On this page
Atomicorp WAF Rule 341266
Rule Summary
- Rule ID: 341266
- Status: Active
- Alert message: Atomicorp.com WAF Rules: Possible Cross Site Scripting
- Observed CWEs: CWE-22 (2), CWE-74 (2), CWE-79 (741), CWE-80 (7), CWE-83 (2), CWE-87 (1), CWE-89 (1), CWE-94 (65), CWE-116 (3), CWE-200 (1), CWE-287 (1), CWE-352 (3), CWE-425 (1), CWE-444 (1), CWE-601 (1), CWE-918 (1)
- Revision: 23
- Rule severity: Critical (2)
- Phase: 1 (request headers)
- Request surfaces: Request URI
- Rule action: deny
- HTTP status: 403
- Logging: log, auditlog
Description
This rule detects behavior identified by its current alert as “Possible Cross Site Scripting” in the request URI. It evaluates during the request headers phase and denies matching traffic with HTTP status 403.
Selected Related CVEs
This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.
| CVE | Vulnerability | Product | CVSS | Severity |
|---|---|---|---|---|
| CVE-2012-1259 | Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities | scrutinizer netflow & sflow analyzer | 9.8 (v3.1) | Critical |
| CVE-2020-20982 | shadoweb wdja v1.5.1 - Cross-Site Scripting | wdja cms | 9.6 (v3.1) | Critical |
| CVE-2021-32853 | Erxes <0.23.0 - Cross-Site Scripting | erxes | 9.6 (v3.1) | Critical |
| CVE-2023-45136 | XWiki < 14.10.14 - Cross-Site Scripting | xwiki | 9.6 (v3.1) | Critical |
| CVE-2026-55085 | Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite | etherpad | 9.6 (v3.1) | Critical |
| CVE-2026-66395 | SiYuan Desktop before v3.7.2 Reflected XSS to RCE via siyuan Protocol | siyuan | 9.4 (v4.0) | Critical |
| CVE-2024-58355 | Cal.com through 4.7.15 Cross-Site Scripting via booking questions | cal.diy | 9.3 (v4.0) | Critical |
| CVE-2026-42849 | authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover | authentik | 9.3 (v3.1) | Critical |
| CVE-2026-45118 | MyBB: Contact page reflected XSS | mybb | 9.3 (v3.1) | Critical |
| CVE-2026-57858 | Cal.com Cal.diy 6.2.0 Stored XSS via BookingPageTagManager Analytics Tracking ID | Cal.com Self-Hosted (Cal.diy) | 9.3 (v4.0) | Critical |
| CVE-2026-66394 | SiYuan before v3.7.3 Stored and Reflected XSS via SVG Sanitizer Bypass | siyuan | 9.3 (v4.0) | Critical |
| CVE-2026-78997 | UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314) Cross-Site Scripting Vulnerability | UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314) | 9.3 (v3.1) | Critical |
| CVE-2026-88869 | AVideo AD_Server Stored XSS via log.php label parameter | AVideo | 9.3 (v4.0) | Critical |
| CVE-2026-89255 | AVideo LoginControl Stored XSS via PGP Public Key | AVideo | 9.3 (v4.0) | Critical |
| CVE-2023-34192 | Zimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site Scripting | collaboration | 9.0 (v3.1) | Critical |
| CVE-2026-34448 | SiYuan: Stored XSS in Attribute View gallery/kanban cover rendering allows arbitrary command execution in the desktop cl | siyuan | 9.0 (v3.1) | Critical |
| CVE-2026-42556 | Postiz stored XSS in public preview page | postiz | 9.0 (v3.1) | Critical |
| CVE-2026-43984 | Tautulli has stored XSS in logFile via guest-controlled log_js_errors input | Tautulli | 8.9 (v3.1) | High |
| CVE-2025-56798 | Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier Cross-Site Request Forgery Vulnerability | Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier | 8.8 (v3.1) | High |
| CVE-2026-42455 | LinkWarden: Stored XSS via Client-Side Archive Upload (Unsanitized HTML served from same origin) | linkwarden | 8.8 (v4.0) | High |
| CVE-2021-47795 | GeoVision GeoWebServer <= 5.3.3 - Local File Inclusion / Cross-Site Scripting | geowebserver | 8.7 (v4.0) | High |
| CVE-2026-12496 | Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server | LIP-ME20xC | 8.7 (v4.0) | High |
| CVE-2026-44667 | Faction: Stored XSS in Remediation Verification Attachment Filename Preview Rendering | faction | 8.7 (v3.1) | High |
| CVE-2026-44729 | Twenty: Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers) | twenty | 8.7 (v3.1) | High |
| CVE-2026-45115 | MyBB: Buddy/ignore list username XSS | mybb | 8.7 (v3.1) | High |
| CVE-2026-45116 | MyBB: Profile field type confusion XSS | mybb | 8.7 (v3.1) | High |
| CVE-2026-48026 | lakeFS vulnerable to stored XSS in rendered markdown previews via raw HTML | lakeFS | 8.7 (v3.1) | High |
| CVE-2026-48527 | HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint | haxcms-nodejs | 8.7 (v3.1) | High |
| CVE-2026-54347 | Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover | froxlor | 8.7 (v3.1) | High |
| CVE-2026-34463 | MantisBT has Stored HTML Injection/XSS via Clone Issue Form | mantisbt | 8.6 (v4.0) | High |
| CVE-2026-49864 | wetty vulnerable to DOM XSS via file-download filename | wetty | 8.6 (v4.0) | High |
| CVE-2026-67328 | @better-auth/sso before 1.6.21 Account Takeover via SSO | sso | 8.6 (v4.0) | High |
| CVE-2026-21618 | Cross-site scripting (XSS) in OAuth Device Authorization screen | hexpm | 8.5 (v4.0) | High |
| CVE-2026-58113 | Teamcenter V2412 Cross-site Scripting Vulnerability | Teamcenter V2412 | 8.5 (v4.0) | High |
| CVE-2026-63361 | LimeSurvey Community Edition 7.0.5+260623 - Reflected XSS in HTML editor popup | LimeSurvey | 8.5 (v4.0) | High |
| CVE-2026-5385 | GLPI 11.0.0 - Stored XSS in knowledge base | glpi | 8.4 (v4.0) | High |
| CVE-2026-77072 | n8n before 1.123.69 Stored XSS via Form Completion Page | n8n | 8.4 (v4.0) | High |
| CVE-2026-85613 | OpenPanel Unauthenticated XSS via SVG Favicon Proxy | openpanel | 8.4 (v4.0) | High |
| CVE-2026-87811 | SiYuan before v3.8.2 Stored XSS via notebook template paths | siyuan | 8.4 (v4.0) | High |
| CVE-2026-56670 | ComfyUI: Stored XSS via SVG file upload on the /view endpoint | ComfyUI | 8.2 (v3.1) | High |
| CVE-2026-63135 | YOURLS: Stored XSS in referrer statistics chart via crafted Referer header | YOURLS | 8.2 (v3.1) | High |
| CVE-2026-18147 | Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url | Red Hat Enterprise Linux 10 | 8.1 (v3.1) | High |
| CVE-2026-39344 | Reflected XSS the login page through the 'username' parameter | churchcrm | 8.1 (v3.0) | High |
| CVE-2026-48060 | Litestar: HTML Injection Through CSRF Token | litestar | 8.1 (v3.1) | High |
| CVE-2026-50758 | DayuanJiang next-ai-draw-io 0.4.13 Arbitrary Code Execution Vulnerability | DayuanJiang next-ai-draw-io 0.4.13 | 8.1 (v3.1) | High |
| CVE-2002-1131 | SquirrelMail 1.2.6/1.2.7 - Cross-Site Scripting | squirrelmail | 7.5 (v2.0) | High |
| CVE-2026-44657 | MantisBT: Stored XSS in File Download | mantisbt | 7.5 (v4.0) | High |
| CVE-2026-7460 | mailcow-dockerized 2026-03b - Stored XSS in Queue Manager via unescaped | mailcow-dockerized | 7.4 (v4.0) | High |
| CVE-2026-87812 | SiYuan before v3.8.2 Stored XSS via Bazaar iconURL | siyuan | 7.4 (v4.0) | High |
| CVE-2025-14340 | Payara Server - Cross-Site Scripting | Payara Server | 7.3 (v4.0) | High |
| CVE-2026-30819 | Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameter | iTop | 7.3 (v3.1) | High |
| CVE-2026-6735 | XSS within PHP-FPM status endpoint | php | 7.3 (v4.0) | High |
| CVE-2026-8203 | Concrete CMS 9.5.0 and below has Stored XSS on the height parameter | concrete cms | 7.3 (v4.0) | High |
| CVE-2022-2219 | Unyson < 2.7.27 - Cross Site Scripting | unyson | 7.2 (v3.1) | High |
| CVE-2026-18756 | HumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button rendering | HumHub | 7.2 (v4.0) | High |
| CVE-2026-4267 | Query Monitor <= 3.20.3 - Reflected Cross-Site Scripting via Request URI | Query Monitor | 7.2 (v3.1) | High |
| CVE-2022-35499 | In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint Cross-Site Scripting Vulnerability | - | 7.1 (v3.1) | High |
| CVE-2024-10152 | Simple Certain Time to Show Content - Cross-Site Scripting | simple certain time to show content | 7.1 (v3.1) | High |
| CVE-2024-12638 | Bulk Me Now! Plugin <= 2.0 - Cross-Site Scripting | bulk me now! | 7.1 (v3.1) | High |
| CVE-2024-12749 | WordPress Competition Form Plugin <= 2.0 - Cross-Site Scripting | competition form | 7.1 (v3.1) | High |
| CVE-2024-12878 | Lazy Blocks <= 3.8.2 - Cross-Site Scripting | lazy blocks | 7.1 (v3.1) | High |
| CVE-2024-13055 | Dyn Business Panel Plugin <= 1.0.0 - Cross-Site Scripting | dyn business panel | 7.1 (v3.1) | High |
| CVE-2024-13094 | WP Triggers Lite - Cross-Site Scripting | wp triggers lite | 7.1 (v3.1) | High |
| CVE-2024-13330 | JustRows WordPress - Cross-Site Scripting | justrows free | 7.1 (v3.1) | High |
| CVE-2024-13352 | Legull WordPress - Cross-Site Scripting | legull | 7.1 (v3.1) | High |
| CVE-2024-13569 | WordPress Front End Users - Reflected XSS | front end users | 7.1 (v3.1) | High |
| CVE-2024-13624 | WordPress WPMovieLibrary Plugin <= 2.1.4.8 - Cross-Site Scripting | wpmovielibrary | 7.1 (v3.1) | High |
| CVE-2024-13625 | Tube Video Ads Lite - Reflected XSS | tube video ads lite | 7.1 (v3.1) | High |
| CVE-2024-14015 | Studiocart <= 2.9.0 - Cross-Site Scripting | WordPress eCommerce Plugin | 7.1 (v3.1) | High |
| CVE-2026-12970 | LearnPress < 4.4.1 - Reflected XSS via c_search | LearnPress | 7.1 (v3.1) | High |
| CVE-2026-14234 | WOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRF | WOLF | 7.1 (v3.1) | High |
| CVE-2026-14239 | Tourmaster < 5.4.8 - Stored XSS via CSRF | tourmaster | 7.1 (v3.1) | High |
| CVE-2026-14870 | Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_id | Database for Contact Form 7, WPforms, Elementor forms | 7.1 (v3.1) | High |
| CVE-2026-34598 | YesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter" | yeswiki | 7.1 (v4.0) | High |
| CVE-2026-84192 | LibreNMS before 26.3.1 Stored XSS via SNMP/Syslog Data | librenms | 7.1 (v4.0) | High |
| CVE-2026-9833 | Tag Groups < 2.2.0 - Reflected XSS via 'tag_groups_task' Parameter | Tag Groups is the Advanced Way to Display Your Taxonomy Terms | 7.1 (v3.1) | High |
| CVE-2026-58411 | ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values | CRM | 7.0 (v4.0) | High |
| CVE-2018-3238 | Oracle Fusion Middleware WebCenter Sites 11.1.1.8.0 - Cross-Site Scripting | webcenter sites | 6.9 (v3.0) | Medium |
| CVE-2025-4576 | Liferay Portal & DXP - Cross-Site Scripting | digital experience platform | 6.9 (v4.0) | Medium |
| CVE-2026-39838 | ProofreadPage improperly sanitizes multiline styles using Sanitizer::checkCSS | MediaWiki - ProofreadPage Extension | 6.9 (v4.0) | Medium |
| CVE-2026-39936 | Stored XSS in Score due to usage of non-reserved data attributes | Mediawiki - Score Extension | 6.9 (v4.0) | Medium |
| CVE-2026-44651 | SillyTavern: Reflected XSS vulnerability in the CORS proxy middleware | SillyTavern | 6.9 (v4.0) | Medium |
| CVE-2026-69092 | Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpoint | admidio | 6.9 (v4.0) | Medium |
| CVE-2026-73848 | Emlog: Stored XSS via Tag Name in Article Editor | emlog | 6.9 (v4.0) | Medium |
| CVE-2026-86188 | AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting | AVideo | 6.9 (v4.0) | Medium |
| CVE-2004-0519 | SquirrelMail 1.4.x - Folder Name Cross-Site Scripting | propack | 6.8 (v2.0) | Medium |
| CVE-2007-0885 | Jira Rainbow.Zen - Cross-Site Scripting | rainbow.zen | 6.8 (v2.0) | Medium |
| CVE-2026-13605 | Photo Swipe <= 4.1.1.1 - Author+ Stored XSS via title Attribute | PhotoSwipe | 6.8 (v3.1) | Medium |
| CVE-2026-14817 | Element Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data Attributes | Element Pack Addons for Elementor | 6.8 (v3.1) | Medium |
| CVE-2026-14833 | Lightbox with PhotoSwipe < 5.9.0 - Author+ Stored XSS via data-lbwps-caption Attribute | Lightbox with PhotoSwipe | 6.8 (v3.1) | Medium |
| CVE-2026-15047 | s2Member < 260805 - Contributor+ Stored XSS via Shortcode | s2Member | 6.8 (v3.1) | Medium |
| CVE-2026-16069 | Brizy - Page Builder < 2.8.19 - Contributor+ Stored XSS via Featured Image Focal Point | Brizy | 6.8 (v3.1) | Medium |
| CVE-2026-33741 | EspoCRM: Stored XSS via SVG attachment loading same-origin JavaScript | espocrm | 6.8 (v3.1) | Medium |
| CVE-2012-1258 | Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities | scrutinizer netflow & sflow analyzer | 6.5 (v3.1) | Medium |
| CVE-2021-31249 | CHIYU TCP/IP Converter - Carriage Return Line Feed Injection | bf-430 firmware | 6.5 (v3.1) | Medium |
| CVE-2026-40105 | XWiki - Cross-Site Scripting | xwiki-platform | 6.5 (v4.0) | Medium |
| CVE-2026-55549 | Yamcs: Reflected XSS in the URL of the Authorize Endpoint | yamcs | 6.5 (v3.1) | Medium |
| CVE-2026-78838 | AppNitro MachForm v30 Cross-Site Scripting Vulnerability | AppNitro MachForm v30 | 6.5 (v3.1) | Medium |
| CVE-2026-0737 | Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode | WP Shortcodes Plugin — Shortcodes Ultimate | 6.4 (v3.1) | Medium |
| CVE-2026-0738 | Shortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode | WP Shortcodes Plugin — Shortcodes Ultimate | 6.4 (v3.1) | Medium |
| CVE-2026-3885 | WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_bo | Shortcodes Ultimate – Content Elements | 6.4 (v3.1) | Medium |
| CVE-2026-50592 | Znuny Cross-Site Scripting Vulnerability | Znuny | 6.4 (v3.1) | Medium |
| CVE-2026-87870 | Ninja Forms - Scheduled Exports <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Paramete | Ninja Forms - Scheduled Exports | 6.4 (v3.1) | Medium |
| CVE-2026-43980 | Malla: Stored XSS via Meshtastic node names in multiple frontend pages | malla | 6.3 (v3.1) | Medium |
| CVE-2011-4336 | Tiki Wiki CMS Groupware 7.0 Cross-Site Scripting | tikiwiki cms/groupware | 6.1 (v3.1) | Medium |
| CVE-2012-1260 | Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities | scrutinizer netflow & sflow analyzer | 6.1 (v3.1) | Medium |
| CVE-2012-1261 | Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities | scrutinizer netflow & sflow analyzer | 6.1 (v3.1) | Medium |
| CVE-2014-4535 | Import Legacy Media <= 0.1 - Cross-Site Scripting | import legacy media | 6.1 (v3.1) | Medium |
| CVE-2014-4536 | Infusionsoft Gravity Forms Add-on < 1.5.7 - Cross-Site Scripting | infusionsoft gravity forms | 6.1 (v3.1) | Medium |
| CVE-2014-4539 | Movies <= 0.6 - Cross-Site Scripting | movies | 6.1 (v3.1) | Medium |
| CVE-2014-4544 | Podcast Channels < 0.28 - Cross-Site Scripting | podcast channels | 6.1 (v3.1) | Medium |
| CVE-2014-4550 | Shortcode Ninja <= 1.4 - Cross-Site Scripting | ninja | 6.1 (v3.1) | Medium |
| CVE-2014-4558 | WooCommerce Swipe <= 2.7.1 - Cross-Site Scripting | swipehq-payment-gateway-woocommerce | 6.1 (v3.1) | Medium |
| CVE-2014-4561 | Ultimate Weather Plugin <= 1.0 - Cross-Site Scripting | ultimate-weather | 6.1 (v3.1) | Medium |
| CVE-2014-4592 | WP Planet <= 0.1 - Cross-Site Scripting | wp-planet | 6.1 (v3.1) | Medium |
| CVE-2014-9606 | Netsweeper 4.0.8 - Cross-Site Scripting | netsweeper | 6.1 (v3.1) | Medium |
| CVE-2014-9607 | Netsweeper 4.0.4 - Cross-Site Scripting | netsweeper | 6.1 (v3.1) | Medium |
| CVE-2014-9608 | Netsweeper 4.0.3 - Cross-Site Scripting | netsweeper | 6.1 (v3.1) | Medium |
| CVE-2014-9615 | Netsweeper 4.0.4 - Cross-Site Scripting | netsweeper | 6.1 (v3.1) | Medium |
| CVE-2015-6544 | Combodo iTop <2.2.0-2459 - Cross-Site Scripting | itop | 6.1 (v3.0) | Medium |
| CVE-2015-8349 | SourceBans <2.0 - Cross-Site Scripting | sourcebans | 6.1 (v3.0) | Medium |
| CVE-2015-8350 | WordPress Calls to Action <=2.4.3 - Authenticated Reflected XSS | call to action | 6.1 (v3.0) | Medium |
| CVE-2015-9414 | WordPress Symposium <=15.8.1 - Cross-Site Scripting | wp-symposium | 6.1 (v3.1) | Medium |
| CVE-2016-1000126 | WordPress Admin Font Editor <=1.8 - Cross-Site Scripting | admin-font-editor | 6.1 (v3.0) | Medium |
| CVE-2016-1000127 | WordPress AJAX Random Post <=2.00 - Cross-Site Scripting | ajax-random-post | 6.1 (v3.0) | Medium |
| CVE-2016-1000128 | WordPress anti-plagiarism <=3.60 - Cross-Site Scripting | anti-plagiarism | 6.1 (v3.0) | Medium |
| CVE-2016-1000129 | WordPress defa-online-image-protector <=3.3 - Cross-Site Scripting | defa-online-image-protector | 6.1 (v3.0) | Medium |
| CVE-2016-1000130 | WordPress e-search <=1.0 - Cross-Site Scripting | e-search | 6.1 (v3.0) | Medium |
| CVE-2016-1000131 | WordPress e-search <=1.0 - Cross-Site Scripting | esearch | 6.1 (v3.0) | Medium |
| CVE-2016-1000132 | WordPress enhanced-tooltipglossary 3.2.8 - Cross-Site Scripting | tooltip glossary | 6.1 (v3.0) | Medium |
| CVE-2016-1000133 | WordPress forget-about-shortcode-buttons 1.1.1 - Cross-Site Scripting | forget about shortcode buttons | 6.1 (v3.0) | Medium |
| CVE-2016-1000134 | WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting | hdw-tube | 6.1 (v3.0) | Medium |
| CVE-2016-1000135 | WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting | hdw-tube | 6.1 (v3.0) | Medium |
| CVE-2016-1000136 | WordPress heat-trackr 1.0 - Cross-Site Scripting | heat-trackr | 6.1 (v3.0) | Medium |
| CVE-2016-1000137 | WordPress Hero Maps Pro 2.1.0 - Cross-Site Scripting | hero-maps-pro | 6.1 (v3.0) | Medium |
| CVE-2016-1000138 | WordPress Admin Font Editor <=1.8 - Cross-Site Scripting | indexisto | 6.1 (v3.0) | Medium |
| CVE-2016-1000139 | WordPress Infusionsoft Gravity Forms <=1.5.11 - Cross-Site Scripting | infusionsoft | 6.1 (v3.0) | Medium |
| CVE-2016-1000140 | WordPress New Year Firework <=1.1.9 - Cross-Site Scripting | new-year-firework | 6.1 (v3.0) | Medium |
| CVE-2016-1000141 | WordPress Page Layout builder v1.9.3 - Cross-Site Scripting | page-layout-builder | 6.1 (v3.0) | Medium |
| CVE-2016-1000142 | WordPress MW Font Changer <=4.2.5 - Cross-Site Scripting | parsi-font | 6.1 (v3.0) | Medium |
| CVE-2016-1000143 | WordPress Photoxhibit 2.1.8 - Cross-Site Scripting | photoxhibit | 6.1 (v3.0) | Medium |
| CVE-2016-1000146 | WordPress Pondol Form to Mail <=1.1 - Cross-Site Scripting | pondol-formmail | 6.1 (v3.0) | Medium |
| CVE-2016-1000148 | WordPress S3 Video <=0.983 - Cross-Site Scripting | s3-video | 6.1 (v3.0) | Medium |
| CVE-2016-1000149 | WordPress Simpel Reserveren <=3.5.2 - Cross-Site Scripting | simpel-reserveren | 6.1 (v3.0) | Medium |
| CVE-2016-1000152 | WordPress Tidio-form <=1.0 - Cross-Site Scripting | tidio-form | 6.1 (v3.0) | Medium |
| CVE-2016-1000153 | WordPress Tidio Gallery <=1.1 - Cross-Site Scripting | tidio-gallery | 6.1 (v3.0) | Medium |
| CVE-2016-1000154 | WordPress WHIZZ <=1.0.7 - Cross-Site Scripting | whizz | 6.1 (v3.0) | Medium |
| CVE-2016-1000155 | WordPress WPSOLR <=8.6 - Cross-Site Scripting | wpsolr-search-engine | 6.1 (v3.0) | Medium |
| CVE-2016-7981 | SPIP <3.1.2 - Cross-Site Scripting | spip | 6.1 (v3.0) | Medium |
| CVE-2016-8527 | Aruba AirWave 8.2.3 - XML External Entity Injection / Cross-Site Scripting | airwave | 6.1 (v3.0) | Medium |
| CVE-2017-11107 | phpLDAPadmin <= 1.2.3 - Reflected XSS | phpldapadmin | 6.1 (v3.1) | Medium |
| CVE-2017-11629 | FineCMS <=5.0.10 - Cross-Site Scripting | finecms | 6.1 (v3.0) | Medium |
| CVE-2017-12794 | Django Debug Page - Cross-Site Scripting | django | 6.1 (v3.0) | Medium |
| CVE-2017-14622 | WordPress 2kb Amazon Affiliates Store <2.1.1 - Cross-Site Scripting | 2kb amazon affiliates store | 6.1 (v3.0) | Medium |
| CVE-2017-15287 | Dreambox WebControl 2.0.0 - Cross-Site Scripting | bouqueteditor | 6.1 (v3.0) | Medium |
| CVE-2017-17043 | WordPress Emag Marketplace Connector 1.0 - Cross-Site Scripting | emag marketplace connector | 6.1 (v3.0) | Medium |
| CVE-2017-17059 | WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting | amtythumb | 6.1 (v3.0) | Medium |
| CVE-2017-17451 | WordPress Mailster <=1.5.4 - Cross-Site Scripting | wp mailster | 6.1 (v3.0) | Medium |
| CVE-2017-18487 | AdPush < 1.44 - Cross-Site Scripting | google adsense | 6.1 (v3.0) | Medium |
| CVE-2017-18490 | Contact Form Multi by BestWebSoft < 1.2.1 - Cross-Site Scripting | contact form multi | 6.1 (v3.0) | Medium |
| CVE-2017-18491 | Contact Form by BestWebSoft < 4.0.6 - Cross-Site Scripting | contact form | 6.1 (v3.0) | Medium |
| CVE-2017-18492 | Contact Form to DB by BestWebSoft < 1.5.7 - Cross-Site Scripting | contact form to db | 6.1 (v3.0) | Medium |
| CVE-2017-18493 | Custom Admin Page by BestWebSoft < 0.1.2 - Cross-Site Scripting | custom admin page | 6.1 (v3.0) | Medium |
| CVE-2017-18494 | Custom Search by BestWebSoft < 1.36 - Cross-Site Scripting | custom search | 6.1 (v3.0) | Medium |
| CVE-2017-18496 | Htaccess by BestWebSoft < 1.7.6 - Cross-Site Scripting | htaccess | 6.1 (v3.0) | Medium |
| CVE-2017-18500 | Social Buttons Pack by BestWebSof < 1.1.1 - Cross-Site Scripting | social buttons pack | 6.1 (v3.0) | Medium |
| CVE-2017-18501 | Social Login by BestWebSoft < 0.2 - Cross-Site Scripting | social login | 6.1 (v3.0) | Medium |
| CVE-2017-18502 | Subscriber by BestWebSoft < 1.3.5 - Cross-Site Scripting | subscriber | 6.1 (v3.0) | Medium |
| CVE-2017-18505 | BestWebSoft's Twitter < 2.55 - Cross-Site Scripting | twitter button | 6.1 (v3.0) | Medium |
| CVE-2017-18516 | LinkedIn by BestWebSoft < 1.0.5 - Cross-Site Scripting | 6.1 (v3.0) | Medium | |
| CVE-2017-18517 | Pinterest by BestWebSoft < 1.0.5 - Cross-Site Scripting | 6.1 (v3.0) | Medium | |
| CVE-2017-18518 | SMTP by BestWebSoft < 1.1.0 - Cross-Site Scripting | smtp | 6.1 (v3.0) | Medium |
| CVE-2017-18527 | Pagination by BestWebSoft < 1.0.7 - Cross-Site Scripting | pagination | 6.1 (v3.0) | Medium |
| CVE-2017-18528 | PDF & Print by BestWebSoft < 1.9.4 - Cross-Site Scripting | pdf & print | 6.1 (v3.0) | Medium |
| CVE-2017-18529 | PromoBar by BestWebSoft < 1.1.1 - Cross-Site Scripting | promobar | 6.1 (v3.0) | Medium |
| CVE-2017-18530 | Rating by BestWebSoft < 0.2 - Cross-Site Scripting | rating | 6.1 (v3.0) | Medium |
| CVE-2017-18532 | Realty by BestWebSoft < 1.1.0 - Cross-Site Scripting | realty | 6.1 (v3.0) | Medium |
| CVE-2017-18536 | WordPress Stop User Enumeration <=1.3.7 - Cross-Site Scripting | stop user enumeration | 6.1 (v3.0) | Medium |
| CVE-2017-18537 | Visitors Online by BestWebSoft < 1.0.0 - Cross-Site Scripting | visitors online | 6.1 (v3.0) | Medium |
| CVE-2017-18542 | Zendesk Help Center by BestWebSoft < 1.0.5 - Cross-Site Scripting | zendesk help center | 6.1 (v3.0) | Medium |
| CVE-2017-18556 | Google Analytics by BestWebSoft < 1.7.1 - Cross-Site Scripting | google analytics | 6.1 (v3.0) | Medium |
| CVE-2017-18557 | Google Maps by BestWebSoft < 1.3.6 - Cross-Site Scripting | google maps | 6.1 (v3.0) | Medium |
| CVE-2017-18558 | Testimonials by BestWebSoft < 0.1.9 - Cross-Site Scripting | testimonials | 6.1 (v3.0) | Medium |
| CVE-2017-18562 | Error Log Viewer by BestWebSoft < 1.0.6 - Cross-Site Scripting | error log viewer | 6.1 (v3.0) | Medium |
| CVE-2017-18564 | Sender by BestWebSoft < 1.2.1 - Cross-Site Scripting | sender | 6.1 (v3.0) | Medium |
| CVE-2017-18565 | Updater by BestWebSoft < 1.35 - Cross-Site Scripting | updater | 6.1 (v3.0) | Medium |
| CVE-2017-18566 | User Role by BestWebSoft < 1.5.6 - Cross-Site Scripting | user role | 6.1 (v3.0) | Medium |
| CVE-2017-18590 | Timesheet Plugin < 0.1.5 - Cross-Site Scripting | timesheet | 6.1 (v3.0) | Medium |
| CVE-2017-3132 | Fortinet FortiOS < 5.6.0 - Cross-Site Scripting | fortios | 6.1 (v3.0) | Medium |
| CVE-2017-3133 | Fortinet FortiOS < 5.6.0 - Cross-Site Scripting | fortios | 6.1 (v3.0) | Medium |
| CVE-2017-5631 | KMCIS CaseAware - Cross-Site Scripting | caseaware | 6.1 (v3.0) | Medium |
| CVE-2017-6478 | MaNGOSWebV4 < 4.0.8 - Cross-Site Scripting | mangoswebv4 | 6.1 (v3.1) | Medium |
| CVE-2017-7391 | Magmi 0.7.22 - Cross-Site Scripting | magmi | 6.1 (v3.0) | Medium |
| CVE-2017-9288 | WordPress Raygun4WP <=1.8.0 - Cross-Site Scripting | raygun4wp | 6.1 (v3.0) | Medium |
| CVE-2018-10095 | Dolibarr <7.0.2 - Cross-Site Scripting | dolibarr | 6.1 (v3.0) | Medium |
| CVE-2018-10230 | Zend Server <9.13 - Cross-Site Scripting | zend server | 6.1 (v3.0) | Medium |
| CVE-2018-11709 | WordPress wpForo Forum <= 1.4.11 - Cross-Site Scripting | wpforo forum | 6.1 (v3.0) | Medium |
| CVE-2018-12998 | Zoho manageengine - Cross-Site Scripting | firewall analyzer | 6.1 (v3.1) | Medium |
| CVE-2018-13380 | Fortinet FortiOS - Cross-Site Scripting | fortios | 6.1 (v3.1) | Medium |
| CVE-2018-14013 | Synacor Zimbra Collaboration Suite Collaboration <8.8.11 - Cross-Site Scripting | zimbra collaboration suite | 6.1 (v3.0) | Medium |
| CVE-2018-16134 | Cybrotech CyBroHttpServer 1.0.3 - Cross-Site Scripting | cybrohttpserver | 6.1 (v3.0) | Medium |
| CVE-2018-16139 | BIBLIOsoft BIBLIOpac 2008 - Cross-Site Scripting | bibliopac | 6.1 (v3.0) | Medium |
| CVE-2018-17587 | Airties AIR5342 1.0.0.18 - Cross-Site Scripting | air 5750 firmware | 6.1 (v3.0) | Medium |
| CVE-2018-17588 | Airties AIR5342 1.0.0.18 - Cross-Site Scripting | air 5021 firmware | 6.1 (v3.0) | Medium |
| CVE-2018-17590 | Airties AIR5342 1.0.0.18 - Cross-Site Scripting | air 5442 firmware | 6.1 (v3.0) | Medium |
| CVE-2018-17591 | Airties AIR5342 1.0.0.18 - Cross-Site Scripting | air 5343v2 firmware | 6.1 (v3.0) | Medium |
| CVE-2018-17593 | Airties AIR5342 1.0.0.18 - Cross-Site Scripting | air 5453 firmware | 6.1 (v3.0) | Medium |
| CVE-2018-18570 | Planon <Live Build 41 - Cross-Site Scripting | planon | 6.1 (v3.0) | Medium |
| CVE-2018-18608 | DedeCMS 5.7 SP2 - Cross-Site Scripting | dedecms | 6.1 (v3.0) | Medium |
| CVE-2018-18775 | Microstrategy Web 7 - Cross-Site Scripting | microstrategy web | 6.1 (v3.0) | Medium |
| CVE-2018-19136 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 6.1 (v3.0) | Medium |
| CVE-2018-19137 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 6.1 (v3.0) | Medium |
| CVE-2018-19439 | Oracle Secure Global Desktop Administration Console 4.4 - Cross-Site Scripting | secure global desktop | 6.1 (v3.0) | Medium |
| CVE-2018-19877 | Adiscon LogAnalyzer <4.1.7 - Cross-Site Scripting | loganalyzer | 6.1 (v3.0) | Medium |
| CVE-2018-20462 | WordPress JSmol2WP <=1.07 - Cross-Site Scripting | jsmol2wp | 6.1 (v3.0) | Medium |
| CVE-2018-5233 | Grav CMS <1.3.0 - Cross-Site Scripting | grav cms | 6.1 (v3.0) | Medium |
| CVE-2018-5316 | WordPress SagePay Server Gateway for WooCommerce <1.0.9 - Cross-Site Scripting | sagepay server gateway for woocommerce | 6.1 (v3.0) | Medium |
| CVE-2018-5715 | SugarCRM 3.5.1 - Cross-Site Scripting | sugarcrm | 6.1 (v3.0) | Medium |
| CVE-2018-6882 | zimbra collaboration suite Cross-Site Scripting Vulnerability | zimbra collaboration suite | 6.1 (v3.1) | Medium |
| CVE-2018-7193 | osTicket < 1.10.2 - Cross-Site Scripting | osticket | 6.1 (v3.0) | Medium |
| CVE-2018-7196 | osTicket < 1.10.2 - Cross-Site Scripting | osticket | 6.1 (v3.0) | Medium |
| CVE-2018-8006 | Apache ActiveMQ <=5.15.5 - Cross-Site Scripting | activemq | 6.1 (v3.1) | Medium |
| CVE-2019-0221 | Apache Tomcat - Cross-Site Scripting | tomcat | 6.1 (v3.0) | Medium |
| CVE-2019-10685 | Prinect Archive System 2015 Release 2.6 - Cross-Site Scripting | prinect archiver | 6.1 (v3.0) | Medium |
| CVE-2019-12461 | WebPort 1.19.1 - Cross-Site Scripting | web port | 6.1 (v3.0) | Medium |
| CVE-2019-12581 | Zyxel ZyWal/USG/UAG Devices - Cross-Site Scripting | uag2100 | 6.1 (v3.0) | Medium |
| CVE-2019-12935 | Shopware < 5.5.8 - Cross-Site Scripting | shopware | 6.1 (v3.0) | Medium |
| CVE-2019-14696 | Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting | open-school | 6.1 (v3.0) | Medium |
| CVE-2019-15501 | L-Soft LISTSERV <16.5-2018a - Cross-Site Scripting | listserv | 6.1 (v3.0) | Medium |
| CVE-2019-15713 | WordPress My Calendar <= 3.1.9 - Cross-Site Scripting | my calendar | 6.1 (v3.0) | Medium |
| CVE-2019-15889 | WordPress Download Manager <2.9.94 - Cross-Site Scripting | wordpress download manager | 6.1 (v3.0) | Medium |
| CVE-2019-16332 | WordPress API Bearer Auth <20190907 - Cross-Site Scripting | api bearer auth | 6.1 (v3.1) | Medium |
| CVE-2019-16525 | WordPress Checklist <1.1.9 - Cross-Site Scripting | checklist | 6.1 (v3.1) | Medium |
| CVE-2019-17504 | Kirona-DRS 5.5.3.5 - Information Disclosure | dynamic resource scheduling | 6.1 (v3.1) | Medium |
| CVE-2019-18859 | Digi AnywhereUSB 14 - Reflective Cross-Site Scripting | anywhereusb/14 firmware | 6.1 (v3.1) | Medium |
| CVE-2019-19134 | WordPress Hero Maps Premium <=2.2.1 - Cross-Site Scripting | hero maps premium | 6.1 (v3.1) | Medium |
| CVE-2019-19908 | phpMyChat-Plus 1.98 - Cross-Site Scripting | phpmychat-plus | 6.1 (v3.1) | Medium |
| CVE-2019-20210 | WordPress CTHthemes - Cross-Site Scripting | citybook | 6.1 (v3.1) | Medium |
| CVE-2019-3402 | Jira < 8.1.1 - Cross-Site Scripting | jira | 6.1 (v3.0) | Medium |
| CVE-2019-3911 | LabKey Server Community Edition <18.3.0 - Cross-Site Scripting | labkey server | 6.1 (v3.1) | Medium |
| CVE-2019-6112 | WordPress Sell Media 2.4.1 - Cross-Site Scripting | sell media | 6.1 (v3.1) | Medium |
| CVE-2019-7255 | Linear eMerge E3 - Cross-Site Scripting | linear emerge essential firmware | 6.1 (v3.1) | Medium |
| CVE-2019-8937 | HotelDruid 2.3.0 - Cross-Site Scripting | hoteldruid | 6.1 (v3.0) | Medium |
| CVE-2019-9591 | ShoreTel Connect ONSITE < 19.49.1500.0 - Multiple Vulnerabilities | connect onsite | 6.1 (v3.1) | Medium |
| CVE-2019-9592 | ShoreTel Connect ONSITE < 19.49.1500.0 - Multiple Vulnerabilities | connect onsite | 6.1 (v3.1) | Medium |
| CVE-2019-9593 | ShoreTel Connect ONSITE < 19.49.1500.0 - Multiple Vulnerabilities | connect onsite | 6.1 (v3.1) | Medium |
| CVE-2020-11930 | WordPress GTranslate <2.8.52 - Cross-Site Scripting | translate wordpress with gtranslate | 6.1 (v3.1) | Medium |
| CVE-2020-13258 | Contentful <=2020-05-21 - Cross-Site Scripting | python example | 6.1 (v3.1) | Medium |
| CVE-2020-17362 | Nova Lite < 1.3.9 - Cross-Site Scripting | nova lite | 6.1 (v3.1) | Medium |
| CVE-2020-19282 | Jeesns 1.4.2 - Cross-Site Scripting | jeesns | 6.1 (v3.1) | Medium |
| CVE-2020-19283 | Jeesns 1.4.2 - Cross-Site Scripting | jeesns | 6.1 (v3.1) | Medium |
| CVE-2020-19295 | Jeesns 1.4.2 - Cross-Site Scripting | jeesns | 6.1 (v3.1) | Medium |
| CVE-2020-2096 | Jenkins Gitlab Hook <=1.4.2 - Cross-Site Scripting | gitlab hook | 6.1 (v3.1) | Medium |
| CVE-2020-23517 | Aryanic HighMail (High CMS) - Cross-Site Scripting | high cms | 6.1 (v3.1) | Medium |
| CVE-2020-24223 | Mara CMS 7.5 - Cross-Site Scripting | mara cms | 6.1 (v3.1) | Medium |
| CVE-2020-24701 | OX Appsuite - Cross-Site Scripting | open-xchange appsuite | 6.1 (v3.1) | Medium |
| CVE-2020-24902 | Quixplorer <=2.4.1 - Cross-Site Scripting | quixplorer | 6.1 (v3.1) | Medium |
| CVE-2020-24903 | Cute Editor for ASP.NET 6.4 - Cross-Site Scripting | cute editor | 6.1 (v3.1) | Medium |
| CVE-2020-25495 | SCO Openserver 5.0.7 - 'section' Reflected XSS | openserver | 6.1 (v3.1) | Medium |
| CVE-2020-26153 | Event Espresso Core-Reg 4.10.7.p - Cross-Site Scripting | event espresso | 6.1 (v3.1) | Medium |
| CVE-2020-28351 | Mitel ShoreTel 19.46.1802.0 Devices - Cross-Site Scripting | shoretel | 6.1 (v3.1) | Medium |
| CVE-2020-35416 | PHPJabbers Appointment Scheduler 2.3 - Reflected XSS (Cross-Site Scripting) | phpjabbers appointment scheduler | 6.1 (v3.1) | Medium |
| CVE-2020-36510 | WordPress 15Zine <3.3.0 - Cross-Site Scripting | 15zine | 6.1 (v3.1) | Medium |
| CVE-2020-6171 | CLink Office 2.0 - Cross-Site Scripting | clink office | 6.1 (v3.1) | Medium |
| CVE-2020-7107 | WordPress Ultimate FAQ <1.8.30 - Cross-Site Scripting | ultimate faq | 6.1 (v3.1) | Medium |
| CVE-2020-9344 | Jira Subversion ALM for Enterprise <8.8.2 - Cross-Site Scripting | subversion application lifecycle management | 6.1 (v3.1) | Medium |
| CVE-2021-20792 | WordPress Quiz and Survey Master <7.1.14 - Cross-Site Scripting | quiz and survey master | 6.1 (v3.1) | Medium |
| CVE-2021-21799 | Advantech R-SeeNet 2.4.12 - Cross-Site Scripting | r-seenet | 6.1 (v3.1) | Medium |
| CVE-2021-21800 | Advantech R-SeeNet 2.4.12 - Cross-Site Scripting | r-seenet | 6.1 (v3.1) | Medium |
| CVE-2021-24169 | WordPress Advanced Order Export For WooCommerce <3.1.8 - Authenticated Cross-Site Scripting | advanced order export | 6.1 (v3.1) | Medium |
| CVE-2021-24213 | GiveWP <= 2.9.7 - Cross-Site Scripting | givewp | 6.1 (v3.1) | Medium |
| CVE-2021-24214 | WordPress OpenID Connect Generic Client 3.8.0-3.8.1 - Cross-Site Scripting | openid connect generic client | 6.1 (v3.1) | Medium |
| CVE-2021-24274 | WordPress Supsystic Ultimate Maps <1.2.5 - Cross-Site Scripting | ultimate maps | 6.1 (v3.1) | Medium |
| CVE-2021-24275 | Popup by Supsystic <1.10.5 - Cross-Site scripting | popup | 6.1 (v3.1) | Medium |
| CVE-2021-24276 | WordPress Supsystic Contact Form <1.7.15 - Cross-Site Scripting | contact form | 6.1 (v3.1) | Medium |
| CVE-2021-24298 | WordPress Simple Giveaways <2.36.2 - Cross-Site Scripting | simple giveaways | 6.1 (v3.1) | Medium |
| CVE-2021-24316 | WordPress Mediumish Theme <=1.0.47 - Cross-Site Scripting | mediumish | 6.1 (v3.1) | Medium |
| CVE-2021-24320 | WordPress Bello Directory & Listing Theme <1.6.0 - Cross-Site Scripting | bello | 6.1 (v3.1) | Medium |
| CVE-2021-24335 | WordPress Car Repair Services & Auto Mechanic Theme <4.0 - Cross-Site Scripting | car repair services & auto mechanic | 6.1 (v3.1) | Medium |
| CVE-2021-24364 | WordPress Jannah Theme <5.4.4 - Cross-Site Scripting | jannah | 6.1 (v3.1) | Medium |
| CVE-2021-24387 | WordPress Pro Real Estate 7 Theme <3.1.1 - Cross-Site Scripting | real estate 7 | 6.1 (v3.1) | Medium |
| CVE-2021-24389 | WordPress FoodBakery <2.2 - Cross-Site Scripting | foodbakery | 6.1 (v3.1) | Medium |
| CVE-2021-24436 | WordPress W3 Total Cache <2.1.4 - Cross-Site Scripting | w3 total cache | 6.1 (v3.1) | Medium |
| CVE-2021-24495 | Wordpress Marmoset Viewer <1.9.3 - Cross-Site Scripting | marmoset viewer | 6.1 (v3.1) | Medium |
| CVE-2021-24510 | WordPress MF Gig Calendar <=1.1 - Cross-Site Scripting | mf gig calendar | 6.1 (v3.1) | Medium |
| CVE-2021-24522 | ProfilePress < 3.1.11 - Cross-Site Scripting | profilepress | 6.1 (v3.1) | Medium |
| CVE-2021-24926 | WordPress Domain Check <1.0.17 - Cross-Site Scripting | domain check | 6.1 (v3.1) | Medium |
| CVE-2021-24934 | Visual CSS Style Editor < 7.5.4 - Cross-Site Scripting | visual css style editor | 6.1 (v3.1) | Medium |
| CVE-2021-24956 | Blog2Social < 6.8.7 - Cross-Site Scripting | blog2social | 6.1 (v3.1) | Medium |
| CVE-2021-25016 | Chaty < 2.8.2 - Cross-Site Scripting | chaty | 6.1 (v3.1) | Medium |
| CVE-2021-25079 | Contact Form Entries < 1.2.4 - Cross-Site Scripting | contact form entries | 6.1 (v3.1) | Medium |
| CVE-2021-25104 | WordPress Ocean Extra <1.9.5 - Cross-Site Scripting | ocean extra | 6.1 (v3.1) | Medium |
| CVE-2021-25120 | Easy Social Feed < 6.2.7 - Cross-Site Scripting | easy social feed | 6.1 (v3.1) | Medium |
| CVE-2021-26247 | Cacti - Cross-Site Scripting | cacti | 6.1 (v3.1) | Medium |
| CVE-2021-26475 | EPrints 3.4.2 - Cross-Site Scripting | eprints | 6.1 (v3.1) | Medium |
| CVE-2021-26702 | EPrints 3.4.2 - Cross-Site Scripting | eprints | 6.1 (v3.1) | Medium |
| CVE-2021-26710 | Redwood Report2Web 4.3.4.5 & 4.5.3 - Cross-Site Scripting | report2web | 6.1 (v3.1) | Medium |
| CVE-2021-26723 | Jenzabar 9.2x-9.2.2 - Cross-Site Scripting | jenzabar | 6.1 (v3.1) | Medium |
| CVE-2021-26947 | Odoo <= 15.0 - Cross-Site Scripting | odoo | 6.1 (v3.1) | Medium |
| CVE-2021-27309 | Clansphere CMS 2011.4 - Cross-Site Scripting | clansphere | 6.1 (v3.1) | Medium |
| CVE-2021-27310 | Clansphere CMS 2011.4 - Cross-Site Scripting | clansphere | 6.1 (v3.1) | Medium |
| CVE-2021-27330 | Triconsole Datepicker Calendar <3.77 - Cross-Site Scripting | datepicker calendar | 6.1 (v3.1) | Medium |
| CVE-2021-29625 | Adminer <=4.8.0 - Cross-Site Scripting | adminer | 6.1 (v3.1) | Medium |
| CVE-2021-30049 | SysAid Technologies 20.3.64 b14 - Cross-Site Scripting | sysaid | 6.1 (v3.1) | Medium |
| CVE-2021-30213 | Knowage Suite 7.3 - Cross-Site Scripting | knowage | 6.1 (v3.1) | Medium |
| CVE-2021-31537 | SIS Informatik REWE GO SP17 <7.7 - Cross-Site Scripting | sis-rewe go | 6.1 (v3.1) | Medium |
| CVE-2021-31682 | WebCTRL OEM <= 6.5 - Cross-Site Scripting | webctrl | 6.1 (v3.1) | Medium |
| CVE-2021-31862 | SysAid 20.4.74 - Cross-Site Scripting | sysaid | 6.1 (v3.1) | Medium |
| CVE-2021-34630 | GTranslate < 2.8.65 - Cross-Site Scripting | gtranslate | 6.1 (v3.1) | Medium |
| CVE-2021-34640 | WordPress Securimage-WP-Fixed <=3.5.4 - Cross-Site Scripting | securimage-wp-fixed | 6.1 (v3.1) | Medium |
| CVE-2021-34643 | WordPress Skaut Bazar <1.3.3 - Cross-Site Scripting | skaut-bazar | 6.1 (v3.1) | Medium |
| CVE-2021-35488 | Thruk 2.40-2 - Cross-Site Scripting | thruk | 6.1 (v3.1) | Medium |
| CVE-2021-36646 | KodExplorer - Cross-Site Scripting | kod-explorer | 6.1 (v3.1) | Medium |
| CVE-2021-37416 | Zoho ManageEngine ADSelfService Plus <=6103 - Cross-Site Scripting | manageengine adselfservice plus | 6.1 (v3.1) | Medium |
| CVE-2021-37833 | Hotel Druid 3.0.2 - Cross-Site Scripting | hoteldruid | 6.1 (v3.1) | Medium |
| CVE-2021-3831 | Gnuboard 5 - Cross-Site Scripting | gnuboard5 | 6.1 (v3.1) | Medium |
| CVE-2021-38702 | Cyberoam NetGenie Cross-Site Scripting | netgenie c0101b1-20141120-ng11vo firmware | 6.1 (v3.1) | Medium |
| CVE-2021-38704 | ClinicCases 7.3.3 Cross-Site Scripting | cliniccases | 6.1 (v3.1) | Medium |
| CVE-2021-39320 | WordPress Under Construction <1.19 - Cross-Site Scripting | underconstruction | 6.1 (v3.1) | Medium |
| CVE-2021-39322 | WordPress Easy Social Icons Plugin < 3.0.9 - Cross-Site Scripting | easy social icons | 6.1 (v3.1) | Medium |
| CVE-2021-39350 | FV Flowplayer Video Player WordPress plugin - Authenticated Cross-Site Scripting | fv flowplayer video player | 6.1 (v3.1) | Medium |
| CVE-2021-40542 | Opensis-Classic 8.0 - Cross-Site Scripting | opensis | 6.1 (v3.1) | Medium |
| CVE-2021-40868 | Cloudron 6.2 Cross-Site Scripting | cloudron | 6.1 (v3.1) | Medium |
| CVE-2021-41467 | JustWriting - Cross-Site Scripting | justwriting | 6.1 (v3.1) | Medium |
| CVE-2021-41951 | Resourcespace - Cross-Site Scripting | resourcespace | 6.1 (v3.1) | Medium |
| CVE-2021-42565 | myfactory FMS - Cross-Site Scripting | fms | 6.1 (v3.1) | Medium |
| CVE-2021-43574 | Atmail 6.5.0 - Cross-Site Scripting | atmail | 6.1 (v3.1) | Medium |
| CVE-2021-43725 | Spotweb <= 1.5.1 - Cross Site Scripting (Reflected) | spotweb | 6.1 (v3.1) | Medium |
| CVE-2021-45380 | AppCMS - Cross-Site Scripting | appcms | 6.1 (v3.1) | Medium |
| CVE-2021-45422 | Reprise License Manager 14.2 - Cross-Site Scripting | reprise license manager | 6.1 (v3.1) | Medium |
| CVE-2021-45425 | SAFARI Montage 8.5 - Reflected Cross Site Scripting (XSS) | safari montage | 6.1 (v3.1) | Medium |
| CVE-2022-0149 | WooCommerce Stored Exporter WordPress Plugin < 2.7.1 - Cross-Site Scripting | store exporter for woocommerce | 6.1 (v3.1) | Medium |
| CVE-2022-0212 | WordPress Spider Calendar <=1.5.65 - Cross-Site Scripting | spidercalendar | 6.1 (v3.1) | Medium |
| CVE-2022-0250 | Redirection for Contact Form 7 < 2.5.0 - Cross-Site Scripting | redirection for contact form 7 | 6.1 (v3.1) | Medium |
| CVE-2022-0678 | Microweber <1.2.11 - Cross-Site Scripting | microweber | 6.1 (v3.1) | Medium |
| CVE-2022-0864 | UpdraftPlus < 1.22.9 - Cross-Site Scripting | updraftplus | 6.1 (v3.1) | Medium |
| CVE-2022-0899 | Header Footer Code Manager < 1.1.24 - Cross-Site Scripting | header footer code manager | 6.1 (v3.1) | Medium |
| CVE-2022-1007 | WordPress Advanced Booking Calendar <1.7.1 - Cross-Site Scripting | advanced booking calendar | 6.1 (v3.1) | Medium |
| CVE-2022-1221 | WordPress Gwyn's Imagemap Selector <=0.3.3 - Cross-Site Scripting | gwyn's imagemap selector | 6.1 (v3.1) | Medium |
| CVE-2022-1724 | WordPress Simple Membership <4.1.1 - Cross-Site Scripting | simple membership | 6.1 (v3.1) | Medium |
| CVE-2022-1904 | WordPress Easy Pricing Tables <3.2.1 - Cross-Site Scripting | easy pricing tables | 6.1 (v3.1) | Medium |
| CVE-2022-1906 | WordPress Copyright Proof <=4.16 - Cross-Site-Scripting | copyright proof | 6.1 (v3.1) | Medium |
| CVE-2022-1910 | WordPress Shortcodes and Extra Features for Phlox <2.9.8 - Cross-Site Scripting | shortcodes and extra features for phlox theme | 6.1 (v3.1) | Medium |
| CVE-2022-1933 | WordPress CDI <5.1.9 - Cross Site Scripting | collect and deliver interface for woocommerce | 6.1 (v3.1) | Medium |
| CVE-2022-1937 | WordPress Awin Data Feed <=1.6 - Cross-Site Scripting | awin data feed | 6.1 (v3.1) | Medium |
| CVE-2022-1946 | WordPress Gallery <2.0.0 - Cross-Site Scripting | gallery | 6.1 (v3.1) | Medium |
| CVE-2022-2130 | Microweber < 1.2.17 - Cross-Site Scripting | microweber | 6.1 (v3.1) | Medium |
| CVE-2022-2168 | WordPress Download Manager < 3.2.44 - Authenticated Cross-Site Scripting | download manager | 6.1 (v3.1) | Medium |
| CVE-2022-2174 | microweber 1.2.18 - Cross-site Scripting | microweber | 6.1 (v3.1) | Medium |
| CVE-2022-2187 | WordPress Contact Form 7 Captcha <0.1.2 - Cross-Site Scripting | contact form 7 captcha | 6.1 (v3.1) | Medium |
| CVE-2022-22242 | Juniper Web Device Manager - Cross-Site Scripting | junos | 6.1 (v3.1) | Medium |
| CVE-2022-23808 | phpMyAdmin < 5.1.2 - Cross-Site Scripting | phpmyadmin | 6.1 (v3.1) | Medium |
| CVE-2022-24899 | Contao <4.13.3 - Cross-Site Scripting | contao | 6.1 (v3.1) | Medium |
| CVE-2022-2599 | WordPress Anti-Malware Security and Brute-Force Firewall <4.21.83 - Cross-Site Scripting | anti-malware security and brute-force firewall | 6.1 (v3.1) | Medium |
| CVE-2022-26564 | HotelDruid Hotel Management Software 3.0.3 - Cross-Site Scripting | hoteldruid | 6.1 (v3.1) | Medium |
| CVE-2022-28508 | MantisBT < 2.25.2 - Cross-Site Scripting | mantisbt | 6.1 (v3.1) | Medium |
| CVE-2022-30776 | Atmail 6.5.0 - Cross-Site Scripting | atmail | 6.1 (v3.1) | Medium |
| CVE-2022-30777 | Parallels H-Sphere 3.6.1713 - Cross-Site Scripting | h-sphere | 6.1 (v3.1) | Medium |
| CVE-2022-31299 | Haraj 3.7 - Cross-Site Scripting | haraj | 6.1 (v3.1) | Medium |
| CVE-2022-31373 | SolarView Compact 6.00 - Cross-Site Scripting | sv-cpt-mc310 firmware | 6.1 (v3.1) | Medium |
| CVE-2022-31470 | Axigen WebMail - Cross-Site Scripting | webmail | 6.1 (v3.1) | Medium |
| CVE-2022-3242 | Microweber <1.3.2 - Cross-Site Scripting | microweber | 6.1 (v3.1) | Medium |
| CVE-2022-32770 | WWBN AVideo 11.6 - Cross-Site Scripting | avideo | 6.1 (v3.1) | Medium |
| CVE-2022-32771 | WWBN AVideo 11.6 - Cross-Site Scripting | avideo | 6.1 (v3.1) | Medium |
| CVE-2022-32772 | WWBN AVideo 11.6 - Cross-Site Scripting | avideo | 6.1 (v3.1) | Medium |
| CVE-2022-34093 | Software Publico Brasileiro i3geo v7.0.5 - Cross-Site Scripting | i3geo | 6.1 (v3.1) | Medium |
| CVE-2022-34094 | Software Publico Brasileiro i3geo v7.0.5 - Cross-Site Scripting | i3geo | 6.1 (v3.1) | Medium |
| CVE-2022-34305 | Apache Tomcat Examples Web Application - Cross-Site Scripting | tomcat | 6.1 (v3.1) | Medium |
| CVE-2022-34328 | PMB 7.3.10 - Cross-Site Scripting | pmb | 6.1 (v3.1) | Medium |
| CVE-2022-3484 | WordPress WPB Show Core - Cross-Site Scripting | wpb show core | 6.1 (v3.1) | Medium |
| CVE-2022-3578 | WordPress ProfileGrid <5.1.1 - Cross-Site Scripting | profilegrid | 6.1 (v3.1) | Medium |
| CVE-2022-38553 | Academy Learning Management System <5.9.1 - Cross-Site Scripting | academy learning management system | 6.1 (v3.1) | Medium |
| CVE-2022-3908 | WordPress Helloprint <1.4.7 - Cross-Site Scripting | helloprint | 6.1 (v3.1) | Medium |
| CVE-2022-39195 | LISTSERV 17 - Cross-Site Scripting | listserv | 6.1 (v3.1) | Medium |
| CVE-2022-40359 | Kae's File Manager <=1.4.7 - Cross-Site Scripting | kfm | 6.1 (v3.1) | Medium |
| CVE-2022-41441 | ReQlogic v11.3 - Cross Site Scripting | reqlogic | 6.1 (v3.1) | Medium |
| CVE-2022-41473 | RPCMS 3.0.2 - Cross-Site Scripting | rpcms | 6.1 (v3.1) | Medium |
| CVE-2022-42118 | Liferay Portal - Cross-site Scripting | liferay portal | 6.1 (v3.1) | Medium |
| CVE-2022-42746 | CandidATS 3.0.0 - Cross-Site Scripting. | candidats | 6.1 (v3.1) | Medium |
| CVE-2022-42747 | CandidATS 3.0.0 - Cross-Site Scripting. | candidats | 6.1 (v3.1) | Medium |
| CVE-2022-42748 | CandidATS 3.0.0 - Cross-Site Scripting. | candidats | 6.1 (v3.1) | Medium |
| CVE-2022-42749 | CandidATS 3.0.0 - Cross-Site Scripting | candidats | 6.1 (v3.1) | Medium |
| CVE-2022-4295 | Show all comments < 7.0.1 - Cross-Site Scripting | show all comments | 6.1 (v3.1) | Medium |
| CVE-2022-4301 | WordPress Sunshine Photo Cart <2.9.15 - Cross-Site Scripting | sunshine photo cart | 6.1 (v3.1) | Medium |
| CVE-2022-43014 | OpenCATS 0.9.6 - Cross-Site Scripting | opencats | 6.1 (v3.1) | Medium |
| CVE-2022-43015 | OpenCATS 0.9.6 - Cross-Site Scripting | opencats | 6.1 (v3.1) | Medium |
| CVE-2022-43016 | OpenCATS 0.9.6 - Cross-Site Scripting | opencats | 6.1 (v3.1) | Medium |
| CVE-2022-43017 | OpenCATS 0.9.6 - Cross-Site Scripting | opencats | 6.1 (v3.1) | Medium |
| CVE-2022-43018 | OpenCATS 0.9.6 - Cross-Site Scripting | opencats | 6.1 (v3.1) | Medium |
| CVE-2022-4320 | WordPress Events Calendar <1.4.5 - Cross-Site Scripting | wordpress events calendar plugin | 6.1 (v3.1) | Medium |
| CVE-2022-4321 | PDF Generator for WordPress < 1.1.2 - Cross Site Scripting | pdf generator for wordpress | 6.1 (v3.1) | Medium |
| CVE-2022-4325 | WordPress Post Status Notifier Lite <1.10.1 - Cross-Site Scripting | post status notifier lite | 6.1 (v3.1) | Medium |
| CVE-2022-46073 | Helmet Store Showroom - Cross Site Scripting | helmet store showroom | 6.1 (v3.1) | Medium |
| CVE-2022-46888 | NexusPHP <1.7.33 - Cross-Site Scripting | nexusphp | 6.1 (v3.1) | Medium |
| CVE-2022-48197 | Yahoo User Interface library (YUI2) TreeView v2.8.2 - Cross-Site Scripting | yui | 6.1 (v3.1) | Medium |
| CVE-2022-4897 | WordPress BackupBuddy <8.8.3 - Cross Site Scripting | backupbuddy | 6.1 (v3.1) | Medium |
| CVE-2023-0099 | Simple URLs < 115 - Cross Site Scripting | simple urls | 6.1 (v3.1) | Medium |
| CVE-2023-0334 | ShortPixel Adaptive Images < 3.6.3 - Cross Site Scripting | shortpixel adaptive images | 6.1 (v3.1) | Medium |
| CVE-2023-0602 | Twittee Text Tweet <= 1.0.8 - Cross-Site Scripting | twittee text tweet | 6.1 (v3.1) | Medium |
| CVE-2023-0942 | WordPress Japanized for WooCommerce <2.5.5 - Cross-Site Scripting | japanized for woocommerce | 6.1 (v3.1) | Medium |
| CVE-2023-0948 | WordPress Japanized for WooCommerce <2.5.8 - Cross-Site Scripting | japanized for woocommerce | 6.1 (v3.1) | Medium |
| CVE-2023-1119 | WP-Optimize WordPress plugin < 3.2.13 - Cross-Site Scripting | wp-optimize,srbtranslatin | 6.1 (v3.1) | Medium |
| CVE-2023-1546 | MyCryptoCheckout < 2.124 - Cross-Site Scripting | mycryptocheckout | 6.1 (v3.1) | Medium |
| CVE-2023-1880 | Phpmyfaq v3.1.11 - Cross-Site Scripting | phpmyfaq | 6.1 (v3.1) | Medium |
| CVE-2023-1890 | Tablesome < 1.0.9 - Cross-Site Scripting | tablesome | 6.1 (v3.1) | Medium |
| CVE-2023-1893 | Login Configurator <=2.1 - Cross-Site Scripting | login configurator | 6.1 (v3.1) | Medium |
| CVE-2023-2256 | WordPress Product Addons & Fields for WooCommerce < 32.0.7 - Cross-Site Scripting | woocommerce-product-addon | 6.1 (v3.1) | Medium |
| CVE-2023-2309 | wpForo Forum <= 2.1.8 - Cross-Site Scripting | wpforo forum | 6.1 (v3.1) | Medium |
| CVE-2023-23491 | Quick Event Manager < 9.7.5 - Cross-Site Scripting | quick event manager | 6.1 (v3.1) | Medium |
| CVE-2023-24278 | Squidex <7.4.0 - Cross-Site Scripting | squidex | 6.1 (v3.1) | Medium |
| CVE-2023-24367 | Temenos T24 R20 - Cross-Site Scripting | t24 | 6.1 | Medium |
| CVE-2023-24488 | Citrix Gateway and Citrix ADC - Cross-Site Scripting | gateway | 6.1 (v3.1) | Medium |
| CVE-2023-24657 | phpIPAM - 1.6 - Cross-Site Scripting | phpipam | 6.1 (v3.1) | Medium |
| CVE-2023-24733 | PMB 7.4.6 - Cross-Site Scripting | pmb | 6.1 (v3.1) | Medium |
| CVE-2023-24737 | PMB v7.4.6 - Cross-Site Scripting | pmb | 6.1 (v3.1) | Medium |
| CVE-2023-25346 | ChurchCRM 4.5.3 - Cross-Site Scripting | churchcrm | 6.1 (v3.1) | Medium |
| CVE-2023-27641 | L-Soft LISTSERV 16.5 - Cross-Site Scripting | listserv | 6.1 (v3.1) | Medium |
| CVE-2023-27922 | Newsletter < 7.6.9 - Cross-Site Scripting | newsletter | 6.1 (v3.1) | Medium |
| CVE-2023-29439 | FooGallery plugin <= 2.2.35 - Cross-Site Scripting | foogallery | 6.1 (v3.1) | Medium |
| CVE-2023-30210 | OURPHP <= 7.2.0 - Cross Site Scripting | ourphp | 6.1 (v3.1) | Medium |
| CVE-2023-30212 | OURPHP <= 7.2.0 - Cross Site Scripting | ourphp | 6.1 (v3.1) | Medium |
| CVE-2023-30868 | Tree Page View Plugin < 1.6.7 - Cross-Site Scripting | cms tree page view | 6.1 (v3.1) | Medium |
| CVE-2023-34599 | Gibbon v25.0.0 - Cross-Site Scripting | gibbon | 6.1 (v3.1) | Medium |
| CVE-2023-3479 | Hestiacp <= 1.7.7 - Cross-Site Scripting | control panel | 6.1 (v3.1) | Medium |
| CVE-2023-36306 | Adiscon LogAnalyzer v.4.1.13 - Cross-Site Scripting | loganalyzer | 6.1 (v3.1) | Medium |
| CVE-2023-36346 | POS Codekop v2.0 - Cross Site Scripting | codekop | 6.1 (v3.1) | Medium |
| CVE-2023-37988 | Contact Form Generator <= 2.5.5 - Cross-Site Scripting | contact form generator | 6.1 (v3.1) | Medium |
| CVE-2023-38040 | Revive Adserver 5.4.1 - Cross-Site Scripting | revive adserver | 6.1 (v3.1) | Medium |
| CVE-2023-38875 | PHP Login System 2.0.1 - Cross-Site Scripting | php-login-system | 6.1 (v3.1) | Medium |
| CVE-2023-39676 | PrestaShop fieldpopupnewsletter Module - Cross Site Scripting | fieldpopupnewsletter | 6.1 (v3.1) | Medium |
| CVE-2023-40755 | PHPJabbers Callback Widget v1.0 - Cross-Site Scripting | callback widget | 6.1 (v3.1) | Medium |
| CVE-2023-4110 | PHPJabbers Availability Booking Calendar 5.0 - Cross-Site Scripting | availability booking calendar | 6.1 (v3.1) | Medium |
| CVE-2023-4111 | PHPJabbers Bus Reservation System 1.1 - Cross-Site Scripting | bus reservation system | 6.1 (v3.1) | Medium |
| CVE-2023-4112 | PHPJabbers Shuttle Booking Software 1.0 - Cross Site Scripting | shuttle booking software | 6.1 (v3.1) | Medium |
| CVE-2023-4113 | PHPJabbers Service Booking Script 1.0 - Cross Site Scripting | service booking script | 6.1 (v3.1) | Medium |
| CVE-2023-4114 | PHP Jabbers Night Club Booking 1.0 - Cross Site Scripting | night club booking software | 6.1 (v3.1) | Medium |
| CVE-2023-4115 | PHPJabbers Cleaning Business 1.0 - Cross-Site Scripting | cleaning business software | 6.1 (v3.1) | Medium |
| CVE-2023-4116 | PHPJabbers Taxi Booking 2.0 - Cross Site Scripting | taxi booking script | 6.1 (v3.1) | Medium |
| CVE-2023-4136 | CrafterCMS Engine - Cross-Site Scripting | craftercms | 6.1 (v3.1) | Medium |
| CVE-2023-4148 | Ditty < 3.1.25 - Cross-Site Scripting | ditty | 6.1 (v3.1) | Medium |
| CVE-2023-41538 | PHPJabbers PHP Forum Script 3.0 - Cross-Site Scripting | php forum script | 6.1 (v3.1) | Medium |
| CVE-2023-41597 | EyouCms v1.6.2 - Cross-Site Scripting | eyoucms | 6.1 (v3.1) | Medium |
| CVE-2023-44352 | Adobe Coldfusion - Cross-Site Scripting | coldfusion | 6.1 (v3.1) | Medium |
| CVE-2023-44393 | Piwigo - Cross-Site Scripting | piwigo | 6.1 (v3.1) | Medium |
| CVE-2023-44812 | mooSocial v.3.1.8 - Cross-Site Scripting | moosocial | 6.1 (v3.1) | Medium |
| CVE-2023-4547 | SPA-Cart eCommerce CMS 1.9.0.3 - Cross-Site Scripting | ecommerce cms | 6.1 (v3.1) | Medium |
| CVE-2023-45542 | MooSocial 3.1.8 - Cross-Site Scripting | moosocial | 6.1 (v3.1) | Medium |
| CVE-2023-46732 | XWiki < 14.10.14 - Cross-Site Scripting | xwiki | 6.1 (v3.1) | Medium |
| CVE-2023-47684 | Essential Grid <= 3.1.0 - Cross-Site Scripting | essential grid | 6.1 (v3.1) | Medium |
| CVE-2023-48728 | WWBN AVideo 11.6 - Cross-Site Scripting | avideo | 6.1 (v3.1) | Medium |
| CVE-2023-49293 | Vite dev server - Cross-Site Scripting | vite | 6.1 (v3.1) | Medium |
| CVE-2023-5758 | firefox mobile Cross-Site Scripting Vulnerability | firefox mobile | 6.1 (v3.1) | Medium |
| CVE-2023-6275 | TOTVS Fluig Platform - Cross-Site Scripting | fluig | 6.1 (v3.1) | Medium |
| CVE-2023-6379 | OpenCMS 14 & 15 - Cross Site Scripting | opencms | 6.1 (v3.1) | Medium |
| CVE-2024-12585 | PropertyHive < 2.1.1 - Cross-Site Scripting | propertyhive | 6.1 (v3.1) | Medium |
| CVE-2024-12724 | WP DeskLite - Reflected XSS | wp desklite | 6.1 (v3.1) | Medium |
| CVE-2024-12732 | AffiliateImporterEb <= 1.0.6 - Reflected XSS | affiliateimportereb | 6.1 (v3.1) | Medium |
| CVE-2024-12734 | Advance Post Prefix WordPress plugin - Reflected XSS | advance post prefix | 6.1 (v3.1) | Medium |
| CVE-2024-12737 | WP BASE Booking - Reflected XSS | wp base booking of appointments, services and events | 6.1 (v3.1) | Medium |
| CVE-2024-12873 | Custom Field Manager WordPress - Cross-Site Scripting | custom field manager | 6.1 (v3.1) | Medium |
| CVE-2024-13112 | WP MediaTagger <= 4.1.1 - Cross-Site Scripting | wp mediatagger | 6.1 (v3.1) | Medium |
| CVE-2024-13114 | WP Projects Portfolio <= 3.0 - Cross-Site Scripting | wp projects portfolio with client testimonials | 6.1 (v3.1) | Medium |
| CVE-2024-13219 | Privacy Policy Genius - Cross-Site Scripting | privacy policy genius | 6.1 (v3.1) | Medium |
| CVE-2024-13220 | WordPress Google Map Professional - Cross-Site Scripting | google map professional | 6.1 (v3.1) | Medium |
| CVE-2024-13221 | Fantastic ElasticSearch Plugin <= 4.1.0 - Cross-Site Scripting | fantastic elasticsearch | 6.1 (v3.1) | Medium |
| CVE-2024-13222 | WordPress User Messages <= 1.2.4 - Reflected XSS | user messages | 6.1 (v3.1) | Medium |
| CVE-2024-13224 | SlideDeck 1 Lite Content Slider - Cross-Site Scripting | slidedeck 1 lite content slider | 6.1 (v3.1) | Medium |
| CVE-2024-13225 | ECT Home Page Products - Reflected XSS | ect home page products | 6.1 (v3.1) | Medium |
| CVE-2024-13226 | A5 Custom Login Page - Reflected XSS | a5 custom login page | 6.1 (v3.1) | Medium |
| CVE-2024-13325 | Glossy WordPress - Reflected XSS | glossy | 6.1 (v3.1) | Medium |
| CVE-2024-13326 | iBuildApp <= 0.2.0 - Reflected Cross-Site Scripting | ibuildapp | 6.1 (v3.1) | Medium |
| CVE-2024-13327 | Musicbox WordPress - Reflected XSS | musicbox | 6.1 (v3.1) | Medium |
| CVE-2024-13328 | Giga Messenger WordPress - Cross-Site Scripting | giga messenger | 6.1 (v3.1) | Medium |
| CVE-2024-13331 | WP Dream Carousel < 1.0.1b - Cross-Site Scripting | wp dream carousel | 6.1 (v3.1) | Medium |
| CVE-2024-13492 | Guten Free Options - Cross Site Scripting | guten free options | 6.1 (v3.1) | Medium |
| CVE-2024-13543 | Zarinpal Paid Download - Reflected XSS | zarinpal paid download | 6.1 (v3.1) | Medium |
| CVE-2024-13570 | WordPress Stray Random Quotes <= 1.9.9 - Cross-Site Scripting | stray random quotes | 6.1 (v3.1) | Medium |
| CVE-2024-13619 | LifterLMS < 8.0.1 - Cross-Site Scripting | lifterlms | 6.1 (v3.1) | Medium |
| CVE-2024-13628 | WP Pricing Table - Reflected XSS | wp pricing table | 6.1 (v3.1) | Medium |
| CVE-2024-13630 | NewsTicker <= 1.0 - Reflected Cross-Site Scripting | newsticker | 6.1 (v3.1) | Medium |
| CVE-2024-13634 | Post Sync Plugin <= 1.1 - Cross-Site Scripting | post sync | 6.1 (v3.1) | Medium |
| CVE-2024-13727 | MemberSpace WordPress - Cross-Site Scripting | memberspace | 6.1 (v3.1) | Medium |
| CVE-2024-13853 | WordPress SEO Tools Plugin 4.0.7 - Cross-Site Scripting | seo-automatic-seo-tools | 6.1 (v3.1) | Medium |
| CVE-2024-24131 | SuperWebMailer 9.31.0.01799 - Cross-Site Scripting | superwebmailer | 6.1 (v3.1) | Medium |
| CVE-2024-29931 | WP Go Maps <= 9.0.29 - Cross-Site Scripting | wp go maps | 6.1 (v3.1) | Medium |
| CVE-2024-33326 | LumisXP - Cross-site Scripting | lumis experience platform | 6.1 (v3.1) | Medium |
| CVE-2024-3469 | GP Premium <= 2.4.0 - Cross-Site Scripting | gp-premium | 6.1 (v3.1) | Medium |
| CVE-2024-35694 | Wordpress WPMobile.App >= 11.42 - Cross-Site Scripting | wpmobile.app | 6.1 (v3.1) | Medium |
| CVE-2024-41810 | Twisted - Open Redirect & XSS | twisted | 6.1 (v3.1) | Medium |
| CVE-2024-6651 | WordPress File Upload Plugin < 4.24.8 - Cross-Site Scripting | wp-file-upload | 6.1 (v3.1) | Medium |
| CVE-2024-7313 | Shield Security Plugin < 20.0.6 - Cross-Site Scripting | shield security | 6.1 (v3.1) | Medium |
| CVE-2024-7354 | Ninja Forms 3.8.6-3.8.10 - Cross-Site Scripting | ninja forms | 6.1 (v3.1) | Medium |
| CVE-2025-1303 | Plugin Oficial – Getnet para WooCommerce <= 1.8.0 - Cross-Site Scripting | plugin oficial | 6.1 (v3.1) | Medium |
| CVE-2025-27506 | NocoDB < 0.258.0 - Reflected XSS in Password Reset | nocodb | 6.1 (v3.1) | Medium |
| CVE-2025-4652 | Broadstreet WordPress plugin - Reflected XSS | broadstreet | 6.1 (v3.1) | Medium |
| CVE-2025-46549 | YesWiki <= 4.5.1 - Cross-Site Scripting | yeswiki | 6.1 (v3.1) | Medium |
| CVE-2025-46550 | YesWiki < 4.5.4 - Cross-Site Scripting | yeswiki | 6.1 (v3.1) | Medium |
| CVE-2025-51501 | Microweber CMS2.0 - Cross-Site Scripting | microweber | 6.1 (v3.1) | Medium |
| CVE-2025-51502 | Microweber CMS 2.0 - Reflected XSS in Admin Page Creation | microweber | 6.1 (v3.1) | Medium |
| CVE-2025-5301 | ONLYOFFICE Docs (DocumentServer) - Reflected Cross-Site Scripting | Docs (DocumentServer) | 6.1 (v3.1) | Medium |
| CVE-2025-54589 | Copyparty <=1.18.6 - Cross-Site Scripting | copyparty | 6.1 (v3.1) | Medium |
| CVE-2025-6174 | WordPress Qwizcards < 3.95 - Cross-Site Scripting (Reflected) | Qwizcards | online quizzes and flashcards | 6.1 (v3.1) | Medium |
| CVE-2025-63607 | TechStore 1.0 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium |
| CVE-2026-0561 | Shield Security <= 21.0.8 - Unauthenticated Reflected XSS | shield-security | 6.1 (v3.1) | Medium |
| CVE-2026-11881 | Fluent Forms < 6.2.6 - Contributor+ Stored XSS via Date/Time Field | Fluent Forms | 6.1 (v3.1) | Medium |
| CVE-2026-12982 | Document Gallery < 5.1.1 - Reflected XSS via dg_generate_gallery | Document Gallery | 6.1 (v3.1) | Medium |
| CVE-2026-14207 | LifterLMS < 10.0.10 - Instructor+ Stored XSS via Featured Pricing Information | LifterLMS | 6.1 (v3.1) | Medium |
| CVE-2026-14845 | NewStatPress < 1.4.5 - Unauthenticated Stored XSS via Top Post Widget | NewStatPress | 6.1 (v3.1) | Medium |
| CVE-2026-14921 | Ultimate Addons for WPBakery Page Builder < 3.21.5 - Contributor+ Stored XSS via ult_buttons Shortcode | Ultimate Addons for WPBakery Page Builder | 6.1 (v3.1) | Medium |
| CVE-2026-17532 | Seraphinite Accelerator <= 2.29.18 - Reflected Cross-Site Scripting | Seraphinite Accelerator | 6.1 (v3.1) | Medium |
| CVE-2026-29183 | SiYuan Note - Cross-Site Scripting | siyuan | 6.1 (v3.1) | Medium |
| CVE-2026-3001 | Gutenverse Plugin <= 3.4.6 - Cross-Site Scripting | gutenverse | 6.1 (v3.1) | Medium |
| CVE-2026-30251 | zenshare suite Cross-Site Scripting Vulnerability | zenshare suite | 6.1 (v3.1) | Medium |
| CVE-2026-30252 | zencrm Cross-Site Scripting Vulnerability | zencrm | 6.1 (v3.1) | Medium |
| CVE-2026-34206 | Captcha Protect: Reflected XSS in challenge page via unsanitized destination rendered with text/template | captcha protect | 6.1 (v3.1) | Medium |
| CVE-2026-34739 | AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php | avideo | 6.1 (v3.1) | Medium |
| CVE-2026-37750 | School Management System by mahmoudai1 Cross-Site Scripting Vulnerability | School Management System by mahmoudai1 | 6.1 (v3.1) | Medium |
| CVE-2026-38444 | osTicket v1.18.3 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium |
| CVE-2026-38472 | forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 Cross-Site Scripting Vulnerability | forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 | 6.1 (v3.1) | Medium |
| CVE-2026-38947 | FluentCMS 1.2.3 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium |
| CVE-2026-42253 | Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties | activemq | 6.1 (v3.1) | Medium |
| CVE-2026-50229 | Apache Tomcat - Cross-Site Scripting | tomcat | 6.1 (v3.1) | Medium |
| CVE-2026-51565 | Modules/Docs/DocsController.php in Milk admin <=0.9.8 Cross-Site Scripting Vulnerability | Modules/Docs/DocsController.php in Milk admin <=0.9.8 | 6.1 (v3.1) | Medium |
| CVE-2026-52232 | FS Inc S3150-8T2F Switch 2.2.0D Build 118101 Cross-Site Scripting Vulnerability | FS Inc S3150-8T2F Switch 2.2.0D Build 118101 | 6.1 (v3.1) | Medium |
| CVE-2026-55087 | Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (ope | etherpad | 6.1 (v3.1) | Medium |
| CVE-2026-61526 | AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler | http-server | 6.1 (v3.1) | Medium |
| CVE-2026-73084 | Activepieces: Reflected Cross-Site Scripting in OAuth Redirect Endpoint | activepieces | 6.1 (v3.1) | Medium |
| CVE-2026-8447 | Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untruste | langflow | 6.1 (v3.1) | Medium |
| CVE-2023-6717 | Keycloak: xss via assertion consumer service url in saml post-binding flow | Red Hat AMQ Broker 7 | 6.0 (v3.1) | Medium |
| CVE-2026-8245 | Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection | concrete cms | 6.0 (v4.0) | Medium |
| CVE-2024-3753 | Hostel < 1.1.5.3 - Cross-Site Scripting | hostel | 5.9 (v3.1) | Medium |
| CVE-2026-84193 | LibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP | librenms | 5.8 (v4.0) | Medium |
| CVE-2016-10993 | ScoreMe Theme - Cross-Site Scripting | scoreme | 5.4 (v3.1) | Medium |
| CVE-2017-3131 | Fortinet FortiOS < 5.6.0 - Cross-Site Scripting | fortios | 5.4 (v3.0) | Medium |
| CVE-2018-12095 | OEcms 3.1 - Cross-Site Scripting | oecms | 5.4 (v3.0) | Medium |
| CVE-2018-15917 | Jorani Leave Management System 0.6.5 - Cross-Site Scripting | jorani | 5.4 (v3.0) | Medium |
| CVE-2018-16363 | WordPress File Manager < 3.0 - Cross-Site Scripting | file manager | 5.4 (v3.0) | Medium |
| CVE-2018-8024 | Apache Spark UI - Cross-Site Scripting | spark | 5.4 (v3.0) | Medium |
| CVE-2020-12256 | rConfig 3.9.4 - Cross-Site Scripting | rconfig | 5.4 (v3.1) | Medium |
| CVE-2020-12259 | rConfig 3.9.4 - Cross-Site Scripting | rconfig | 5.4 (v3.1) | Medium |
| CVE-2020-12262 | Intelbras TIP200/TIP200LITE/TIP300 - Cross-Site Scripting | tip300 | 5.4 (v3.1) | Medium |
| CVE-2020-35774 | twitter-server Cross-Site Scripting | twitter-server | 5.4 (v3.1) | Medium |
| CVE-2020-7108 | WordPress Plugin LearnDash LMS 3.1.2 - Reflective Cross-Site Scripting | learndash | 5.4 (v3.1) | Medium |
| CVE-2021-25065 | Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting | smash balloon social post feed | 5.4 (v3.1) | Medium |
| CVE-2021-31250 | CHIYU TCP/IP Converter - Cross-Site Scripting | bf-430 firmware | 5.4 (v3.1) | Medium |
| CVE-2022-25489 | Atom CMS v2.0 - Cross-Site Scripting | atomcms | 5.4 (v3.1) | Medium |
| CVE-2022-3933 | WordPress Essential Real Estate <3.9.6 - Authenticated Cross-Site Scripting | essential real estate | 5.4 (v3.1) | Medium |
| CVE-2023-1315 | osTicket < v1.16.6 - Cross-Site Scripting | osticket | 5.4 (v3.1) | Medium |
| CVE-2023-1318 | osTicket < v1.16.6 - Cross-Site Scripting | osticket | 5.4 (v3.1) | Medium |
| CVE-2023-40753 | PHPJabbers Ticket Support Script v3.2 - Cross-Site Scripting | ticket support script | 5.4 (v3.1) | Medium |
| CVE-2024-10146 | Simple File List < 6.1.13 - Reflected Cross-Site Scripting | simple file list | 5.4 (v3.1) | Medium |
| CVE-2024-13097 | WP Finance Plugin <= 1.3.6 - Cross-Site Scripting | wp finance | 5.4 (v3.1) | Medium |
| CVE-2024-13098 | WordPress Email Newsletter - Reflected XSS | wordpress email newsletter | 5.4 (v3.1) | Medium |
| CVE-2024-13099 | Widget4Call WordPress - Cross-Site Scripting | widget4call | 5.4 (v3.1) | Medium |
| CVE-2024-33724 | SOPlanning 1.52.00 Cross Site Scripting | soplanning | 5.4 (v3.1) | Medium |
| CVE-2024-52762 | Ganglia Web Interface (v3.7.3 - v3.7.6) - Cross-Site Scripting | ganglia-web | 5.4 (v3.1) | Medium |
| CVE-2026-15234 | Codeless Page Builder <= 1.1.4 - Contributor+ Stored XSS via Shortcode Attribute | Codeless Page Builder | 5.4 (v3.1) | Medium |
| CVE-2026-15245 | BNE Testimonials < 2.0.8.2 - Contributor+ Stored XSS via Slider Shortcode | BNE Testimonials | 5.4 (v3.1) | Medium |
| CVE-2026-15262 | Admin Columns for ACF Fields <= 0.3.2 - Contributor+ Stored XSS via ACF Field Value Column | Admin Columns for ACF Fields | 5.4 (v3.1) | Medium |
| CVE-2026-16063 | Event Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event Timeline Content | Event Booking Manager for WooCommerce | 5.4 (v3.1) | Medium |
| CVE-2026-16537 | Slick Slider < 0.5.3 - Contributor+ Stored XSS via Gallery Shortcode | Slick Slider | 5.4 (v3.1) | Medium |
| CVE-2026-18395 | Child Pages Card < 1.09 - Contributor+ Stored XSS via Shortcode Attributes | Child Pages Card | 5.4 (v3.1) | Medium |
| CVE-2026-34974 | phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding leads to Stored XSS and Privilege Escalation | phpmyfaq | 5.4 (v3.1) | Medium |
| CVE-2026-35403 | LORIS has potential cross-site scripting in survey_accounts module | loris | 5.4 (v3.1) | Medium |
| CVE-2026-38473 | the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 Cross-Site Scripting Vulnerability | the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 | 5.4 (v3.1) | Medium |
| CVE-2026-39964 | TypeBot: Stored XSS via javascript: URI in text bubble links — bot author executes JS on visitors' browsers | typebot.io | 5.4 (v3.1) | Medium |
| CVE-2026-45694 | LibreNMS: Reflected XSS in the Proxmox app view via unsanitized instance/vmid parameters | librenms | 5.4 (v3.1) | Medium |
| CVE-2026-72570 | cube-root directory-serve - Stored Cross-Site Scripting via Malicious Filename | directory-serve | 5.4 (v3.1) | Medium |
| CVE-2026-72583 | fastschema - Stored Cross-Site Scripting via MIME Type Bypass in File Upload | fastschema | 5.4 (v3.1) | Medium |
| CVE-2026-82396 | Sulu: Stored XSS via media download inline-disposition override | sulu | 5.4 (v3.1) | Medium |
| CVE-2019-17503 | Kirona-DRS 5.5.3.5 - Information Disclosure | dynamic resource scheduling | 5.3 (v3.1) | Medium |
| CVE-2024-11587 | idcCMS V1.60 - Cross-Site Scripting | idccms | 5.3 (v4.0) | Medium |
| CVE-2025-2127 | JoomlaUX JUX Real Estate 3.4.0 - Reflected XSS | jux real estate | 5.3 (v4.0) | Medium |
| CVE-2025-2710 | Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting | ufida erp-nc | 5.3 (v4.0) | Medium |
| CVE-2025-2711 | Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting | ufida erp-nc | 5.3 (v4.0) | Medium |
| CVE-2025-2712 | Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting | ufida erp-nc | 5.3 (v4.0) | Medium |
| CVE-2026-35208 | lichess.org has an Unsanitized Stream Title Injection on /streamer | lila | 5.3 (v4.0) | Medium |
| CVE-2026-48094 | ShareOpenly has Cross-Site Scripting (XSS) via Missing esc_url() on Shared URL in Content Output | shareopenly | 5.3 (v4.0) | Medium |
| CVE-2026-5808 | openstatusHQ openstatus Onboarding Endpoint client.tsx cross site scripting | openstatus | 5.3 (v4.0) | Medium |
| CVE-2026-73422 | Astro: Reflected XSS via unescaped View Transition animation properties | astro | 5.3 (v4.0) | Medium |
| CVE-2026-73628 | Serendipity 2.3.5 Reflected XSS via search clean-URL route | Serendipity | 5.3 (v4.0) | Medium |
| CVE-2026-82451 | Formwork through 2.3.14 Stored XSS via Referer Header | Formwork | 5.3 (v4.0) | Medium |
| CVE-2026-82646 | WWBN AVideo Unauthenticated Reflected XSS via url2Embed.json.php | AVideo | 5.3 (v4.0) | Medium |
| CVE-2026-85158 | AVideo Reflected XSS via videoEmbeded.php link parameter | AVideo | 5.3 (v4.0) | Medium |
| CVE-2026-85159 | AVideo Reflected XSS via cancelUri in userLogin.php | AVideo | 5.3 (v4.0) | Medium |
| CVE-2026-85577 | AVideo userLogin.php Reflected XSS via error parameter | AVideo | 5.3 (v4.0) | Medium |
| CVE-2026-89240 | WWBN AVideo Reflected XSS via confirmLivePassword.php | AVideo | 5.3 (v4.0) | Medium |
| CVE-2026-89241 | WWBN AVideo Reflected XSS via confirmLivePassword.php | AVideo | 5.3 (v4.0) | Medium |
| CVE-2026-89244 | WWBN AVideo Reflected XSS via Gallery Category getBackURL | AVideo | 5.3 (v4.0) | Medium |
| CVE-2018-25349 | userSpice 4.3.24 Cross-Site Scripting via X-Forwarded-For Header | userSpice | 5.1 (v4.0) | Medium |
| CVE-2022-50943 | Moodle LMS 4.0 Cross-Site Scripting via course search.php | moodle | 5.1 (v4.0) | Medium |
| CVE-2022-50948 | Motopress Hotel Booking Lite 4.2.4 Stored Cross-Site Scripting | Motopress Hotel Booking Lite | 5.1 (v4.0) | Medium |
| CVE-2022-50958 | WordPress Plugin Jetpack 9.1 Cross Site Scripting via grunion-form-view.php | Jetpack | 5.1 (v4.0) | Medium |
| CVE-2022-50959 | WordPress Contact Form Builder 1.6.1 Cross-Site Scripting via code_generator.php | Contact Form Builder | 5.1 (v4.0) | Medium |
| CVE-2022-50960 | WordPress International Sms Contact Form 7 Integration 1.2 XSS | International Sms For Contact Form | 5.1 (v4.0) | Medium |
| CVE-2022-50962 | uBidAuction 2.0.1 myOrders Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium |
| CVE-2022-50963 | uBidAuction 2.0.1 myAuctions active Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium |
| CVE-2022-50964 | uBidAuction 2.0.1 myAuctions loose Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium |
| CVE-2022-50965 | uBidAuction 2.0.1 posts manage Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium |
| CVE-2022-50966 | uBidAuction 2.0.1 news manage Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium |
| CVE-2022-50968 | uBidAuction 2.0.1 auctions manage Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium |
| CVE-2022-50969 | uBidAuction 2.0.1 mailingLog manage Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium |
| CVE-2022-50970 | WordPress Plugin AAWP 3.16 Reflected XSS via tab Parameter | WordPress Plugin AAWP | 5.1 (v4.0) | Medium |
| CVE-2025-34032 | Moodle LMS Jmol Plugin <= 6.1 - Cross-Site Scripting | jmol | 5.1 (v4.0) | Medium |
| CVE-2025-41393 | Ricoh Web Image Monitor - Reflected XSS | Multiple laser printers and MFPs which implement Web Image Monitor | 5.1 (v4.0) | Medium |
| CVE-2025-71404 | better-auth before 1.1.16 Reflected XSS via error parameter | better-auth | 5.1 (v4.0) | Medium |
| CVE-2026-22675 | OCS Inventory NG Server Stored XSS via User-Agent | ocs inventory server | 5.1 (v4.0) | Medium |
| CVE-2026-25557 | Evoluted PHP Directory Listing Script 4.0.5 Reflected XSS via dir parameter | PHP Directory Listing Script | 5.1 (v4.0) | Medium |
| CVE-2026-32856 | Ellucian Banner Self-Service Reflected XSS via dateConverter | Banner Self-Service | 5.1 (v4.0) | Medium |
| CVE-2026-34416 | OSCAL-GUI Reflected XSS via project parameter in oscal.php | OSCAL-GUI | 5.1 (v4.0) | Medium |
| CVE-2026-34417 | OSCAL-GUI Reflected XSS via project parameter in oscal-forms.php | OSCAL-GUI | 5.1 (v4.0) | Medium |
| CVE-2026-34798 | Endian Firewall /cgi-bin/routing.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34800 | Endian Firewall /cgi-bin/uplinkeditor.cgi NAME Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34802 | Endian Firewall /cgi-bin/salearn.cgi remark user ham spam Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34803 | Endian Firewall /manage/qos/classes/ name Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34804 | Endian Firewall /manage/qos/rules/ dscp Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34805 | Endian Firewall /cgi-bin/dnat.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34806 | Endian Firewall /cgi-bin/snat.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34807 | Endian Firewall /cgi-bin/incoming.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34808 | Endian Firewall /cgi-bin/outgoingfw.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34809 | Endian Firewall /cgi-bin/zonefw.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34810 | Endian Firewall /cgi-bin/vpnfw.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34811 | Endian Firewall /cgi-bin/xtaccess.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34812 | Endian Firewall /cgi-bin/proxypolicy.cgi mimetypes Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34813 | Endian Firewall /cgi-bin/proxyuser.cgi user Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34814 | Endian Firewall /cgi-bin/proxygroup.cgi group Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34815 | Endian Firewall /cgi-bin/smtpdomains.cgi DOMAIN Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34816 | Endian Firewall /manage/smtpscan/domainrouting/ domain Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34817 | Endian Firewall /cgi-bin/smtprouting.cgi ADDRESS BCC Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34818 | Endian Firewall /manage/dnsmasq/localdomains/ remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34819 | Endian Firewall /cgi-bin/openvpnclient.cgi REMARK Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34820 | Endian Firewall /manage/ipsec/ remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34822 | Endian Firewall /manage/ca/certificate/ new_cert_name Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34823 | Endian Firewall /manage/password/web/ remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-35007 | Open ISES Tickets < 3.44.2 Reflected XSS via single_unit.php id Parameter | tickets | 5.1 (v4.0) | Medium |
| CVE-2026-35008 | Open ISES Tickets < 3.44.2 Reflected XSS via single.php ticket_id Parameter | tickets | 5.1 (v4.0) | Medium |
| CVE-2026-35009 | Open ISES Tickets < 3.44.2 Reflected XSS via add_note.php ticket_id Parameter | tickets | 5.1 (v4.0) | Medium |
| CVE-2026-35010 | Open ISES Tickets < 3.44.2 Reflected XSS via patient_JF.php ticket_id Parameter | tickets | 5.1 (v4.0) | Medium |
| CVE-2026-35011 | Open ISES Tickets < 3.44.2 Reflected XSS via opena.php frm_call Parameter | tickets | 5.1 (v4.0) | Medium |
| CVE-2026-35012 | Open ISES Tickets < 3.44.2 Reflected XSS via add_facnote.php ticket_id Parameter | tickets | 5.1 (v4.0) | Medium |
| CVE-2026-35014 | Open ISES Tickets < 3.44.2 Reflected XSS via routes_nm.php ticket_id Parameter | tickets | 5.1 (v4.0) | Medium |
| CVE-2026-35015 | Open ISES Tickets < 3.44.2 Reflected XSS via do_unit_mail.php the_ticket Parameter | tickets | 5.1 (v4.0) | Medium |
| CVE-2026-40507 | OpenEMR < 8.3.0 Reflected XSS via templateHtml Parameter in Patient Portal | openemr | 5.1 (v4.0) | Medium |
| CVE-2026-40508 | OpenEMR < 8.3.0 Stored XSS via Patient Portal Template Import Handler | openemr | 5.1 (v4.0) | Medium |
| CVE-2026-48227 | Open ISES Tickets < 3.44.2 Reflected XSS via patient.php id and ticket_id Parameters | Tickets | 5.1 (v4.0) | Medium |
| CVE-2026-48228 | Open ISES Tickets < 3.44.2 Reflected XSS via patient_w.php id and ticket_id Parameters | Tickets | 5.1 (v4.0) | Medium |
| CVE-2026-48229 | Open ISES Tickets < 3.44.2 Reflected XSS via routes_i.php ticket_id Parameter | Tickets | 5.1 (v4.0) | Medium |
| CVE-2026-48534 | GFI Archiver < 15.13 Stored XSS via ImapServerWizard.aspx | GFI Archiver | 5.1 (v4.0) | Medium |
| CVE-2026-48537 | GFI Archiver < 15.13 Stored XSS via FileArchiveAssistantWizard.aspx | GFI Archiver | 5.1 (v4.0) | Medium |
| CVE-2026-48538 | GFI Archiver < 15.13 Stored XSS via ImportSettingsWizard.ashx | GFI Archiver | 5.1 (v4.0) | Medium |
| CVE-2026-48552 | Nagios Core / XI DOM-based XSS via jsonquery.js | Nagios Core | 5.1 (v4.0) | Medium |
| CVE-2026-50230 | Lyrion Music Server <= 9.2.0 - Cross-Site Scripting | Lyrion Music Server | 5.1 (v4.0) | Medium |
| CVE-2026-53992 | Reflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date Parameters | ProjectSend | 5.1 (v4.0) | Medium |
| CVE-2026-57857 | Flow Payment Plugin for WordPress Reflected Cross-Site Scripting via error_message Parameter | Flow Payment | 5.1 (v4.0) | Medium |
| CVE-2026-65697 | Fathom Lite 1.3.1 Stored XSS via /collect Endpoint | fathom | 5.1 (v4.0) | Medium |
| CVE-2026-66296 | Reflected XSS in oaskit's default HTML error handler | oaskit | 5.1 (v4.0) | Medium |
| CVE-2026-67333 | better-auth before 1.6.13 Stored XSS via javascript redirect_uri | better-auth | 5.1 (v4.0) | Medium |
| CVE-2026-71503 | Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template | dolibarr | 5.1 (v4.0) | Medium |
| CVE-2026-73319 | XenForo < 2.3.13 XSS via Dynamic Redirect Handler | xenforo | 5.1 (v4.0) | Medium |
| CVE-2026-75831 | Grav before 2.0.15 Stored XSS via audio/video source URL | grav | 5.1 (v4.0) | Medium |
| CVE-2026-85593 | phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode | phpMyFAQ | 5.1 (v4.0) | Medium |
| CVE-2026-85600 | Grav Admin before 2.0.21 Stored XSS via username | grav-plugin-admin2 | 5.1 (v4.0) | Medium |
| CVE-2026-86197 | Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox | grav | 5.1 (v4.0) | Medium |
| CVE-2024-11921 | Give WP Plugin < 3.19.0 - Cross-Site Scripting | givewp | 4.8 (v3.1) | Medium |
| CVE-2024-3822 | Base64 Encoder/Decoder <= 0.9.2 - Reflected XSS | base64 encoderdecoder | 4.8 (v3.1) | Medium |
| CVE-2024-50857 | GestioIP - Reflected Cross-Site Scripting | gestioip | 4.8 (v3.1) | Medium |
| CVE-2025-15669 | Bit Form < 3.1.4 - Admin+ Stored XSS via Conversational Form Progress Label | Bit Form | 4.8 (v3.1) | Medium |
| CVE-2026-14203 | Smart Manager < 8.92.0 - Contributor+ Stored XSS via Post Title | Smart Manager | 4.8 (v3.1) | Medium |
| CVE-2026-15233 | Nested Pages < 3.2.15 - Editor+ Stored XSS via Post Title | Nested Pages | 4.8 (v3.1) | Medium |
| CVE-2026-46516 | Frogman vulnerable to stored XSS in chat console formatter (escalation vector in multi-admin deployments) | frogman | 4.8 (v4.0) | Medium |
| CVE-2026-67612 | OpenEMR 8.2.0 Stored XSS via import_template.php Template Management | openemr | 4.8 (v4.0) | Medium |
| CVE-2026-67617 | Microweber CMS 2.0.20 Stored XSS via tag_names Parameter | microweber | 4.8 (v4.0) | Medium |
| CVE-2026-84188 | librenms before 26.7.0 Stored XSS via graph_descr settings | librenms | 4.8 (v4.0) | Medium |
| CVE-2026-9577 | Post Status Notifier Lite < 1.13.0 - Reflected XSS via mod Parameter | Post Status Notifier Lite | 4.8 (v3.1) | Medium |
| CVE-2024-13627 | OWL Carousel Slider - Cross-Site Scripting | owl carousel slider | 4.7 (v3.1) | Medium |
| CVE-2026-3093 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab | gitlab | 4.7 (v3.1) | Medium |
| CVE-2005-3128 | SquirrelMail Address Add 1.4.2 - Cross-Site Scripting | address add plugin | 4.3 (v2.0) | Medium |
| CVE-2005-4385 | Cofax <=2.0RC3 - Cross-Site Scripting | cofax | 4.3 (v2.0) | Medium |
| CVE-2006-1681 | Cherokee HTTPD <=0.5 - Cross-Site Scripting | cherokee httpd | 4.3 (v2.0) | Medium |
| CVE-2007-2449 | Apache Tomcat 4.x-7.x - Cross-Site Scripting | tomcat | 4.3 (v2.0) | Medium |
| CVE-2007-5728 | phpPgAdmin <=4.1.1 - Cross-Site Scripting | phppgadmin | 4.3 (v2.0) | Medium |
| CVE-2008-1061 | WordPress Sniplets <=1.2.2 - Cross-Site Scripting | sniplets plugin | 4.3 (v2.0) | Medium |
| CVE-2008-6982 | Devalcms 1.4a - Cross-Site Scripting | devalcms | 4.3 (v2.0) | Medium |
| CVE-2009-1872 | Adobe Coldfusion <=8.0.1 - Cross-Site Scripting | coldfusion | 4.3 (v2.0) | Medium |
| CVE-2011-4618 | Advanced Text Widget < 2.0.2 - Cross-Site Scripting | advanced text widget plugin | 4.3 (v2.0) | Medium |
| CVE-2011-4624 | GRAND FlAGallery 1.57 - Cross-Site Scripting | grand flagallery | 4.3 (v2.0) | Medium |
| CVE-2011-4926 | Adminimize 1.7.22 - Cross-Site Scripting | adminimize | 4.3 (v2.0) | Medium |
| CVE-2011-5106 | WordPress Plugin Flexible Custom Post Type < 0.1.7 - Cross-Site Scripting | flexible custom post type | 4.3 (v2.0) | Medium |
| CVE-2011-5107 | Alert Before Your Post <= 0.1.1 - Cross-Site Scripting | alert before you post | 4.3 (v2.0) | Medium |
| CVE-2011-5179 | Skysa App Bar 1.04 - Cross-Site Scripting | skysa app bar integration plugin | 4.3 (v2.0) | Medium |
| CVE-2011-5181 | ClickDesk Live Support Live Chat 2.0 - Cross-Site Scripting | clickdesk live support-live chat plugin | 4.3 (v2.0) | Medium |
| CVE-2011-5265 | Featurific For WordPress 1.6.2 - Cross-Site Scripting | featurific-for-wordpress | 4.3 (v2.0) | Medium |
| CVE-2012-0901 | YouSayToo auto-publishing 1.0 - Cross-Site Scripting | yousaytoo | 4.3 (v2.0) | Medium |
| CVE-2012-1835 | WordPress Plugin All-in-One Event Calendar 1.4 - Cross-Site Scripting | all-in-one event calendar | 4.3 (v2.0) | Medium |
| CVE-2012-2371 | WP-FaceThumb 0.1 - Cross-Site Scripting | wp-facethumb | 4.3 (v2.0) | Medium |
| CVE-2012-4242 | WordPress Plugin MF Gig Calendar 0.9.2 - Cross-Site Scripting | mf gig calendar | 4.3 (v2.0) | Medium |
| CVE-2012-4273 | 2 Click Socialmedia Buttons < 0.34 - Cross-Site Scripting | 2-click-social-media-buttons | 4.3 (v2.0) | Medium |
| CVE-2012-4547 | AWStats 6.95/7.0 - 'awredir.pl' Cross-Site Scripting | awstats | 4.3 (v2.0) | Medium |
| CVE-2012-4768 | WordPress Plugin Download Monitor < 3.3.5.9 - Cross-Site Scripting | download monitor | 4.3 (v2.0) | Medium |
| CVE-2012-4889 | ManageEngine Firewall Analyzer 7.2 - Cross-Site Scripting | firewall analyzer | 4.3 (v2.0) | Medium |
| CVE-2012-5913 | WordPress Integrator 1.32 - Cross-Site Scripting | wordpress integrator | 4.3 (v2.0) | Medium |
| CVE-2013-2287 | WordPress Plugin Uploader 1.0.4 - Cross-Site Scripting | uploader | 4.3 (v2.0) | Medium |
| CVE-2013-3526 | WordPress Plugin Traffic Analyzer - 'aoid' Cross-Site Scripting | trafficanalyzer | 4.3 (v2.0) | Medium |
| CVE-2013-4117 | WordPress Plugin Category Grid View Gallery 2.3.1 - Cross-Site Scripting | category-grid-view-gallery | 4.3 (v2.0) | Medium |
| CVE-2013-4625 | WordPress Plugin Duplicator < 0.4.5 - Cross-Site Scripting | duplicator | 4.3 (v2.0) | Medium |
| CVE-2013-6281 | WordPress Spreadsheet - Cross-Site Scripting | dhtmlxspreadsheet | 4.3 (v2.0) | Medium |
| CVE-2014-2908 | Siemens SIMATIC S7-1200 CPU - Cross-Site Scripting | simatic s7 cpu 1200 firmware | 4.3 (v2.0) | Medium |
| CVE-2014-4513 | ActiveHelper LiveHelp Server 3.1.0 - Cross-Site Scripting | activehelper livehelp live chat | 4.3 (v2.0) | Medium |
| CVE-2014-9094 | WordPress DZS-VideoGallery Plugin Cross-Site Scripting | video gallery | 4.3 (v2.0) | Medium |
| CVE-2014-9444 | Frontend Uploader <= 0.9.2 - Cross-Site Scripting | frontend uploader | 4.3 (v2.0) | Medium |
| CVE-2015-1880 | Fortinet FortiOS <=5.2.3 - Cross-Site Scripting | fortios | 4.3 (v2.0) | Medium |
| CVE-2015-2068 | Magento Server Mass Importer - Cross-Site Scripting | magmi | 4.3 (v2.0) | Medium |
| CVE-2015-2807 | Navis DocumentCloud <0.1.1 - Cross-Site Scripting | navis documentcloud | 4.3 (v2.0) | Medium |
| CVE-2015-4127 | WordPress Church Admin <0.810 - Cross-Site Scripting | church admin | 4.3 (v2.0) | Medium |
| CVE-2015-6920 | WordPress sourceAFRICA <=0.1.3 - Cross-Site Scripting | sourceafrica | 4.3 (v2.0) | Medium |
| CVE-2021-42663 | Sourcecodester Online Event Booking and Reservation System 2.3.0 - Cross-Site Scripting | online event booking and reservation system | 4.3 (v3.1) | Medium |
| CVE-2025-41228 | VMware vSphere Client 8.0.3.0 - Reflected Cross-Site Scripting (XSS) | vCenter Server | 4.3 (v3.1) | Medium |
| CVE-2026-32250 | NamelessMC has Reflected Cross-Site Scripting (XSS) in id parameter of /index.php?route=/queries/user/ | Nameless | 4.3 (v3.1) | Medium |
| CVE-2026-55566 | Yamcs: DOM XSS in Extension Routing | yamcs | 4.3 (v3.1) | Medium |
| CVE-2015-4063 | NewStatPress <0.9.9 - Cross-Site Scripting | newstatpress | 3.5 (v2.0) | Low |
| CVE-2026-9061 | Agile Store Locator < 1.6.9 - Admin+ Stored XSS via logo_name | Store Locator WordPress | 3.5 (v3.1) | Low |
| CVE-2025-0133 | PAN-OS - Reflected Cross-Site Scripting | PAN-OS | 2.7 (v4.0) | Low |
| CVE-2026-66300 | SNOMED International Snowstorm reflected XSS | Snowstorm | 2.3 (v4.0) | Low |
| CVE-2026-10153 | westboy CicadasCMS AbstractCacheManager.java search cross site scripting | CicadasCMS | 2.1 (v4.0) | Low |
| CVE-2026-10173 | Orthanc Explorer 2 URL StudyList.vue cross site scripting | Explorer 2 | 2.1 (v4.0) | Low |
| CVE-2026-10301 | itsourcecode Fees Management System index.php cross site scripting | Fees Management System | 2.1 (v4.0) | Low |
| CVE-2026-10810 | itsourcecode Fees Management System navbar.php cross site scripting | Fees Management System | 2.1 (v4.0) | Low |
| CVE-2026-11436 | Mage AI Sign-in Flow index.tsx useMutation cross site scripting | Mage AI | 2.1 (v4.0) | Low |
| CVE-2026-11512 | itsourcecode Hospital Management System billing.php cross site scripting | Hospital Management System | 2.1 (v4.0) | Low |
| CVE-2026-16220 | code-projects Online Examination System account.php cross site scripting | Online Examination System | 2.1 (v4.0) | Low |
| CVE-2026-16229 | itsourcecode Courier Management System index.php cross site scripting | Courier Management System | 2.1 (v4.0) | Low |
| CVE-2026-16485 | SourceCodester Class and Exam Timetabling System class.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low |
| CVE-2026-16486 | SourceCodester Class and Exam Timetabling System BSIS.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low |
| CVE-2026-18968 | ttttonyhe OBlog tags.php cross site scripting | OBlog | 2.1 (v4.0) | Low |
| CVE-2026-5825 | code-projects Simple Laundry System delmemberinfo.php cross site scripting | Simple Laundry System | 2.1 (v4.0) | Low |
| CVE-2026-5826 | code-projects Simple IT Discussion Forum edit-category.php cross site scripting | Simple IT Discussion Forum | 2.1 (v4.0) | Low |
| CVE-2026-66882 | Reflected XSS in AshAuthentication confirmation and magic link interaction forms | ash authentication | 2.1 (v4.0) | Low |
| CVE-2026-75077 | SourceCodester Class and Exam Timetabling System BSCE2.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low |
| CVE-2026-75078 | SourceCodester Class and Exam Timetabling System BSHRM1.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low |
| CVE-2026-78054 | SourceCodester Class and Exam Timetabling System BSIS1.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low |
| CVE-2026-78055 | SourceCodester Class and Exam Timetabling System BSIT2.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low |
| CVE-2026-79793 | code-projects Online Shopping System sumit_form.php cross site scripting | Online Shopping System | 2.1 (v4.0) | Low |
| CVE-2026-82601 | SeaCMS err.php cross site scripting | SeaCMS | 2.1 (v4.0) | Low |
| CVE-2026-82664 | yaojingang GEOFlow JSON-LD Theme HomeController.php cross site scripting | GEOFlow | 2.1 (v4.0) | Low |
| CVE-2026-85021 | langgenius dify Splash Layout splash.tsx router.replace cross site scripting | dify | 2.1 (v4.0) | Low |
| CVE-2026-86216 | code-projects Hotel and Tourism Reservation in PHP details.php cross site scripting | Hotel and Tourism Reservation in PHP | 2.1 (v4.0) | Low |
| CVE-2026-86244 | FastAdmin User Controller User.php login cross site scripting | FastAdmin | 2.1 (v4.0) | Low |
| CVE-2026-86278 | SourceCodester Syllabus-Aligned Learning Management & Examination System manage_subjects.php cross site scripting | Syllabus-Aligned Learning Management & Examination System | 2.1 (v4.0) | Low |
| CVE-2026-87926 | Rizwan17 inventory-management-system Login Page index.php cross site scripting | inventory-management-system | 2.1 (v4.0) | Low |
| CVE-2026-9415 | code-projects Employee Management System eloginwel.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low |
| CVE-2026-9416 | code-projects Employee Management System myprofile.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low |
| CVE-2026-9417 | code-projects Employee Management System myprofileup.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low |
| CVE-2026-9418 | code-projects Employee Management System changepassemp.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low |
| CVE-2026-9419 | code-projects Employee Management System empproject.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low |
| CVE-2026-9448 | code-projects Employee Management System applyleave.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low |
| CVE-2026-9519 | stonith404 pingvin-share Sign-in Auto-Redirect signIn.tsx getServerSideProps cross site scripting | pingvin-share | 2.1 (v4.0) | Low |
| CVE-2026-9520 | blitz-js blitz Sign-in LoginForm.tsx cross site scripting | blitz | 2.1 (v4.0) | Low |
| CVE-2026-9527 | itsourcecode Electronic Judging System judges.php cross site scripting | Electronic Judging System | 2.1 (v4.0) | Low |
| CVE-2026-9566 | teableio teable Sign-up LoginPage.tsx cross site scripting | teable | 2.1 (v4.0) | Low |
| CVE-2026-10234 | Mettle sendportal Campaign webview cross site scripting | sendportal | 2.0 (v4.0) | Low |
| CVE-2026-10244 | SourceCodester Pharmacy Sales and Inventory System main create_medicine_name cross site scripting | Pharmacy Sales and Inventory System | 2.0 (v4.0) | Low |
| CVE-2026-10245 | SourceCodester Pharmacy Sales and Inventory System main create_supplier cross site scripting | Pharmacy Sales and Inventory System | 2.0 (v4.0) | Low |
| CVE-2026-10246 | SourceCodester Pharmacy Sales and Inventory System main create_medicine_presentation cross site scripting | Pharmacy Sales and Inventory System | 2.0 (v4.0) | Low |
| CVE-2026-10247 | SourceCodester Pharmacy Sales and Inventory System main create_generic_name cross site scripting | Pharmacy Sales and Inventory System | 2.0 (v4.0) | Low |
| CVE-2026-16155 | SourceCodester Class and Exam Timetabling System schoolyr.php cross site scripting | Class and Exam Timetabling System | 2.0 (v4.0) | Low |
| CVE-2026-16156 | SourceCodester Class and Exam Timetabling System forexam.php cross site scripting | Class and Exam Timetabling System | 2.0 (v4.0) | Low |
| CVE-2026-16202 | SourceCodester Class and Exam Timetabling System CYS.php cross site scripting | Class and Exam Timetabling System | 2.0 (v4.0) | Low |
| CVE-2026-16203 | SourceCodester Class and Exam Timetabling System forCYS.php cross site scripting | Class and Exam Timetabling System | 2.0 (v4.0) | Low |
| CVE-2026-5810 | SourceCodester Sales and Inventory System GET Parameter delete.php cross site scripting | Sales and Inventory System | 2.0 (v4.0) | Low |
| CVE-2026-82665 | yaojingang GEOFlow Image Library Cleanup ImageLibraryController.php unlink path traversal | GEOFlow | 2.0 (v4.0) | Low |
| CVE-2026-82666 | yaojingang GEOFlow Superadmin Theme Editor SiteThemeEditorController.php preview code injection | GEOFlow | 2.0 (v4.0) | Low |
| CVE-2026-82667 | yaojingang GEOFlow GenericHttpEndpointResolver.php DistributionController.isValidHttpEndpoint server-side request forger | GEOFlow | 2.0 (v4.0) | Low |
| CVE-2026-84438 | OpenCart Autocomplete Workflow edit.php cross site scripting | OpenCart | 2.0 (v4.0) | Low |
| CVE-2026-85022 | langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting | dify | 2.0 (v4.0) | Low |
| CVE-2026-86301 | code-projects Hospital Information System Patient Management editPatient.php cross site scripting | Hospital Information System | 2.0 (v4.0) | Low |
| CVE-2026-11434 | FluentCMS Blocks Plugin blocks cross site scripting | FluentCMS | 1.9 (v4.0) | Low |
| CVE-2026-11468 | SourceCodester Hospitals Patient Records Management System page room_types cross site scripting | Hospitals Patient Records Management System | 1.9 (v4.0) | Low |
| CVE-2026-5834 | code-projects Online Shoe Store admin_running.php cross site scripting | Online Shoe Store | 1.9 (v4.0) | Low |
| CVE-2026-5835 | code-projects Online Shoe Store admin_football.php cross site scripting | Online Shoe Store | 1.9 (v4.0) | Low |
| CVE-2026-5836 | code-projects Online Shoe Store admin_product.php cross site scripting | Online Shoe Store | 1.9 (v4.0) | Low |
| CVE-2026-9564 | SourceCodester/oretnom23 Hospitals Patient Records Management System view_patient cross site scripting | Hospitals Patient Records Management System | 1.9 (v4.0) | Low |
| CVE-2026-78187 | Piwigo Public Authentication cross site scripting | Piwigo | 1.3 (v4.0) | Low |
| CVE-2022-29299 | SolarView Compact 6.00 - 'time_begin' Cross-Site Scripting | solarview compact firmware | N/A | N/A |
| CVE-2022-29301 | SolarView Compact 6.00 - 'pow' Cross-Site Scripting | - | N/A | N/A |
| CVE-2023-1434 | Odoo - Cross-Site Scripting | odoo | N/A | N/A |
Observed CWEs
These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.