)	Low
CVE-2026-66300	SNOMED International Snowstorm reflected XSS	Snowstorm	2.3 (v4.0)	Low
CVE-2026-10153	westboy CicadasCMS AbstractCacheManager.java search cross site scripting	CicadasCMS	2.1 (v4.0)	Low
CVE-2026-10173	Orthanc Explorer 2 URL StudyList.vue cross site scripting	Explorer 2	2.1 (v4.0)	Low
CVE-2026-10289	code-projects Hotel and Tourism Reservation System tour.php cross site scripting	Hotel and Tourism Reservation System	2.1 (v4.0)	Low
CVE-2026-11436	Mage AI Sign-in Flow index.tsx useMutation cross site scripting	Mage AI	2.1 (v4.0)	Low
CVE-2026-11512	itsourcecode Hospital Management System billing.php cross site scripting	Hospital Management System	2.1 (v4.0)	Low
CVE-2026-11518	SourceCodester Inventory System User Management users.php cross site scripting	Inventory System	2.1 (v4.0)	Low
CVE-2026-16220	code-projects Online Examination System account.php cross site scripting	Online Examination System	2.1 (v4.0)	Low
CVE-2026-18968	ttttonyhe OBlog tags.php cross site scripting	OBlog	2.1 (v4.0)	Low
CVE-2026-19378	code-projects Task Management System CommentSave.php cross site scripting	Task Management System	2.1 (v4.0)	Low
CVE-2026-19998	code-projects Online Shopping System offersmail.php cross site scripting	Online Shopping System	2.1 (v4.0)	Low
CVE-2026-5825	code-projects Simple Laundry System delmemberinfo.php cross site scripting	Simple Laundry System	2.1 (v4.0)	Low
CVE-2026-5826	code-projects Simple IT Discussion Forum edit-category.php cross site scripting	Simple IT Discussion Forum	2.1 (v4.0)	Low
CVE-2026-59727	Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands	astro	2.1 (v4.0)	Low
CVE-2026-66882	Reflected XSS in AshAuthentication confirmation and magic link interaction forms	ash authentication	2.1 (v4.0)	Low
CVE-2026-78055	SourceCodester Class and Exam Timetabling System BSIT2.php cross site scripting	Class and Exam Timetabling System	2.1 (v4.0)	Low
CVE-2026-78059	SourceCodester Stock Management System printOrder.php cross site scripting	Stock Management System	2.1 (v4.0)	Low
CVE-2026-78060	SourceCodester Stock Management System getOrderReport.php cross site scripting	Stock Management System	2.1 (v4.0)	Low
CVE-2026-82601	SeaCMS err.php cross site scripting	SeaCMS	2.1 (v4.0)	Low
CVE-2026-82625	code-projects Simple Inventory System User Registration register.php cross site scripting	Simple Inventory System	2.1 (v4.0)	Low
CVE-2026-82664	yaojingang GEOFlow JSON-LD Theme HomeController.php cross site scripting	GEOFlow	2.1 (v4.0)	Low
CVE-2026-82700	code-projects Online Shopping System Newsletter Subscription offersmail.php cross site scripting	Online Shopping System	2.1 (v4.0)	Low
CVE-2026-85021	langgenius dify Splash Layout splash.tsx router.replace cross site scripting	dify	2.1 (v4.0)	Low
CVE-2026-85382	light0011 cms Chapter Content Output oneChapter.tpl htmlspecialchars_decode cross site scripting	cms	2.1 (v4.0)	Low
CVE-2026-86244	FastAdmin User Controller User.php login cross site scripting	FastAdmin	2.1 (v4.0)	Low
CVE-2026-86668	aircheng-org iWebShop-5 pic.php uploadFile cross site scripting	iWebShop-5	2.1 (v4.0)	Low
CVE-2026-9415	code-projects Employee Management System eloginwel.php cross site scripting	Employee Management System	2.1 (v4.0)	Low
CVE-2026-9416	code-projects Employee Management System myprofile.php cross site scripting	Employee Management System	2.1 (v4.0)	Low
CVE-2026-9417	code-projects Employee Management System myprofileup.php cross site scripting	Employee Management System	2.1 (v4.0)	Low
CVE-2026-9418	code-projects Employee Management System changepassemp.php cross site scripting	Employee Management System	2.1 (v4.0)	Low
CVE-2026-9419	code-projects Employee Management System empproject.php cross site scripting	Employee Management System	2.1 (v4.0)	Low
CVE-2026-9448	code-projects Employee Management System applyleave.php cross site scripting	Employee Management System	2.1 (v4.0)	Low
CVE-2026-9518	hemant6488 CodeIgniter-StudentManagementSystem Students Controller view_students.php addStudent cross site scripting	CodeIgniter-StudentManagementSystem	2.1 (v4.0)	Low
CVE-2026-9519	stonith404 pingvin-share Sign-in Auto-Redirect signIn.tsx getServerSideProps cross site scripting	pingvin-share	2.1 (v4.0)	Low
CVE-2026-9520	blitz-js blitz Sign-in LoginForm.tsx cross site scripting	blitz	2.1 (v4.0)	Low
CVE-2026-9566	teableio teable Sign-up LoginPage.tsx cross site scripting	teable	2.1 (v4.0)	Low
CVE-2026-10228	raisulislamg4 student_management_system_by_php admission_form_check.php cross site scripting	student management system by php	2.0 (v4.0)	Low
CVE-2026-10234	Mettle sendportal Campaign webview cross site scripting	sendportal	2.0 (v4.0)	Low
CVE-2026-10244	SourceCodester Pharmacy Sales and Inventory System main create_medicine_name cross site scripting	Pharmacy Sales and Inventory System	2.0 (v4.0)	Low
CVE-2026-10245	SourceCodester Pharmacy Sales and Inventory System main create_supplier cross site scripting	Pharmacy Sales and Inventory System	2.0 (v4.0)	Low
CVE-2026-10246	SourceCodester Pharmacy Sales and Inventory System main create_medicine_presentation cross site scripting	Pharmacy Sales and Inventory System	2.0 (v4.0)	Low
CVE-2026-10247	SourceCodester Pharmacy Sales and Inventory System main create_generic_name cross site scripting	Pharmacy Sales and Inventory System	2.0 (v4.0)	Low
CVE-2026-19922	code-projects Online Shopping System checkout.php cross site scripting	Online Shopping System	2.0 (v4.0)	Low
CVE-2026-5810	SourceCodester Sales and Inventory System GET Parameter delete.php cross site scripting	Sales and Inventory System	2.0 (v4.0)	Low
CVE-2026-7222	code-projects Coaching Management System Complaint Form complaint.php cross site scripting	Coaching Management System	2.0 (v4.0)	Low
CVE-2026-8139	Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName	concrete cms	2.0 (v4.0)	Low
CVE-2026-82483	coppermine-gallery Coppermine Photo Gallery Hidden Album Update Endpoint db_input.php cross site scripting	Coppermine Photo Gallery	2.0 (v4.0)	Low
CVE-2026-82488	Beetel 450TC3 User Management cross site scripting	450TC3	2.0 (v4.0)	Low
CVE-2026-82622	code-projects Employee Leave Managing System Employee Profile Update editaction.php cross site scripting	Employee Leave Managing System	2.0 (v4.0)	Low
CVE-2026-82665	yaojingang GEOFlow Image Library Cleanup ImageLibraryController.php unlink path traversal	GEOFlow	2.0 (v4.0)	Low
CVE-2026-82666	yaojingang GEOFlow Superadmin Theme Editor SiteThemeEditorController.php preview code injection	GEOFlow	2.0 (v4.0)	Low
CVE-2026-82667	yaojingang GEOFlow GenericHttpEndpointResolver.php DistributionController.isValidHttpEndpoint server-side request forger	GEOFlow	2.0 (v4.0)	Low
CVE-2026-84437	OpenCart Autocomplete Workflow address.php cross site scripting	OpenCart	2.0 (v4.0)	Low
CVE-2026-85022	langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting	dify	2.0 (v4.0)	Low
CVE-2026-85207	itsourcecode Online Medicine Delivery System index.php cross site scripting	Online Medicine Delivery System	2.0 (v4.0)	Low
CVE-2026-86181	code-projects Task Management System User Profile Update UpdateUserProfile.php cross site scripting	Task Management System	2.0 (v4.0)	Low
CVE-2026-86301	code-projects Hospital Information System Patient Management editPatient.php cross site scripting	Hospital Information System	2.0 (v4.0)	Low
CVE-2026-86644	star7th showdoc API Page Save Endpoint editormd.js cross site scripting	showdoc	2.0 (v4.0)	Low
CVE-2026-10112	sambitraj STUDENT-MANAGEMENT-SYSTEM Dashboard cross site scripting	STUDENT-MANAGEMENT-SYSTEM	1.9 (v4.0)	Low
CVE-2026-10529	westboy CicadasCMS Task Scheduling Management ScheduleJobController.java cross site scripting	CicadasCMS	1.9 (v4.0)	Low
CVE-2026-16205	Pluck CMS Albums albums.admin.php htmlspecialchars_decode cross site scripting	CMS	1.9 (v4.0)	Low
CVE-2026-19110	DataGear Chart Name HtmlTplDashboardWidgetHtmlRenderer.java HtmlTplDashboardWidgetHtmlRenderer cross site scripting	DataGear	1.9 (v4.0)	Low
CVE-2026-19207	PHPGurukul Company Visitor Management System manage-newvisitors.php cross site scripting	Company Visitor Management System	1.9 (v4.0)	Low
CVE-2026-78187	Piwigo Public Authentication cross site scripting	Piwigo	1.3 (v4.0)	Low
CVE-2026-78849	Netgate pfSense Plus software versions <= 26.03 pfSense CE software versions <= 2.8.1 Arbitrary Code Execution Vulnerability	Netgate pfSense Plus software versions <= 26.03 pfSense CE software versions <= 2.8.1	N/A	N/A

Observed CWEs

These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.

CWE	Related Published CVEs
CWE-20	CVE-2015-4664 , CVE-2026-54694 , CVE-2016-1328 , CVE-2016-1336
CWE-22	CVE-2025-61884 , CVE-2018-1204 , CVE-2012-5192 , CVE-2015-4666 , CVE-2024-55550 , CVE-2026-82665
CWE-73	CVE-2023-30943
CWE-74	CVE-2018-6220 , CVE-2021-31249 , CVE-2026-5827 , CVE-2026-82666
CWE-78	CVE-2018-6222
CWE-79	CVE-2025-44136 , CVE-2020-20982 , CVE-2021-32853 , CVE-2023-1892 , CVE-2026-54694 , CVE-2026-55085 , CVE-2026-73043 , CVE-2026-73044 , CVE-2026-73050 , CVE-2026-73052 , CVE-2026-73053 , CVE-2026-42849 , CVE-2026-57858 , CVE-2026-66394 , CVE-2026-66396 , CVE-2026-66418 , CVE-2026-74902 , CVE-2026-78997 , CVE-2026-88866 , CVE-2026-88867 , CVE-2026-88868 , CVE-2026-88869 , CVE-2026-89249 , CVE-2026-89253 , CVE-2026-89254 , CVE-2026-89255 , CVE-2026-89256 , CVE-2026-84189 , CVE-2026-89243 , CVE-2019-7671 , CVE-2023-34192 , CVE-2026-34448 , CVE-2026-42556 , CVE-2026-43984 , CVE-2026-12968 , CVE-2026-12496 , CVE-2026-15217 , CVE-2026-28445 , CVE-2026-44667 , CVE-2026-44669 , CVE-2026-44729 , CVE-2026-45115 , CVE-2026-45116 , CVE-2026-45270 , CVE-2026-46518 , CVE-2026-47665 , CVE-2026-47743 , CVE-2026-48026 , CVE-2026-53758 , CVE-2026-54347 , CVE-2026-70492 , CVE-2025-66024 , CVE-2026-34463 , CVE-2026-49864 , CVE-2026-21618 , CVE-2026-34932 , CVE-2026-58113 , CVE-2026-64851 , CVE-2026-65986 , CVE-2026-5385 , CVE-2026-77072 , CVE-2026-77850 , CVE-2026-85613 , CVE-2026-87814 , CVE-2024-5420 , CVE-2026-34725 , CVE-2026-56670 , CVE-2026-33437 , CVE-2026-39344 , CVE-2026-48060 , CVE-2026-50758 , CVE-2026-16969 , CVE-2026-18360 , CVE-2026-18361 , CVE-2026-44657 , CVE-2026-7460 , CVE-2026-87812 , CVE-2026-30819 , CVE-2026-6735 , CVE-2026-8203 , CVE-2026-16809 , CVE-2026-18756 , CVE-2026-19914 , CVE-2022-35499 , CVE-2026-12970 , CVE-2026-34598 , CVE-2026-6858 , CVE-2026-84192 , CVE-2026-55746 , CVE-2026-58411 , CVE-2025-4388 , CVE-2025-4576 , CVE-2025-62613 , CVE-2026-39838 , CVE-2026-39936 , CVE-2026-40598 , CVE-2026-44651 , CVE-2026-59238 , CVE-2026-69092 , CVE-2026-86188 , CVE-2026-13605 , CVE-2026-14817 , CVE-2026-14833 , CVE-2026-15047 , CVE-2026-16559 , CVE-2026-33741 , CVE-2025-32430 , CVE-2026-24128 , CVE-2026-55549 , CVE-2026-78838 , CVE-2026-0737 , CVE-2026-3885 , CVE-2026-45797 , CVE-2026-50592 , CVE-2026-87870 , CVE-2026-43980 , CVE-2012-1260 , CVE-2012-1261 , CVE-2012-5193 , CVE-2014-4535 , CVE-2014-4536 , CVE-2014-4539 , CVE-2014-4544 , CVE-2014-4558 , CVE-2014-4561 , CVE-2014-4592 , CVE-2014-9607 , CVE-2015-6477 , CVE-2015-6544 , CVE-2015-8349 , CVE-2015-9414 , CVE-2016-1000126 , CVE-2016-1000127 , CVE-2016-1000128 , CVE-2016-1000129 , CVE-2016-1000130 , CVE-2016-1000131 , CVE-2016-1000132 , CVE-2016-1000133 , CVE-2016-1000134 , CVE-2016-1000135 , CVE-2016-1000136 , CVE-2016-1000137 , CVE-2016-1000138 , CVE-2016-1000139 , CVE-2016-1000141 , CVE-2016-1000142 , CVE-2016-1000143 , CVE-2016-1000146 , CVE-2016-1000148 , CVE-2016-1000153 , CVE-2016-1000154 , CVE-2016-7981 , CVE-2016-8527 , CVE-2017-11107 , CVE-2017-11629 , CVE-2017-12794 , CVE-2017-17451 , CVE-2017-18536 , CVE-2017-3132 , CVE-2017-3133 , CVE-2017-6443 , CVE-2017-7855 , CVE-2017-9140 , CVE-2017-9288 , CVE-2018-10095 , CVE-2018-10230 , CVE-2018-10383 , CVE-2018-12998 , CVE-2018-14013 , CVE-2018-16139 , CVE-2018-17441 , CVE-2018-17443 , CVE-2018-19136 , CVE-2018-19137 , CVE-2018-19439 , CVE-2018-19933 , CVE-2018-20462 , CVE-2018-20503 , CVE-2018-6882 , CVE-2018-7196 , CVE-2018-7203 , CVE-2018-7653 , CVE-2018-9238 , CVE-2019-10475 , CVE-2019-10685 , CVE-2019-11507 , CVE-2019-12461 , CVE-2019-12935 , CVE-2019-14696 , CVE-2019-15501 , CVE-2019-15713 , CVE-2019-15811 , CVE-2019-15889 , CVE-2019-16332 , CVE-2019-16525 , CVE-2019-16931 , CVE-2019-19134 , CVE-2019-19908 , CVE-2019-20210 , CVE-2019-3402 , CVE-2019-3911 , CVE-2019-6112 , CVE-2019-7438 , CVE-2019-8390 , CVE-2019-8937 , CVE-2019-9553 , CVE-2020-1106 , CVE-2020-12054 , CVE-2020-14413 , CVE-2020-15500 , CVE-2020-15599 , CVE-2020-15718 , CVE-2020-17362 , CVE-2020-19283 , CVE-2020-23517 , CVE-2020-23814 , CVE-2020-24609 , CVE-2020-24701 , CVE-2020-27982 , CVE-2020-35416 , CVE-2020-3580 , CVE-2020-6171 , CVE-2020-7107 , CVE-2020-8191 , CVE-2020-8512 , CVE-2020-9344 , CVE-2021-20137 , CVE-2021-21799 , CVE-2021-21800 , CVE-2021-21801 , CVE-2021-21802 , CVE-2021-21803 , CVE-2021-24214 , CVE-2021-24235 , CVE-2021-24237 , CVE-2021-24245 , CVE-2021-24298 , CVE-2021-24316 , CVE-2021-24320 , CVE-2021-24335 , CVE-2021-24342 , CVE-2021-24387 , CVE-2021-24389 , CVE-2021-24435 , CVE-2021-24495 , CVE-2021-24498 , CVE-2021-24522 , CVE-2021-26247 , CVE-2021-26475 , CVE-2021-26702 , CVE-2021-26710 , CVE-2021-26947 , CVE-2021-27309 , CVE-2021-27310 , CVE-2021-27519 , CVE-2021-27520 , CVE-2021-27695 , CVE-2021-29625 , CVE-2021-30049 , CVE-2021-30203 , CVE-2021-30213 , CVE-2021-31537 , CVE-2021-31589 , CVE-2021-31682 , CVE-2021-31862 , CVE-2021-35488 , CVE-2021-36646 , CVE-2021-37416 , CVE-2021-37833 , CVE-2021-3831 , CVE-2021-38702 , CVE-2021-38704 , CVE-2021-40868 , CVE-2021-41467 , CVE-2021-41951 , CVE-2021-42565 , CVE-2021-42567 , CVE-2021-43062 , CVE-2021-43725 , CVE-2021-45422 , CVE-2021-45425 , CVE-2021-46387 , CVE-2022-0201 , CVE-2022-0208 , CVE-2022-0346 , CVE-2022-0678 , CVE-2022-0879 , CVE-2022-1168 , CVE-2022-1170 , CVE-2022-1221 , CVE-2022-2130 , CVE-2022-2174 , CVE-2022-22242 , CVE-2022-23397 , CVE-2022-24384 , CVE-2022-26564 , CVE-2022-2733 , CVE-2022-27926 , CVE-2022-28363 , CVE-2022-28508 , CVE-2022-29004 , CVE-2022-29005 , CVE-2022-30489 , CVE-2022-30777 , CVE-2022-30983 , CVE-2022-31470 , CVE-2022-32195 , CVE-2022-32770 , CVE-2022-32771 , CVE-2022-34093 , CVE-2022-34094 , CVE-2022-34305 , CVE-2022-34328 , CVE-2022-3484 , CVE-2022-35155 , CVE-2022-35493 , CVE-2022-3766 , CVE-2022-38295 , CVE-2022-38467 , CVE-2022-39195 , CVE-2022-41441 , CVE-2022-43016 , CVE-2022-43018 , CVE-2022-45836 , CVE-2022-46381 , CVE-2022-48012 , CVE-2022-48197 , CVE-2023-0527 , CVE-2023-0676 , CVE-2023-1880 , CVE-2023-23161 , CVE-2023-24278 , CVE-2023-24657 , CVE-2023-25346 , CVE-2023-2822 , CVE-2023-2949 , CVE-2023-30210 , CVE-2023-30212 , CVE-2023-30256 , CVE-2023-34599 , CVE-2023-3479 , CVE-2023-35155 , CVE-2023-3521 , CVE-2023-36289 , CVE-2023-36306 , CVE-2023-36346 , CVE-2023-37580 , CVE-2023-37728 , CVE-2023-38040 , CVE-2023-38194 , CVE-2023-38501 , CVE-2023-38875 , CVE-2023-39598 , CVE-2023-39600 , CVE-2023-39700 , CVE-2023-40750 , CVE-2023-40751 , CVE-2023-40752 , CVE-2023-4110 , CVE-2023-4111 , CVE-2023-4113 , CVE-2023-4114 , CVE-2023-4115 , CVE-2023-4116 , CVE-2023-4136 , CVE-2023-41538 , CVE-2023-42343 , CVE-2023-44012 , CVE-2023-4547 , CVE-2023-46020 , CVE-2023-46732 , CVE-2023-48728 , CVE-2023-49494 , CVE-2023-5758 , CVE-2023-6275 , CVE-2023-6379 , CVE-2024-13853 , CVE-2024-24494 , CVE-2024-28734 , CVE-2024-3231 , CVE-2024-35693 , CVE-2024-37259 , CVE-2024-41810 , CVE-2024-55218 , CVE-2025-25296 , CVE-2025-2609 , CVE-2025-46349 , CVE-2025-4652 , CVE-2025-46550 , CVE-2025-48954 , CVE-2025-51501 , CVE-2025-5301 , CVE-2025-54589 , CVE-2025-63607 , CVE-2026-0594 , CVE-2026-11588 , CVE-2026-11881 , CVE-2026-13330 , CVE-2026-13400 , CVE-2026-17505 , CVE-2026-26028 , CVE-2026-3001 , CVE-2026-30251 , CVE-2026-34206 , CVE-2026-34229 , CVE-2026-34739 , CVE-2026-36324 , CVE-2026-37750 , CVE-2026-38432 , CVE-2026-38446 , CVE-2026-38472 , CVE-2026-41580 , CVE-2026-51565 , CVE-2026-52232 , CVE-2026-52475 , CVE-2026-55087 , CVE-2026-61526 , CVE-2026-73084 , CVE-2026-75170 , CVE-2026-75307 , CVE-2026-78742 , CVE-2026-8447 , CVE-2023-6717 , CVE-2026-84193 , CVE-2016-10993 , CVE-2016-9316 , CVE-2017-3131 , CVE-2018-15917 , CVE-2018-16736 , CVE-2018-6226 , CVE-2018-6227 , CVE-2019-9556 , CVE-2020-12256 , CVE-2020-12259 , CVE-2020-12706 , CVE-2020-20988 , CVE-2020-27533 , CVE-2020-9467 , CVE-2021-31250 , CVE-2021-35956 , CVE-2022-0020 , CVE-2022-0378 , CVE-2022-0928 , CVE-2022-0954 , CVE-2022-25489 , CVE-2022-48178 , CVE-2023-26842 , CVE-2023-31548 , CVE-2023-34537 , CVE-2023-5452 , CVE-2024-33724 , CVE-2024-48120 , CVE-2024-52762 , CVE-2024-52763 , CVE-2025-2610 , CVE-2026-11569 , CVE-2026-15245 , CVE-2026-16063 , CVE-2026-16537 , CVE-2026-16558 , CVE-2026-18395 , CVE-2026-34848 , CVE-2026-35403 , CVE-2026-35455 , CVE-2026-36392 , CVE-2026-38473 , CVE-2026-39380 , CVE-2026-39960 , CVE-2026-39964 , CVE-2026-45138 , CVE-2026-45580 , CVE-2026-45694 , CVE-2026-72570 , CVE-2026-72583 , CVE-2026-82396 , CVE-2019-25731 , CVE-2024-11587 , CVE-2024-9007 , CVE-2025-2127 , CVE-2025-2709 , CVE-2025-2710 , CVE-2025-2711 , CVE-2025-2712 , CVE-2026-35208 , CVE-2026-41472 , CVE-2026-48094 , CVE-2026-5808 , CVE-2026-59232 , CVE-2026-69116 , CVE-2026-73038 , CVE-2026-73422 , CVE-2026-73628 , CVE-2026-76837 , CVE-2026-82646 , CVE-2026-84191 , CVE-2026-85158 , CVE-2026-85159 , CVE-2026-85577 , CVE-2026-89240 , CVE-2026-89241 , CVE-2026-89244 , CVE-2018-25248 , CVE-2018-25349 , CVE-2021-47931 , CVE-2021-47947 , CVE-2022-50962 , CVE-2022-50963 , CVE-2022-50964 , CVE-2022-50965 , CVE-2022-50966 , CVE-2022-50968 , CVE-2022-50969 , CVE-2025-34032 , CVE-2025-41393 , CVE-2025-71404 , CVE-2026-19434 , CVE-2026-19716 , CVE-2026-22675 , CVE-2026-25557 , CVE-2026-27176 , CVE-2026-32856 , CVE-2026-34416 , CVE-2026-34417 , CVE-2026-34798 , CVE-2026-34799 , CVE-2026-34800 , CVE-2026-34801 , CVE-2026-34802 , CVE-2026-34803 , CVE-2026-34804 , CVE-2026-34805 , CVE-2026-34806 , CVE-2026-34807 , CVE-2026-34808 , CVE-2026-34809 , CVE-2026-34810 , CVE-2026-34811 , CVE-2026-34812 , CVE-2026-34813 , CVE-2026-34814 , CVE-2026-34815 , CVE-2026-34816 , CVE-2026-34817 , CVE-2026-34818 , CVE-2026-34819 , CVE-2026-34820 , CVE-2026-34821 , CVE-2026-34822 , CVE-2026-34823 , CVE-2026-35007 , CVE-2026-35008 , CVE-2026-35009 , CVE-2026-35010 , CVE-2026-35011 , CVE-2026-35012 , CVE-2026-35014 , CVE-2026-35015 , CVE-2026-40508 , CVE-2026-42840 , CVE-2026-45551 , CVE-2026-47106 , CVE-2026-48214 , CVE-2026-48215 , CVE-2026-48218 , CVE-2026-48219 , CVE-2026-48220 , CVE-2026-48221 , CVE-2026-48222 , CVE-2026-48223 , CVE-2026-48224 , CVE-2026-48225 , CVE-2026-48226 , CVE-2026-48227 , CVE-2026-48228 , CVE-2026-48229 , CVE-2026-48530 , CVE-2026-48531 , CVE-2026-48532 , CVE-2026-48534 , CVE-2026-48535 , CVE-2026-48536 , CVE-2026-48537 , CVE-2026-48538 , CVE-2026-48539 , CVE-2026-48552 , CVE-2026-48559 , CVE-2026-50230 , CVE-2026-53992 , CVE-2026-56126 , CVE-2026-57857 , CVE-2026-64628 , CVE-2026-65697 , CVE-2026-67333 , CVE-2026-71503 , CVE-2026-72743 , CVE-2026-72747 , CVE-2026-72821 , CVE-2026-73319 , CVE-2026-75831 , CVE-2026-84477 , CVE-2026-85593 , CVE-2026-85600 , CVE-2026-86197 , CVE-2017-14651 , CVE-2018-1000856 , CVE-2018-1186 , CVE-2018-1187 , CVE-2018-1188 , CVE-2018-1189 , CVE-2018-1201 , CVE-2018-1202 , CVE-2018-19749 , CVE-2018-19752 , CVE-2018-19914 , CVE-2018-19915 , CVE-2018-20009 , CVE-2018-20010 , CVE-2018-20418 , CVE-2019-19742 , CVE-2020-29240 , CVE-2021-46068 , CVE-2021-46069 , CVE-2021-46071 , CVE-2021-46072 , CVE-2021-46073 , CVE-2023-0563 , CVE-2024-3822 , CVE-2024-50857 , CVE-2025-15669 , CVE-2026-26211 , CVE-2026-39390 , CVE-2026-39392 , CVE-2026-67612 , CVE-2026-67617 , CVE-2026-70560 , CVE-2026-79663 , CVE-2026-84188 , CVE-2024-24050 , CVE-2026-3093 , CVE-2026-16273 , CVE-2026-53468 , CVE-2008-2398 , CVE-2008-6982 , CVE-2011-4624 , CVE-2011-5106 , CVE-2011-5107 , CVE-2011-5265 , CVE-2012-1835 , CVE-2012-2371 , CVE-2012-4273 , CVE-2012-4547 , CVE-2012-4768 , CVE-2012-4889 , CVE-2012-5684 , CVE-2012-5913 , CVE-2013-2287 , CVE-2013-3526 , CVE-2013-4117 , CVE-2013-4625 , CVE-2014-2908 , CVE-2014-3110 , CVE-2014-4513 , CVE-2014-9094 , CVE-2014-9444 , CVE-2015-1389 , CVE-2015-1880 , CVE-2015-2068 , CVE-2015-2275 , CVE-2015-2807 , CVE-2015-4127 , CVE-2015-4420 , CVE-2015-4665 , CVE-2015-6402 , CVE-2015-6920 , CVE-2020-7318 , CVE-2024-34061 , CVE-2026-32250 , CVE-2026-55566 , CVE-2026-13393 , CVE-2025-0133 , CVE-2026-66300 , CVE-2026-10153 , CVE-2026-10173 , CVE-2026-10289 , CVE-2026-11436 , CVE-2026-11512 , CVE-2026-11518 , CVE-2026-16220 , CVE-2026-18968 , CVE-2026-19378 , CVE-2026-19998 , CVE-2026-5825 , CVE-2026-5826 , CVE-2026-59727 , CVE-2026-66882 , CVE-2026-78055 , CVE-2026-78059 , CVE-2026-78060 , CVE-2026-82601 , CVE-2026-82625 , CVE-2026-82664 , CVE-2026-82700 , CVE-2026-85021 , CVE-2026-85382 , CVE-2026-86244 , CVE-2026-86668 , CVE-2026-9415 , CVE-2026-9416 , CVE-2026-9417 , CVE-2026-9418 , CVE-2026-9419 , CVE-2026-9448 , CVE-2026-9518 , CVE-2026-9519 , CVE-2026-9520 , CVE-2026-9566 , CVE-2026-10228 , CVE-2026-10234 , CVE-2026-10244 , CVE-2026-10245 , CVE-2026-10246 , CVE-2026-10247 , CVE-2026-19922 , CVE-2026-5810 , CVE-2026-7222 , CVE-2026-8139 , CVE-2026-82483 , CVE-2026-82488 , CVE-2026-82622 , CVE-2026-84437 , CVE-2026-85022 , CVE-2026-85207 , CVE-2026-86181 , CVE-2026-86301 , CVE-2026-86644 , CVE-2026-10112 , CVE-2026-10529 , CVE-2026-16205 , CVE-2026-19110 , CVE-2026-19207 , CVE-2026-78187
CWE-80	CVE-2024-58355 , CVE-2026-39344 , CVE-2026-24128 , CVE-2026-40105 , CVE-2024-41810 , CVE-2025-54589 , CVE-2026-50229 , CVE-2026-52774
CWE-83	CVE-2026-8245 , CVE-2026-59727
CWE-87	CVE-2026-34598
CWE-89	CVE-2012-1259 , CVE-2018-6228 , CVE-2018-6229 , CVE-2022-29316 , CVE-2015-4669 , CVE-2012-5685 , CVE-2018-6230 , CVE-2026-5827
CWE-91	CVE-2026-89247
CWE-93	CVE-2025-61884
CWE-94	CVE-2026-34448 , CVE-2026-34725 , CVE-2026-73084 , CVE-2024-11587 , CVE-2025-2127 , CVE-2025-2709 , CVE-2025-2710 , CVE-2025-2711 , CVE-2025-2712 , CVE-2026-5808 , CVE-2026-10153 , CVE-2026-10173 , CVE-2026-10289 , CVE-2026-11436 , CVE-2026-11512 , CVE-2026-11518 , CVE-2026-16220 , CVE-2026-18968 , CVE-2026-19378 , CVE-2026-19998 , CVE-2026-5825 , CVE-2026-5826 , CVE-2026-78055 , CVE-2026-78059 , CVE-2026-78060 , CVE-2026-82601 , CVE-2026-82625 , CVE-2026-82664 , CVE-2026-82700 , CVE-2026-85021 , CVE-2026-85382 , CVE-2026-86244 , CVE-2026-86668 , CVE-2026-9415 , CVE-2026-9416 , CVE-2026-9417 , CVE-2026-9418 , CVE-2026-9419 , CVE-2026-9448 , CVE-2026-9518 , CVE-2026-9519 , CVE-2026-9520 , CVE-2026-9566 , CVE-2026-10228 , CVE-2026-10234 , CVE-2026-10244 , CVE-2026-10245 , CVE-2026-10246 , CVE-2026-10247 , CVE-2026-19922 , CVE-2026-5810 , CVE-2026-7222 , CVE-2026-82483 , CVE-2026-82488 , CVE-2026-82622 , CVE-2026-82666 , CVE-2026-84437 , CVE-2026-85022 , CVE-2026-85207 , CVE-2026-86181 , CVE-2026-86301 , CVE-2026-86644 , CVE-2026-10112 , CVE-2026-10529 , CVE-2026-16205 , CVE-2026-19110 , CVE-2026-19207 , CVE-2026-78187
CWE-116	CVE-2026-54694 , CVE-2026-12496 , CVE-2026-26028 , CVE-2026-35208 , CVE-2026-59727
CWE-183	CVE-2026-54694
CWE-200	CVE-2026-47743 , CVE-2016-1337 , CVE-2016-9314 , CVE-2018-8033
CWE-264	CVE-2016-9269 , CVE-2016-9315 , CVE-2016-1337
CWE-287	CVE-2015-6401 , CVE-2025-61884 , CVE-2012-1258
CWE-295	CVE-2018-6221 , CVE-2018-6219
CWE-306	CVE-2018-6223 , CVE-2026-41473
CWE-345	CVE-2026-12724 , CVE-2026-17011 , CVE-2026-10827
CWE-352	CVE-2018-11442 , CVE-2018-11445 , CVE-2018-1213 , CVE-2018-6224 , CVE-2025-56798 , CVE-2012-5683 , CVE-2025-47204
CWE-384	CVE-2022-31798
CWE-434	CVE-2018-17440 , CVE-2026-67688 , CVE-2018-17442 , CVE-2026-68899 , CVE-2026-65986 , CVE-2026-45797 , CVE-2026-79670 , CVE-2026-75331
CWE-444	CVE-2025-61884 , CVE-2026-55087
CWE-501	CVE-2025-61884
CWE-502	CVE-2019-10068
CWE-601	CVE-2015-4668 , CVE-2026-55087
CWE-610	CVE-2023-30943
CWE-611	CVE-2020-24589 , CVE-2016-8526 , CVE-2019-9757 , CVE-2018-6225
CWE-639	CVE-2026-47743 , CVE-2026-45551
CWE-640	CVE-2012-5686
CWE-665	CVE-2023-1719
CWE-693	CVE-2026-54694
CWE-732	CVE-2018-1203
CWE-798	CVE-2012-5686 , CVE-2015-4667
CWE-862	CVE-2026-46518
CWE-918	CVE-2025-61884 , CVE-2026-82667
CWE-1321	CVE-2021-20086

Atomicorp WAF Rule 341256

Rule Summary

Description

Selected Related CVEs

Observed CWEs