On this page
Atomicorp WAF Rule 342259
Rule Summary
- Rule ID: 342259
- Status: Active
- Alert message: Atomicorp.com WAF Rules: Possible HTML Injection
- Observed CWEs: CWE-20 (5), CWE-22 (6), CWE-73 (1), CWE-74 (4), CWE-78 (3), CWE-79 (906), CWE-80 (9), CWE-83 (3), CWE-87 (1), CWE-89 (9), CWE-93 (1), CWE-94 (95), CWE-116 (8), CWE-183 (1), CWE-184 (1), CWE-200 (5), CWE-264 (3), CWE-269 (1), CWE-287 (3), CWE-295 (2), CWE-306 (2), CWE-345 (2), CWE-352 (8), CWE-384 (1), CWE-425 (1), CWE-434 (9), CWE-444 (2), CWE-501 (1), CWE-521 (1), CWE-601 (2), CWE-610 (1), CWE-611 (3), CWE-639 (2), CWE-640 (1), CWE-665 (1), CWE-693 (1), CWE-697 (1), CWE-732 (2), CWE-798 (2), CWE-862 (2), CWE-915 (1), CWE-918 (2), CWE-1287 (1)
- Revision: 130
- Rule severity: Critical (2)
- Phase: 2 (request body)
- Request surfaces: Request headers, Request cookies, Request argument names, Request arguments, JSON request data, SOAP request data, XML request data
- Rule action: deny
- HTTP status: 403
- Logging: log, auditlog
Description
This rule detects behavior identified by its current alert as “Possible HTML Injection” in the request headers, request cookies, request argument names, request arguments, JSON request data, SOAP request data, XML request data. It evaluates during the request body phase and denies matching traffic with HTTP status 403.
Selected Related CVEs
This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.
| CVE | Vulnerability | Product | CVSS | Severity |
|---|---|---|---|---|
| CVE-2016-9269 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities | interscan web security virtual appliance | 9.9 (v3.0) | Critical |
| CVE-2012-1259 | Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities | scrutinizer netflow & sflow analyzer | 9.8 (v3.1) | Critical |
| CVE-2012-5686 | ZPanel 10.0.1 - Cross-Site Request Forgery / Cross-Site Scripting / SQL Injection / Password Reset | zpanel | 9.8 (v3.1) | Critical |
| CVE-2015-4664 | Xceedium Xsuite - Multiple Vulnerabilities | privileged access manager | 9.8 (v3.0) | Critical |
| CVE-2015-4667 | Xceedium Xsuite - Multiple Vulnerabilities | xsuite | 9.8 (v3.0) | Critical |
| CVE-2018-11535 | Sitemakin SLAC 1.0 - 'my_item_search' SQL Injection | slac | 9.8 (v3.0) | Critical |
| CVE-2018-17440 | D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities | central wifimanager | 9.8 (v3.0) | Critical |
| CVE-2018-6220 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 9.8 (v3.0) | Critical |
| CVE-2018-6223 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 9.8 (v3.0) | Critical |
| CVE-2018-6228 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 9.8 (v3.0) | Critical |
| CVE-2018-6229 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 9.8 (v3.0) | Critical |
| CVE-2021-21307 | Lucee Admin - Remote Code Execution | lucee server | 9.8 (v3.1) | Critical |
| CVE-2022-29316 | Complete Online Job Search System 1.0 - Cross-Site Scripting | complete online job search system | 9.8 (v3.1) | Critical |
| CVE-2023-1719 | Bitrix Component - Cross-Site Scripting | bitrix24 | 9.8 (v3.1) | Critical |
| CVE-2023-2479 | Appium Desktop Server - Remote Code Execution | appium-desktop | 9.8 (v3.1) | Critical |
| CVE-2025-44136 | MapTiler Tileserver-php v2.0 - Unauthenticated XSS | tileserver php | 9.8 (v3.1) | Critical |
| CVE-2026-67688 | ICS-Park Smart Park Management System v2.0 Arbitrary Code Execution Vulnerability | ICS-Park Smart Park Management System v2.0 | 9.8 (v3.1) | Critical |
| CVE-2020-20982 | shadoweb wdja v1.5.1 - Cross-Site Scripting | wdja cms | 9.6 (v3.1) | Critical |
| CVE-2021-32853 | Erxes <0.23.0 - Cross-Site Scripting | erxes | 9.6 (v3.1) | Critical |
| CVE-2023-1892 | Sidekiq < 7.0.8 - Cross-Site Scripting | sidekiq | 9.6 (v3.1) | Critical |
| CVE-2026-54694 | NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover | skills-service | 9.6 (v3.1) | Critical |
| CVE-2026-55085 | Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite | etherpad | 9.6 (v3.1) | Critical |
| CVE-2026-73043 | SiYuan before v3.7.4 Remote Code Execution via Template Calculation | siyuan | 9.4 (v4.0) | Critical |
| CVE-2026-73044 | SiYuan before v3.7.4 Stored Cross-Site Scripting via Column Width | siyuan | 9.4 (v4.0) | Critical |
| CVE-2026-73050 | SiYuan before v3.7.4 Stored XSS via select option color | siyuan | 9.4 (v4.0) | Critical |
| CVE-2026-73052 | SiYuan before v3.7.4 Stored XSS via Attribute-View Field Names | siyuan | 9.4 (v4.0) | Critical |
| CVE-2026-73053 | SiYuan before v3.7.4 Cross-Site Scripting via unicode2Emoji | siyuan | 9.4 (v4.0) | Critical |
| CVE-2024-4879 | ServiceNow UI Macros - Template Injection | servicenow | 9.3 (v4.0) | Critical |
| CVE-2024-58355 | Cal.com through 4.7.15 Cross-Site Scripting via booking questions | cal.diy | 9.3 (v4.0) | Critical |
| CVE-2026-42849 | authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover | authentik | 9.3 (v3.1) | Critical |
| CVE-2026-45118 | MyBB: Contact page reflected XSS | mybb | 9.3 (v3.1) | Critical |
| CVE-2026-57858 | Cal.com Cal.diy 6.2.0 Stored XSS via BookingPageTagManager Analytics Tracking ID | Cal.com Self-Hosted (Cal.diy) | 9.3 (v4.0) | Critical |
| CVE-2026-66394 | SiYuan before v3.7.3 Stored and Reflected XSS via SVG Sanitizer Bypass | siyuan | 9.3 (v4.0) | Critical |
| CVE-2026-66396 | SiYuan before v3.7.2 Stored XSS to RCE via title-img IAL | siyuan | 9.3 (v4.0) | Critical |
| CVE-2026-66418 | OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field | openclaw agent dashboard | 9.3 (v4.0) | Critical |
| CVE-2026-74902 | SiYuan before v3.7.4 XSS-to-RCE via malicious filename upload | siyuan | 9.3 (v4.0) | Critical |
| CVE-2026-78997 | UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314) Cross-Site Scripting Vulnerability | UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314) | 9.3 (v3.1) | Critical |
| CVE-2026-86738 | Snipe-IT before 8.7.0 CSS Injection via Custom CSS | snipe-it | 9.3 (v4.0) | Critical |
| CVE-2026-88866 | WWBN AVideo LoginControl Stored XSS via User-Agent Header | AVideo | 9.3 (v4.0) | Critical |
| CVE-2026-88867 | WWBN AVideo Stored XSS via Category Name and Icon Class | AVideo | 9.3 (v4.0) | Critical |
| CVE-2026-88868 | AVideo LiveLinks Stored XSS via title and description fields | AVideo | 9.3 (v4.0) | Critical |
| CVE-2026-88869 | AVideo AD_Server Stored XSS via log.php label parameter | AVideo | 9.3 (v4.0) | Critical |
| CVE-2026-89249 | AVideo YPTWallet Stored XSS via CryptoWallet Configuration | AVideo | 9.3 (v4.0) | Critical |
| CVE-2026-89253 | AVideo Stored XSS via donationLink in watch page button | AVideo | 9.3 (v4.0) | Critical |
| CVE-2026-89254 | AVideo CustomizeUser Stored XSS via field_name Parameter | AVideo | 9.3 (v4.0) | Critical |
| CVE-2026-89255 | AVideo LoginControl Stored XSS via PGP Public Key | AVideo | 9.3 (v4.0) | Critical |
| CVE-2026-89256 | AVideo Bookmark Plugin Stored XSS via Chapter Names | AVideo | 9.3 (v4.0) | Critical |
| CVE-2024-5217 | ServiceNow - Incomplete Input Validation | servicenow | 9.2 (v4.0) | Critical |
| CVE-2026-84189 | LibreNMS before 26.7.0 Stored XSS via Oxidized API | librenms | 9.2 (v4.0) | Critical |
| CVE-2026-89243 | WWBN AVideo Stored XSS via UserGroups setGroup_name | AVideo | 9.2 (v4.0) | Critical |
| CVE-2019-7671 | Prima Access Control 2.3.35 - 'HwName' Persistent Cross-Site Scripting | flexair | 9.0 (v3.1) | Critical |
| CVE-2023-34192 | Zimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site Scripting | collaboration | 9.0 (v3.1) | Critical |
| CVE-2026-34448 | SiYuan: Stored XSS in Attribute View gallery/kanban cover rendering allows arbitrary command execution in the desktop cl | siyuan | 9.0 (v3.1) | Critical |
| CVE-2026-35198 | HeyForm vulnerable to stored XSS via form field titles | heyform | 9.0 (v3.1) | Critical |
| CVE-2026-42556 | Postiz stored XSS in public preview page | postiz | 9.0 (v3.1) | Critical |
| CVE-2026-43984 | Tautulli has stored XSS in logFile via guest-controlled log_js_errors input | Tautulli | 8.9 (v3.1) | High |
| CVE-2016-8526 | Aruba AirWave 8.2.3 - XML External Entity Injection / Cross-Site Scripting | airwave | 8.8 (v3.0) | High |
| CVE-2016-9315 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities | interscan web security virtual appliance | 8.8 (v3.0) | High |
| CVE-2018-11442 | EasyService Billing 1.0 - Cross-Site Request Forgery | easyservice billing | 8.8 (v3.0) | High |
| CVE-2018-11445 | EasyService Billing 1.0 - Cross-Site Request Forgery | easyservice billing | 8.8 (v3.0) | High |
| CVE-2018-1213 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon onefs | 8.8 (v3.0) | High |
| CVE-2018-17442 | D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities | central wifimanager | 8.8 (v3.0) | High |
| CVE-2018-6224 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 8.8 (v3.0) | High |
| CVE-2019-9189 | Prima Access Control 2.3.35 - Arbitrary File Upload | flexair | 8.8 (v3.0) | High |
| CVE-2020-7991 | Adive Framework 2.0.8 - Cross-Site Request Forgery (Change Admin Password) | framework | 8.8 (v3.1) | High |
| CVE-2025-56798 | Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier Cross-Site Request Forgery Vulnerability | Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier | 8.8 (v3.1) | High |
| CVE-2026-12968 | Product Addons – WowAddons < 1.6.15 - Unauthenticated Stored XSS via Arbitrary SVG Upload | Product Addons and Product Options With Custom Fields | 8.8 (v3.1) | High |
| CVE-2026-41473 | CyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner Endpoints | cyberpanel | 8.8 (v4.0) | High |
| CVE-2026-42455 | LinkWarden: Stored XSS via Client-Side Archive Upload (Unsanitized HTML served from same origin) | linkwarden | 8.8 (v4.0) | High |
| CVE-2021-47795 | GeoVision GeoWebServer <= 5.3.3 - Local File Inclusion / Cross-Site Scripting | geowebserver | 8.7 (v4.0) | High |
| CVE-2026-12496 | Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server | LIP-ME20xC | 8.7 (v4.0) | High |
| CVE-2026-15217 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab | gitlab | 8.7 (v3.1) | High |
| CVE-2026-28445 | Typebot: Stored XSS via Rating Block Custom Icon Bypasses isUnsafe Sandbox in Builder Preview | typebot.io | 8.7 (v3.1) | High |
| CVE-2026-44667 | Faction: Stored XSS in Remediation Verification Attachment Filename Preview Rendering | faction | 8.7 (v3.1) | High |
| CVE-2026-44669 | Faction: Stored XSS in Assessment Attachment Filename Preview Rendering | faction | 8.7 (v3.1) | High |
| CVE-2026-44729 | Twenty: Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers) | twenty | 8.7 (v3.1) | High |
| CVE-2026-45115 | MyBB: Buddy/ignore list username XSS | mybb | 8.7 (v3.1) | High |
| CVE-2026-45116 | MyBB: Profile field type confusion XSS | mybb | 8.7 (v3.1) | High |
| CVE-2026-45270 | CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule | ci4ms | 8.7 (v3.1) | High |
| CVE-2026-46518 | OpenEMR: Stored XSS in prescription CSS/HTML print view via patient demographics | openemr | 8.7 (v3.1) | High |
| CVE-2026-47665 | Penpot: Stored XSS via comment content, innerHTML renders unsanitized HTML | penpot | 8.7 (v3.1) | High |
| CVE-2026-47743 | Shopper: Multiple data integrity and disclosure issues in admin Livewire components | shopper | 8.7 (v3.1) | High |
| CVE-2026-48026 | lakeFS vulnerable to stored XSS in rendered markdown previews via raw HTML | lakeFS | 8.7 (v3.1) | High |
| CVE-2026-48527 | HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint | haxcms-nodejs | 8.7 (v3.1) | High |
| CVE-2026-53758 | Emlog: Stored XSS via Parsedown Markdown Processing - Raw HTML Not Sanitized | emlog | 8.7 (v4.0) | High |
| CVE-2026-54347 | Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover | froxlor | 8.7 (v3.1) | High |
| CVE-2026-68899 | Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallback | wekan | 8.7 (v3.1) | High |
| CVE-2025-66024 | XWiki Blog Application home page vulnerable to Stored XSS via Post Title | blog application | 8.6 (v4.0) | High |
| CVE-2026-34463 | MantisBT has Stored HTML Injection/XSS via Clone Issue Form | mantisbt | 8.6 (v4.0) | High |
| CVE-2026-49864 | wetty vulnerable to DOM XSS via file-download filename | wetty | 8.6 (v4.0) | High |
| CVE-2026-67328 | @better-auth/sso before 1.6.21 Account Takeover via SSO | sso | 8.6 (v4.0) | High |
| CVE-2026-21618 | Cross-site scripting (XSS) in OAuth Device Authorization screen | hexpm | 8.5 (v4.0) | High |
| CVE-2026-34932 | hoppscotch: Stored XSS via mock server responses on backend origin | hoppscotch | 8.5 (v4.0) | High |
| CVE-2026-58113 | Teamcenter V2412 Cross-site Scripting Vulnerability | Teamcenter V2412 | 8.5 (v4.0) | High |
| CVE-2026-63361 | LimeSurvey Community Edition 7.0.5+260623 - Reflected XSS in HTML editor popup | LimeSurvey | 8.5 (v4.0) | High |
| CVE-2026-64851 | Grav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlers | grav-plugin-shortcode-core | 8.5 (v4.0) | High |
| CVE-2026-65986 | CVAT has stored XSS via annotation guide assets | cvat | 8.5 (v4.0) | High |
| CVE-2026-75933 | Jet Admin Stored XSS | Jet Admin | 8.5 (v4.0) | High |
| CVE-2026-15973 | LimeSurvey 7.0.5 - Stored XSS in Survey Menu Entries | LimeSurvey | 8.4 (v4.0) | High |
| CVE-2026-5385 | GLPI 11.0.0 - Stored XSS in knowledge base | glpi | 8.4 (v4.0) | High |
| CVE-2026-77072 | n8n before 1.123.69 Stored XSS via Form Completion Page | n8n | 8.4 (v4.0) | High |
| CVE-2026-77850 | Stored XSS in AshAdmin relationship typeahead via unescaped label_field content | ash admin | 8.4 (v4.0) | High |
| CVE-2026-85613 | OpenPanel Unauthenticated XSS via SVG Favicon Proxy | openpanel | 8.4 (v4.0) | High |
| CVE-2026-87811 | SiYuan before v3.8.2 Stored XSS via notebook template paths | siyuan | 8.4 (v4.0) | High |
| CVE-2026-87814 | SiYuan before v3.8.2 Stored XSS via Asset Preview | siyuan | 8.4 (v4.0) | High |
| CVE-2024-5420 | SEH utnserver Pro/ProMAX/INU-100 20.1.22 - Cross-Site Scripting | utnserver Pro | 8.3 (v4.0) | High |
| CVE-2017-10075 | Oracle Content Server - Cross-Site Scripting | webcenter content | 8.2 (v3.0) | High |
| CVE-2026-34725 | dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration | dbgate | 8.2 (v3.1) | High |
| CVE-2026-56670 | ComfyUI: Stored XSS via SVG file upload on the /view endpoint | ComfyUI | 8.2 (v3.1) | High |
| CVE-2026-63135 | YOURLS: Stored XSS in referrer statistics chart via crafted Referer header | YOURLS | 8.2 (v3.1) | High |
| CVE-2016-1337 | Cisco EPC 3928 - Multiple Vulnerabilities | epc3928 firmware | 8.1 (v3.0) | High |
| CVE-2018-6221 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 8.1 (v3.0) | High |
| CVE-2026-18147 | Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url | Red Hat Enterprise Linux 10 | 8.1 (v3.1) | High |
| CVE-2026-33437 | Stirling PDF: Stored XSS in Info Summary | Stirling-PDF | 8.1 (v3.1) | High |
| CVE-2026-39344 | Reflected XSS the login page through the 'username' parameter | churchcrm | 8.1 (v3.0) | High |
| CVE-2026-48060 | Litestar: HTML Injection Through CSRF Token | litestar | 8.1 (v3.1) | High |
| CVE-2026-48081 | OpenReception vulnerable to stored click-triggered XSS via javascript: tenant links rendered into patient-facing footer | appointment-booking-software | 8.1 (v3.1) | High |
| CVE-2026-50758 | DayuanJiang next-ai-draw-io 0.4.13 Arbitrary Code Execution Vulnerability | DayuanJiang next-ai-draw-io 0.4.13 | 8.1 (v3.1) | High |
| CVE-2015-4669 | Xceedium Xsuite - Multiple Vulnerabilities | xsuite | 7.8 (v3.0) | High |
| CVE-2016-9314 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities | interscan web security virtual appliance | 7.8 (v3.0) | High |
| CVE-2018-6222 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 7.8 (v3.0) | High |
| CVE-2025-47783 | Label Studio < 1.18.0 - Reflected XSS | label studio | 7.6 (v4.0) | High |
| CVE-2026-16969 | DFIR-IRIS Stored XSS in Assets | iris-web | 7.6 (v3.1) | High |
| CVE-2026-18360 | DFIR-IRIS Stored XSS in Custom Attributes | iris-web | 7.6 (v3.1) | High |
| CVE-2026-18361 | DFIR-IRIS Stored XSS in Datastore Upload | iris-web | 7.6 (v3.1) | High |
| CVE-2002-1131 | SquirrelMail 1.2.6/1.2.7 - Cross-Site Scripting | squirrelmail | 7.5 (v2.0) | High |
| CVE-2012-5685 | ZPanel 10.0.1 - Cross-Site Request Forgery / Cross-Site Scripting / SQL Injection / Password Reset | zpanel | 7.5 (v2.0) | High |
| CVE-2013-6041 | Webuzo 2.1.3 - Multiple Vulnerabilities | webuzo | 7.5 (v2.0) | High |
| CVE-2015-6401 | Cisco EPC 3928 - Multiple Vulnerabilities | epc3928 docsis 3.0 8x4 wireless residential gateway with embedded digital voice adapter | 7.5 (v2.0) | High |
| CVE-2016-1328 | Cisco EPC 3928 - Multiple Vulnerabilities | epc3928 firmware | 7.5 (v3.0) | High |
| CVE-2016-1336 | Cisco EPC 3928 - Multiple Vulnerabilities | epc3928 firmware | 7.5 (v3.0) | High |
| CVE-2019-9757 | LabKey Server 19.1.0 - XML External Entity (XXE) | labkey server | 7.5 (v3.1) | High |
| CVE-2025-61884 | Oracle E-Business Suite - Server-Side Request Forgery | configurator | 7.5 (v3.1) | High |
| CVE-2026-12592 | SlimStat Analytics < 5.5.0 - Unauthenticated Stored XSS via CF-IPCountry Header | SlimStat Analytics | 7.5 (v3.1) | High |
| CVE-2026-44657 | MantisBT: Stored XSS in File Download | mantisbt | 7.5 (v4.0) | High |
| CVE-2026-87812 | SiYuan before v3.8.2 Stored XSS via Bazaar iconURL | siyuan | 7.4 (v4.0) | High |
| CVE-2026-30819 | Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameter | iTop | 7.3 (v3.1) | High |
| CVE-2026-6735 | XSS within PHP-FPM status endpoint | php | 7.3 (v4.0) | High |
| CVE-2026-8203 | Concrete CMS 9.5.0 and below has Stored XSS on the height parameter | concrete cms | 7.3 (v4.0) | High |
| CVE-2026-18756 | HumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button rendering | HumHub | 7.2 (v4.0) | High |
| CVE-2026-19914 | Welcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter | Welcart e-Commerce | 7.2 (v3.1) | High |
| CVE-2022-35499 | In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint Cross-Site Scripting Vulnerability | - | 7.1 (v3.1) | High |
| CVE-2024-41357 | phpIPAM 1.6 - Reflected-Cross-Site Scripting (XSS) | phpipam | 7.1 (v3.1) | High |
| CVE-2026-12970 | LearnPress < 4.4.1 - Reflected XSS via c_search | LearnPress | 7.1 (v3.1) | High |
| CVE-2026-34598 | YesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter" | yeswiki | 7.1 (v4.0) | High |
| CVE-2026-6858 | Transbank Webpay < 1.14.0 - Unauthenticated Stored XSS | Transbank Webpay | 7.1 (v3.1) | High |
| CVE-2026-84192 | LibreNMS before 26.3.1 Stored XSS via SNMP/Syslog Data | librenms | 7.1 (v4.0) | High |
| CVE-2026-55746 | Cotonti stored XSS via PFS folder title | Cotonti | 7.0 (v4.0) | High |
| CVE-2026-58411 | ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values | CRM | 7.0 (v4.0) | High |
| CVE-2018-3238 | Oracle Fusion Middleware WebCenter Sites 11.1.1.8.0 - Cross-Site Scripting | webcenter sites | 6.9 (v3.0) | Medium |
| CVE-2025-4388 | Liferay Portal - Cross-Site Scripting | digital experience platform | 6.9 (v4.0) | Medium |
| CVE-2025-4576 | Liferay Portal & DXP - Cross-Site Scripting | digital experience platform | 6.9 (v4.0) | Medium |
| CVE-2025-62613 | VDO.Ninja - DOM-Based Cross-Site Scripting | vdo.ninja | 6.9 (v4.0) | Medium |
| CVE-2026-39838 | ProofreadPage improperly sanitizes multiline styles using Sanitizer::checkCSS | MediaWiki - ProofreadPage Extension | 6.9 (v4.0) | Medium |
| CVE-2026-39936 | Stored XSS in Score due to usage of non-reserved data attributes | Mediawiki - Score Extension | 6.9 (v4.0) | Medium |
| CVE-2026-40598 | MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page | mantisbt | 6.9 (v4.0) | Medium |
| CVE-2026-44651 | SillyTavern: Reflected XSS vulnerability in the CORS proxy middleware | SillyTavern | 6.9 (v4.0) | Medium |
| CVE-2026-59238 | Stored XSS in Pentestify via unsanitized finding images and report client logo | Pentestify | 6.9 (v4.0) | Medium |
| CVE-2026-69092 | Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpoint | admidio | 6.9 (v4.0) | Medium |
| CVE-2026-73848 | Emlog: Stored XSS via Tag Name in Article Editor | emlog | 6.9 (v4.0) | Medium |
| CVE-2026-86188 | AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting | AVideo | 6.9 (v4.0) | Medium |
| CVE-2007-0885 | Jira Rainbow.Zen - Cross-Site Scripting | rainbow.zen | 6.8 (v2.0) | Medium |
| CVE-2012-5683 | ZPanel 10.0.1 - Cross-Site Request Forgery / Cross-Site Scripting / SQL Injection / Password Reset | zpanel | 6.8 (v2.0) | Medium |
| CVE-2018-6230 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 6.8 (v3.0) | Medium |
| CVE-2026-13605 | Photo Swipe <= 4.1.1.1 - Author+ Stored XSS via title Attribute | PhotoSwipe | 6.8 (v3.1) | Medium |
| CVE-2026-14817 | Element Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data Attributes | Element Pack Addons for Elementor | 6.8 (v3.1) | Medium |
| CVE-2026-14827 | Calendar < 1.3.18 - Contributor+ Stored XSS via event_link Parameter | Calendar | 6.8 (v3.1) | Medium |
| CVE-2026-14833 | Lightbox with PhotoSwipe < 5.9.0 - Author+ Stored XSS via data-lbwps-caption Attribute | Lightbox with PhotoSwipe | 6.8 (v3.1) | Medium |
| CVE-2026-15047 | s2Member < 260805 - Contributor+ Stored XSS via Shortcode | s2Member | 6.8 (v3.1) | Medium |
| CVE-2026-16559 | YMC Filter < 3.12.9 - Author+ Stored XSS via SVG Icon Upload | YMC Filter | 6.8 (v3.1) | Medium |
| CVE-2026-33741 | EspoCRM: Stored XSS via SVG attachment loading same-origin JavaScript | espocrm | 6.8 (v3.1) | Medium |
| CVE-2026-39311 | Trilium Notes: Stored XSS Leads to Unauthorized Remote Code Execution (RCE) via Unsanitized SVG Attachments | Trilium | 6.8 (v3.1) | Medium |
| CVE-2026-67352 | luci-app-https-dns-proxy Stored XSS via resolver_url | luci | 6.8 (v4.0) | Medium |
| CVE-2018-1203 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon onefs | 6.7 (v3.0) | Medium |
| CVE-2018-1204 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon onefs | 6.7 (v3.0) | Medium |
| CVE-2012-1258 | Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities | scrutinizer netflow & sflow analyzer | 6.5 (v3.1) | Medium |
| CVE-2017-6338 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities | interscan web security virtual appliance | 6.5 (v3.0) | Medium |
| CVE-2017-6339 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities | interscan web security virtual appliance | 6.5 (v3.0) | Medium |
| CVE-2018-6219 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 6.5 (v3.0) | Medium |
| CVE-2019-7439 | JioFi 4G M2S 1.0.2 - Denial of Service | jiofi 4g m2s firmware | 6.5 (v3.0) | Medium |
| CVE-2021-31249 | CHIYU TCP/IP Converter - Carriage Return Line Feed Injection | bf-430 firmware | 6.5 (v3.1) | Medium |
| CVE-2021-41349 | Microsoft Exchange Server Pre-Auth POST Based Cross-Site Scripting | exchange server | 6.5 (v3.1) | Medium |
| CVE-2025-32430 | XWiki Platform - Cross-Site Scripting | xwiki-platform | 6.5 (v4.0) | Medium |
| CVE-2026-24128 | XWiki Platform Distribution Flavor Main - Cross-Site Scripting | xwiki-platform-distribution-flavor-main | 6.5 (v4.0) | Medium |
| CVE-2026-40105 | XWiki - Cross-Site Scripting | xwiki-platform | 6.5 (v4.0) | Medium |
| CVE-2026-55549 | Yamcs: Reflected XSS in the URL of the Authorize Endpoint | yamcs | 6.5 (v3.1) | Medium |
| CVE-2026-78838 | AppNitro MachForm v30 Cross-Site Scripting Vulnerability | AppNitro MachForm v30 | 6.5 (v3.1) | Medium |
| CVE-2026-0737 | Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode | WP Shortcodes Plugin — Shortcodes Ultimate | 6.4 (v3.1) | Medium |
| CVE-2026-36214 | osTicket Cross-Site Scripting Vulnerability | osTicket | 6.4 (v3.1) | Medium |
| CVE-2026-3885 | WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_bo | Shortcodes Ultimate – Content Elements | 6.4 (v3.1) | Medium |
| CVE-2026-45797 | HeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Upload | heyform | 6.4 (v4.0) | Medium |
| CVE-2026-50592 | Znuny Cross-Site Scripting Vulnerability | Znuny | 6.4 (v3.1) | Medium |
| CVE-2026-87870 | Ninja Forms - Scheduled Exports <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Paramete | Ninja Forms - Scheduled Exports | 6.4 (v3.1) | Medium |
| CVE-2026-43980 | Malla: Stored XSS via Meshtastic node names in multiple frontend pages | malla | 6.3 (v3.1) | Medium |
| CVE-2011-4336 | Tiki Wiki CMS Groupware 7.0 Cross-Site Scripting | tikiwiki cms/groupware | 6.1 (v3.1) | Medium |
| CVE-2012-1260 | Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities | scrutinizer netflow & sflow analyzer | 6.1 (v3.1) | Medium |
| CVE-2012-1261 | Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities | scrutinizer netflow & sflow analyzer | 6.1 (v3.1) | Medium |
| CVE-2012-5193 | Bitweaver 2.8.1 - Multiple Vulnerabilities | bitweaver | 6.1 (v3.1) | Medium |
| CVE-2014-4535 | Import Legacy Media <= 0.1 - Cross-Site Scripting | import legacy media | 6.1 (v3.1) | Medium |
| CVE-2014-4536 | Infusionsoft Gravity Forms Add-on < 1.5.7 - Cross-Site Scripting | infusionsoft gravity forms | 6.1 (v3.1) | Medium |
| CVE-2014-4539 | Movies <= 0.6 - Cross-Site Scripting | movies | 6.1 (v3.1) | Medium |
| CVE-2014-4544 | Podcast Channels < 0.28 - Cross-Site Scripting | podcast channels | 6.1 (v3.1) | Medium |
| CVE-2014-4558 | WooCommerce Swipe <= 2.7.1 - Cross-Site Scripting | swipehq-payment-gateway-woocommerce | 6.1 (v3.1) | Medium |
| CVE-2014-4561 | Ultimate Weather Plugin <= 1.0 - Cross-Site Scripting | ultimate-weather | 6.1 (v3.1) | Medium |
| CVE-2014-4592 | WP Planet <= 0.1 - Cross-Site Scripting | wp-planet | 6.1 (v3.1) | Medium |
| CVE-2014-9607 | Netsweeper 4.0.4 - Cross-Site Scripting | netsweeper | 6.1 (v3.1) | Medium |
| CVE-2015-4668 | Xceedium Xsuite - Multiple Vulnerabilities | xsuite | 6.1 (v3.0) | Medium |
| CVE-2015-6477 | Nordex NC2 - Cross-Site Scripting | nordex control 2 scada | 6.1 (v3.1) | Medium |
| CVE-2015-6544 | Combodo iTop <2.2.0-2459 - Cross-Site Scripting | itop | 6.1 (v3.0) | Medium |
| CVE-2015-8349 | SourceBans <2.0 - Cross-Site Scripting | sourcebans | 6.1 (v3.0) | Medium |
| CVE-2015-9414 | WordPress Symposium <=15.8.1 - Cross-Site Scripting | wp-symposium | 6.1 (v3.1) | Medium |
| CVE-2016-1000126 | WordPress Admin Font Editor <=1.8 - Cross-Site Scripting | admin-font-editor | 6.1 (v3.0) | Medium |
| CVE-2016-1000127 | WordPress AJAX Random Post <=2.00 - Cross-Site Scripting | ajax-random-post | 6.1 (v3.0) | Medium |
| CVE-2016-1000128 | WordPress anti-plagiarism <=3.60 - Cross-Site Scripting | anti-plagiarism | 6.1 (v3.0) | Medium |
| CVE-2016-1000129 | WordPress defa-online-image-protector <=3.3 - Cross-Site Scripting | defa-online-image-protector | 6.1 (v3.0) | Medium |
| CVE-2016-1000130 | WordPress e-search <=1.0 - Cross-Site Scripting | e-search | 6.1 (v3.0) | Medium |
| CVE-2016-1000131 | WordPress e-search <=1.0 - Cross-Site Scripting | esearch | 6.1 (v3.0) | Medium |
| CVE-2016-1000132 | WordPress enhanced-tooltipglossary 3.2.8 - Cross-Site Scripting | tooltip glossary | 6.1 (v3.0) | Medium |
| CVE-2016-1000133 | WordPress forget-about-shortcode-buttons 1.1.1 - Cross-Site Scripting | forget about shortcode buttons | 6.1 (v3.0) | Medium |
| CVE-2016-1000134 | WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting | hdw-tube | 6.1 (v3.0) | Medium |
| CVE-2016-1000135 | WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting | hdw-tube | 6.1 (v3.0) | Medium |
| CVE-2016-1000136 | WordPress heat-trackr 1.0 - Cross-Site Scripting | heat-trackr | 6.1 (v3.0) | Medium |
| CVE-2016-1000137 | WordPress Hero Maps Pro 2.1.0 - Cross-Site Scripting | hero-maps-pro | 6.1 (v3.0) | Medium |
| CVE-2016-1000138 | WordPress Admin Font Editor <=1.8 - Cross-Site Scripting | indexisto | 6.1 (v3.0) | Medium |
| CVE-2016-1000139 | WordPress Infusionsoft Gravity Forms <=1.5.11 - Cross-Site Scripting | infusionsoft | 6.1 (v3.0) | Medium |
| CVE-2016-1000141 | WordPress Page Layout builder v1.9.3 - Cross-Site Scripting | page-layout-builder | 6.1 (v3.0) | Medium |
| CVE-2016-1000142 | WordPress MW Font Changer <=4.2.5 - Cross-Site Scripting | parsi-font | 6.1 (v3.0) | Medium |
| CVE-2016-1000143 | WordPress Photoxhibit 2.1.8 - Cross-Site Scripting | photoxhibit | 6.1 (v3.0) | Medium |
| CVE-2016-1000146 | WordPress Pondol Form to Mail <=1.1 - Cross-Site Scripting | pondol-formmail | 6.1 (v3.0) | Medium |
| CVE-2016-1000148 | WordPress S3 Video <=0.983 - Cross-Site Scripting | s3-video | 6.1 (v3.0) | Medium |
| CVE-2016-1000149 | WordPress Simpel Reserveren <=3.5.2 - Cross-Site Scripting | simpel-reserveren | 6.1 (v3.0) | Medium |
| CVE-2016-1000152 | WordPress Tidio-form <=1.0 - Cross-Site Scripting | tidio-form | 6.1 (v3.0) | Medium |
| CVE-2016-1000153 | WordPress Tidio Gallery <=1.1 - Cross-Site Scripting | tidio-gallery | 6.1 (v3.0) | Medium |
| CVE-2016-1000154 | WordPress WHIZZ <=1.0.7 - Cross-Site Scripting | whizz | 6.1 (v3.0) | Medium |
| CVE-2016-1000155 | WordPress WPSOLR <=8.6 - Cross-Site Scripting | wpsolr-search-engine | 6.1 (v3.0) | Medium |
| CVE-2016-8527 | Aruba AirWave 8.2.3 - XML External Entity Injection / Cross-Site Scripting | airwave | 6.1 (v3.0) | Medium |
| CVE-2017-11107 | phpLDAPadmin <= 1.2.3 - Reflected XSS | phpldapadmin | 6.1 (v3.1) | Medium |
| CVE-2017-11629 | FineCMS <=5.0.10 - Cross-Site Scripting | finecms | 6.1 (v3.0) | Medium |
| CVE-2017-12794 | Django Debug Page - Cross-Site Scripting | django | 6.1 (v3.0) | Medium |
| CVE-2017-17043 | WordPress Emag Marketplace Connector 1.0 - Cross-Site Scripting | emag marketplace connector | 6.1 (v3.0) | Medium |
| CVE-2017-17059 | WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting | amtythumb | 6.1 (v3.0) | Medium |
| CVE-2017-17451 | WordPress Mailster <=1.5.4 - Cross-Site Scripting | wp mailster | 6.1 (v3.0) | Medium |
| CVE-2017-18024 | AvantFAX 3.3.3 - Cross-Site Scripting | avantfax | 6.1 (v3.0) | Medium |
| CVE-2017-18536 | WordPress Stop User Enumeration <=1.3.7 - Cross-Site Scripting | stop user enumeration | 6.1 (v3.0) | Medium |
| CVE-2017-3132 | Fortinet FortiOS < 5.6.0 - Cross-Site Scripting | fortios | 6.1 (v3.0) | Medium |
| CVE-2017-3133 | Fortinet FortiOS < 5.6.0 - Cross-Site Scripting | fortios | 6.1 (v3.0) | Medium |
| CVE-2017-5631 | KMCIS CaseAware - Cross-Site Scripting | caseaware | 6.1 (v3.0) | Medium |
| CVE-2017-6443 | EPSON TMNet WebConfig 1.00 - Cross-Site Scripting | tmnet webconfig | 6.1 (v3.0) | Medium |
| CVE-2017-7391 | Magmi 0.7.22 - Cross-Site Scripting | magmi | 6.1 (v3.0) | Medium |
| CVE-2017-7855 | IceWarp WebMail 11.3.1.5 - Cross-Site Scripting | server | 6.1 (v3.0) | Medium |
| CVE-2017-9140 | Reflected XSS - Telerik Reporting Module | telerik reporting | 6.1 (v3.0) | Medium |
| CVE-2017-9288 | WordPress Raygun4WP <=1.8.0 - Cross-Site Scripting | raygun4wp | 6.1 (v3.0) | Medium |
| CVE-2018-10095 | Dolibarr <7.0.2 - Cross-Site Scripting | dolibarr | 6.1 (v3.0) | Medium |
| CVE-2018-10230 | Zend Server <9.13 - Cross-Site Scripting | zend server | 6.1 (v3.0) | Medium |
| CVE-2018-10383 | Lantronix SecureLinx Spider (SLS) 2.2+ - Cross-Site Scripting | securelinx spider firmware | 6.1 (v3.0) | Medium |
| CVE-2018-11227 | Monstra CMS <=3.0.4 - Cross-Site Scripting | monstra cms | 6.1 (v3.0) | Medium |
| CVE-2018-11709 | WordPress wpForo Forum <= 1.4.11 - Cross-Site Scripting | wpforo forum | 6.1 (v3.0) | Medium |
| CVE-2018-12998 | Zoho manageengine - Cross-Site Scripting | firewall analyzer | 6.1 (v3.1) | Medium |
| CVE-2018-13380 | Fortinet FortiOS - Cross-Site Scripting | fortios | 6.1 (v3.1) | Medium |
| CVE-2018-14013 | Synacor Zimbra Collaboration Suite Collaboration <8.8.11 - Cross-Site Scripting | zimbra collaboration suite | 6.1 (v3.0) | Medium |
| CVE-2018-16139 | BIBLIOsoft BIBLIOpac 2008 - Cross-Site Scripting | bibliopac | 6.1 (v3.0) | Medium |
| CVE-2018-16833 | ManageEngine Desktop Central 10.0.271 - Cross-Site Scripting | manageengine desktop central | 6.1 (v3.0) | Medium |
| CVE-2018-17441 | D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities | central wifimanager | 6.1 (v3.0) | Medium |
| CVE-2018-17443 | D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities | central wifimanager | 6.1 (v3.0) | Medium |
| CVE-2018-17587 | Airties AIR5342 1.0.0.18 - Cross-Site Scripting | air 5750 firmware | 6.1 (v3.0) | Medium |
| CVE-2018-17588 | Airties AIR5342 1.0.0.18 - Cross-Site Scripting | air 5021 firmware | 6.1 (v3.0) | Medium |
| CVE-2018-17590 | Airties AIR5342 1.0.0.18 - Cross-Site Scripting | air 5442 firmware | 6.1 (v3.0) | Medium |
| CVE-2018-17591 | Airties AIR5342 1.0.0.18 - Cross-Site Scripting | air 5343v2 firmware | 6.1 (v3.0) | Medium |
| CVE-2018-17593 | Airties AIR5342 1.0.0.18 - Cross-Site Scripting | air 5453 firmware | 6.1 (v3.0) | Medium |
| CVE-2018-18570 | Planon <Live Build 41 - Cross-Site Scripting | planon | 6.1 (v3.0) | Medium |
| CVE-2018-18775 | Microstrategy Web 7 - Cross-Site Scripting | microstrategy web | 6.1 (v3.0) | Medium |
| CVE-2018-19439 | Oracle Secure Global Desktop Administration Console 4.4 - Cross-Site Scripting | secure global desktop | 6.1 (v3.0) | Medium |
| CVE-2018-19877 | Adiscon LogAnalyzer <4.1.7 - Cross-Site Scripting | loganalyzer | 6.1 (v3.0) | Medium |
| CVE-2018-19933 | Bolt CMS < 3.6.2 - Cross-Site Scripting | bolt cms | 6.1 (v3.0) | Medium |
| CVE-2018-20462 | WordPress JSmol2WP <=1.07 - Cross-Site Scripting | jsmol2wp | 6.1 (v3.0) | Medium |
| CVE-2018-20503 | SirsiDynix e-Library 3.5.x - Cross-Site Scripting | 8100l/8 firmware | 6.1 (v3.0) | Medium |
| CVE-2018-5316 | WordPress SagePay Server Gateway for WooCommerce <1.0.9 - Cross-Site Scripting | sagepay server gateway for woocommerce | 6.1 (v3.0) | Medium |
| CVE-2018-5715 | SugarCRM 3.5.1 - Cross-Site Scripting | sugarcrm | 6.1 (v3.0) | Medium |
| CVE-2018-6882 | zimbra collaboration suite Cross-Site Scripting Vulnerability | zimbra collaboration suite | 6.1 (v3.1) | Medium |
| CVE-2018-7193 | osTicket < 1.10.2 - Cross-Site Scripting | osticket | 6.1 (v3.0) | Medium |
| CVE-2018-7196 | osTicket < 1.10.2 - Cross-Site Scripting | osticket | 6.1 (v3.0) | Medium |
| CVE-2018-7203 | TwonkyMedia Server 7.0.11-8.5 - Persistent Cross-Site Scripting | twonky server | 6.1 (v3.0) | Medium |
| CVE-2018-7653 | YzmCMS v3.6 - Cross-Site Scripting | yzmcms | 6.1 (v3.0) | Medium |
| CVE-2018-8006 | Apache ActiveMQ <=5.15.5 - Cross-Site Scripting | activemq | 6.1 (v3.1) | Medium |
| CVE-2018-9238 | Yahei PHP Prober 0.4.7 - Cross-Site Scripting | yahei php prober | 6.1 (v3.0) | Medium |
| CVE-2019-0221 | Apache Tomcat - Cross-Site Scripting | tomcat | 6.1 (v3.0) | Medium |
| CVE-2019-1010287 | Timesheet Next Gen <=1.5.3 - Cross-Site Scripting | timesheet next gen | 6.1 (v3.0) | Medium |
| CVE-2019-10475 | Jenkins build-metrics 1.3 - Cross-Site Scripting | build-metrics | 6.1 (v3.1) | Medium |
| CVE-2019-11398 | UliCMS 2019.1 'Spitting Lama' - Persistent Cross-Site Scripting | ulicms | 6.1 (v3.0) | Medium |
| CVE-2019-11507 | Pulse Secure Pulse Connect Secure - Cross-Site Scripting (Reflected) | connect secure | 6.1 (v3.1) | Medium |
| CVE-2019-12461 | WebPort 1.19.1 - Cross-Site Scripting | web port | 6.1 (v3.0) | Medium |
| CVE-2019-12581 | Zyxel ZyWal/USG/UAG Devices - Cross-Site Scripting | uag2100 | 6.1 (v3.0) | Medium |
| CVE-2019-12935 | Shopware < 5.5.8 - Cross-Site Scripting | shopware | 6.1 (v3.0) | Medium |
| CVE-2019-13392 | MindPalette NateMail 3.0.15 - Cross-Site Scripting | natemail | 6.1 (v3.1) | Medium |
| CVE-2019-14696 | Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting | open-school | 6.1 (v3.0) | Medium |
| CVE-2019-15501 | L-Soft LISTSERV <16.5-2018a - Cross-Site Scripting | listserv | 6.1 (v3.0) | Medium |
| CVE-2019-15713 | WordPress My Calendar <= 3.1.9 - Cross-Site Scripting | my calendar | 6.1 (v3.0) | Medium |
| CVE-2019-15811 | DomainMOD <=4.13.0 - Cross-Site Scripting | domainmod | 6.1 (v3.0) | Medium |
| CVE-2019-15889 | WordPress Download Manager <2.9.94 - Cross-Site Scripting | wordpress download manager | 6.1 (v3.0) | Medium |
| CVE-2019-16332 | WordPress API Bearer Auth <20190907 - Cross-Site Scripting | api bearer auth | 6.1 (v3.1) | Medium |
| CVE-2019-16525 | WordPress Checklist <1.1.9 - Cross-Site Scripting | checklist | 6.1 (v3.1) | Medium |
| CVE-2019-16931 | WordPress Visualizer <3.3.1 - Cross-Site Scripting | visualizer | 6.1 (v3.1) | Medium |
| CVE-2019-17504 | Kirona-DRS 5.5.3.5 - Information Disclosure | dynamic resource scheduling | 6.1 (v3.1) | Medium |
| CVE-2019-19134 | WordPress Hero Maps Premium <=2.2.1 - Cross-Site Scripting | hero maps premium | 6.1 (v3.1) | Medium |
| CVE-2019-19368 | Rumpus FTP Web File Manager 8.2.9.1 - Cross-Site Scripting | rumpus | 6.1 (v3.1) | Medium |
| CVE-2019-19908 | phpMyChat-Plus 1.98 - Cross-Site Scripting | phpmychat-plus | 6.1 (v3.1) | Medium |
| CVE-2019-20141 | WordPress Laborator Neon Theme 2.0 - Cross-Site Scripting | neon | 6.1 (v3.1) | Medium |
| CVE-2019-20210 | WordPress CTHthemes - Cross-Site Scripting | citybook | 6.1 (v3.1) | Medium |
| CVE-2019-3402 | Jira < 8.1.1 - Cross-Site Scripting | jira | 6.1 (v3.0) | Medium |
| CVE-2019-3911 | LabKey Server Community Edition <18.3.0 - Cross-Site Scripting | labkey server | 6.1 (v3.1) | Medium |
| CVE-2019-6112 | WordPress Sell Media 2.4.1 - Cross-Site Scripting | sell media | 6.1 (v3.1) | Medium |
| CVE-2019-7219 | Zarafa WebApp <=2.0.1.47791 - Cross-Site Scripting | webaccess | 6.1 (v3.0) | Medium |
| CVE-2019-7255 | Linear eMerge E3 - Cross-Site Scripting | linear emerge essential firmware | 6.1 (v3.1) | Medium |
| CVE-2019-7438 | JioFi 4G M2S 1.0.2 - 'mask' Cross-Site Scripting | jiofi 4g m2s firmware | 6.1 (v3.0) | Medium |
| CVE-2019-8390 | qdPM 9.1 - 'search[keywords]' Cross-Site Scripting | qdpm | 6.1 (v3.0) | Medium |
| CVE-2019-8937 | HotelDruid 2.3.0 - Cross-Site Scripting | hoteldruid | 6.1 (v3.0) | Medium |
| CVE-2019-9591 | ShoreTel Connect ONSITE < 19.49.1500.0 - Multiple Vulnerabilities | connect onsite | 6.1 (v3.1) | Medium |
| CVE-2019-9592 | ShoreTel Connect ONSITE < 19.49.1500.0 - Multiple Vulnerabilities | connect onsite | 6.1 (v3.1) | Medium |
| CVE-2019-9593 | ShoreTel Connect ONSITE < 19.49.1500.0 - Multiple Vulnerabilities | connect onsite | 6.1 (v3.1) | Medium |
| CVE-2020-1106 | Microsoft Office SharePoint XSS Vulnerability | sharepoint enterprise server | 6.1 (v3.1) | Medium |
| CVE-2020-12054 | WordPress Catch Breadcrumb <1.5.4 - Cross-Site Scripting | catch breadcrumb | 6.1 (v3.1) | Medium |
| CVE-2020-13258 | Contentful <=2020-05-21 - Cross-Site Scripting | python example | 6.1 (v3.1) | Medium |
| CVE-2020-13820 | Extreme Management Center 8.4.1.24 - Cross-Site Scripting | extreme management center | 6.1 (v3.1) | Medium |
| CVE-2020-14413 | NeDi 1.9C - Cross-Site Scripting | nedi | 6.1 (v3.1) | Medium |
| CVE-2020-15500 | TileServer GL <=3.0.0 - Cross-Site Scripting | tileservergl | 6.1 (v3.1) | Medium |
| CVE-2020-15599 | Victor CMS 1.0 - 'user_firstname' Persistent Cross-Site Scripting | victor cms | 6.1 (v3.1) | Medium |
| CVE-2020-15718 | RosarioSIS 6.7.2 - Cross-Site Scripting | rosariosis | 6.1 (v3.1) | Medium |
| CVE-2020-17362 | Nova Lite < 1.3.9 - Cross-Site Scripting | nova lite | 6.1 (v3.1) | Medium |
| CVE-2020-19282 | Jeesns 1.4.2 - Cross-Site Scripting | jeesns | 6.1 (v3.1) | Medium |
| CVE-2020-19283 | Jeesns 1.4.2 - Cross-Site Scripting | jeesns | 6.1 (v3.1) | Medium |
| CVE-2020-23517 | Aryanic HighMail (High CMS) - Cross-Site Scripting | high cms | 6.1 (v3.1) | Medium |
| CVE-2020-23814 | XXL-JOB v2.2.0 — Stored Cross Site Scripting | xxl-job | 6.1 (v3.1) | Medium |
| CVE-2020-24223 | Mara CMS 7.5 - Cross-Site Scripting | mara cms | 6.1 (v3.1) | Medium |
| CVE-2020-24609 | Savsoft Quiz 5 - Stored Cross-Site Scripting | savsoft quiz | 6.1 (v3.1) | Medium |
| CVE-2020-24701 | OX Appsuite - Cross-Site Scripting | open-xchange appsuite | 6.1 (v3.1) | Medium |
| CVE-2020-24902 | Quixplorer <=2.4.1 - Cross-Site Scripting | quixplorer | 6.1 (v3.1) | Medium |
| CVE-2020-24903 | Cute Editor for ASP.NET 6.4 - Cross-Site Scripting | cute editor | 6.1 (v3.1) | Medium |
| CVE-2020-25495 | SCO Openserver 5.0.7 - 'section' Reflected XSS | openserver | 6.1 (v3.1) | Medium |
| CVE-2020-26153 | Event Espresso Core-Reg 4.10.7.p - Cross-Site Scripting | event espresso | 6.1 (v3.1) | Medium |
| CVE-2020-27982 | IceWarp WebMail 11.4.5.0 - Cross-Site Scripting | mail server | 6.1 (v3.1) | Medium |
| CVE-2020-29395 | Wordpress EventON Calendar 3.0.5 - Cross-Site Scripting | eventon | 6.1 (v3.1) | Medium |
| CVE-2020-35416 | PHPJabbers Appointment Scheduler 2.3 - Reflected XSS (Cross-Site Scripting) | phpjabbers appointment scheduler | 6.1 (v3.1) | Medium |
| CVE-2020-3580 | Cisco ASA/FTD Software - Cross-Site Scripting | firepower threat defense | 6.1 (v3.1) | Medium |
| CVE-2020-5191 | Hospital Management System 4.0 - Persistent Cross-Site Scripting | hospital management system | 6.1 (v3.1) | Medium |
| CVE-2020-6171 | CLink Office 2.0 - Cross-Site Scripting | clink office | 6.1 (v3.1) | Medium |
| CVE-2020-7107 | WordPress Ultimate FAQ <1.8.30 - Cross-Site Scripting | ultimate faq | 6.1 (v3.1) | Medium |
| CVE-2020-8191 | Citrix ADC/Gateway - Cross-Site Scripting | application delivery controller firmware | 6.1 (v3.1) | Medium |
| CVE-2020-8512 | IceWarp WebMail Server <=11.4.4.1 - Cross-Site Scripting | icewarp server | 6.1 (v3.1) | Medium |
| CVE-2020-9344 | Jira Subversion ALM for Enterprise <8.8.2 - Cross-Site Scripting | subversion application lifecycle management | 6.1 (v3.1) | Medium |
| CVE-2021-20137 | Gryphon Tower - Cross-Site Scripting | gryphon tower | 6.1 (v3.1) | Medium |
| CVE-2021-21799 | Advantech R-SeeNet 2.4.12 - Cross-Site Scripting | r-seenet | 6.1 (v3.1) | Medium |
| CVE-2021-21800 | Advantech R-SeeNet 2.4.12 - Cross-Site Scripting | r-seenet | 6.1 (v3.1) | Medium |
| CVE-2021-21801 | Advantech R-SeeNet - Cross-Site Scripting | r-seenet | 6.1 (v3.1) | Medium |
| CVE-2021-21802 | Advantech R-SeeNet - Cross-Site Scripting | r-seenet | 6.1 (v3.1) | Medium |
| CVE-2021-21803 | Advantech R-SeeNet - Cross-Site Scripting | r-seenet | 6.1 (v3.1) | Medium |
| CVE-2021-24214 | WordPress OpenID Connect Generic Client 3.8.0-3.8.1 - Cross-Site Scripting | openid connect generic client | 6.1 (v3.1) | Medium |
| CVE-2021-24235 | WordPress Goto Tour & Travel Theme <2.0 - Cross-Site Scripting | goto | 6.1 (v3.1) | Medium |
| CVE-2021-24237 | WordPress Realteo <=1.2.3 - Cross-Site Scripting | findeo | 6.1 (v3.1) | Medium |
| CVE-2021-24245 | WordPress Plugin Stop Spammers 2021.8 - 'log' Reflected Cross-site Scripting (XSS) | stop spammers | 6.1 (v3.1) | Medium |
| CVE-2021-24298 | WordPress Simple Giveaways <2.36.2 - Cross-Site Scripting | simple giveaways | 6.1 (v3.1) | Medium |
| CVE-2021-24316 | WordPress Mediumish Theme <=1.0.47 - Cross-Site Scripting | mediumish | 6.1 (v3.1) | Medium |
| CVE-2021-24320 | WordPress Bello Directory & Listing Theme <1.6.0 - Cross-Site Scripting | bello | 6.1 (v3.1) | Medium |
| CVE-2021-24335 | WordPress Car Repair Services & Auto Mechanic Theme <4.0 - Cross-Site Scripting | car repair services & auto mechanic | 6.1 (v3.1) | Medium |
| CVE-2021-24342 | WordPress JNews Theme <8.0.6 - Cross-Site Scripting | jnews | 6.1 (v3.1) | Medium |
| CVE-2021-24387 | WordPress Pro Real Estate 7 Theme <3.1.1 - Cross-Site Scripting | real estate 7 | 6.1 (v3.1) | Medium |
| CVE-2021-24389 | WordPress FoodBakery <2.2 - Cross-Site Scripting | foodbakery | 6.1 (v3.1) | Medium |
| CVE-2021-24435 | WordPress Titan Framework plugin <= 1.12.1 - Cross-Site Scripting | titan framework | 6.1 (v3.1) | Medium |
| CVE-2021-24495 | Wordpress Marmoset Viewer <1.9.3 - Cross-Site Scripting | marmoset viewer | 6.1 (v3.1) | Medium |
| CVE-2021-24498 | WordPress Calendar Event Multi View <1.4.01 - Cross-Site Scripting | calendar event multi view | 6.1 (v3.1) | Medium |
| CVE-2021-24522 | ProfilePress < 3.1.11 - Cross-Site Scripting | profilepress | 6.1 (v3.1) | Medium |
| CVE-2021-26247 | Cacti - Cross-Site Scripting | cacti | 6.1 (v3.1) | Medium |
| CVE-2021-26475 | EPrints 3.4.2 - Cross-Site Scripting | eprints | 6.1 (v3.1) | Medium |
| CVE-2021-26702 | EPrints 3.4.2 - Cross-Site Scripting | eprints | 6.1 (v3.1) | Medium |
| CVE-2021-26710 | Redwood Report2Web 4.3.4.5 & 4.5.3 - Cross-Site Scripting | report2web | 6.1 (v3.1) | Medium |
| CVE-2021-26723 | Jenzabar 9.2x-9.2.2 - Cross-Site Scripting | jenzabar | 6.1 (v3.1) | Medium |
| CVE-2021-26947 | Odoo <= 15.0 - Cross-Site Scripting | odoo | 6.1 (v3.1) | Medium |
| CVE-2021-27309 | Clansphere CMS 2011.4 - Cross-Site Scripting | clansphere | 6.1 (v3.1) | Medium |
| CVE-2021-27310 | Clansphere CMS 2011.4 - Cross-Site Scripting | clansphere | 6.1 (v3.1) | Medium |
| CVE-2021-27519 | FUDForum 3.1.0 - Cross-Site Scripting | fudforum | 6.1 (v3.1) | Medium |
| CVE-2021-27520 | FUDForum 3.1.0 - Cross-Site Scripting | fudforum | 6.1 (v3.1) | Medium |
| CVE-2021-27695 | openMAINT openMAINT 2.1-3.3-b - 'Multiple' Persistent Cross-Site Scripting | openmaint | 6.1 (v3.1) | Medium |
| CVE-2021-29625 | Adminer <=4.8.0 - Cross-Site Scripting | adminer | 6.1 (v3.1) | Medium |
| CVE-2021-30049 | SysAid Technologies 20.3.64 b14 - Cross-Site Scripting | sysaid | 6.1 (v3.1) | Medium |
| CVE-2021-30134 | Php-mod/curl Library <2.3.2 - Cross-Site Scripting | php curl class | 6.1 (v3.1) | Medium |
| CVE-2021-30203 | Dzzoffice 2.02.1 - Cross-Site Scripting | dzzoffice | 6.1 (v3.1) | Medium |
| CVE-2021-30213 | Knowage Suite 7.3 - Cross-Site Scripting | knowage | 6.1 (v3.1) | Medium |
| CVE-2021-31537 | SIS Informatik REWE GO SP17 <7.7 - Cross-Site Scripting | sis-rewe go | 6.1 (v3.1) | Medium |
| CVE-2021-31589 | BeyondTrust Secure Remote Access Base <=6.0.1 - Cross-Site Scripting | appliance base software | 6.1 (v3.1) | Medium |
| CVE-2021-31682 | WebCTRL OEM <= 6.5 - Cross-Site Scripting | webctrl | 6.1 (v3.1) | Medium |
| CVE-2021-31862 | SysAid 20.4.74 - Cross-Site Scripting | sysaid | 6.1 (v3.1) | Medium |
| CVE-2021-34630 | GTranslate < 2.8.65 - Cross-Site Scripting | gtranslate | 6.1 (v3.1) | Medium |
| CVE-2021-35488 | Thruk 2.40-2 - Cross-Site Scripting | thruk | 6.1 (v3.1) | Medium |
| CVE-2021-36646 | KodExplorer - Cross-Site Scripting | kod-explorer | 6.1 (v3.1) | Medium |
| CVE-2021-37416 | Zoho ManageEngine ADSelfService Plus <=6103 - Cross-Site Scripting | manageengine adselfservice plus | 6.1 (v3.1) | Medium |
| CVE-2021-37833 | Hotel Druid 3.0.2 - Cross-Site Scripting | hoteldruid | 6.1 (v3.1) | Medium |
| CVE-2021-3831 | Gnuboard 5 - Cross-Site Scripting | gnuboard5 | 6.1 (v3.1) | Medium |
| CVE-2021-38702 | Cyberoam NetGenie Cross-Site Scripting | netgenie c0101b1-20141120-ng11vo firmware | 6.1 (v3.1) | Medium |
| CVE-2021-38704 | ClinicCases 7.3.3 Cross-Site Scripting | cliniccases | 6.1 (v3.1) | Medium |
| CVE-2021-39411 | Hospital Management System 1.0 - Cross-Site Scripting | hospital management system | 6.1 (v3.1) | Medium |
| CVE-2021-40542 | Opensis-Classic 8.0 - Cross-Site Scripting | opensis | 6.1 (v3.1) | Medium |
| CVE-2021-40868 | Cloudron 6.2 Cross-Site Scripting | cloudron | 6.1 (v3.1) | Medium |
| CVE-2021-41467 | JustWriting - Cross-Site Scripting | justwriting | 6.1 (v3.1) | Medium |
| CVE-2021-41951 | Resourcespace - Cross-Site Scripting | resourcespace | 6.1 (v3.1) | Medium |
| CVE-2021-42565 | myfactory FMS - Cross-Site Scripting | fms | 6.1 (v3.1) | Medium |
| CVE-2021-42567 | Apereo CAS Cross-Site Scripting | central authentication service | 6.1 (v3.1) | Medium |
| CVE-2021-43062 | Fortinet FortiMail 7.0.1 - Cross-Site Scripting | fortimail | 6.1 (v3.1) | Medium |
| CVE-2021-43574 | Atmail 6.5.0 - Cross-Site Scripting | atmail | 6.1 (v3.1) | Medium |
| CVE-2021-43725 | Spotweb <= 1.5.1 - Cross Site Scripting (Reflected) | spotweb | 6.1 (v3.1) | Medium |
| CVE-2021-45380 | AppCMS - Cross-Site Scripting | appcms | 6.1 (v3.1) | Medium |
| CVE-2021-45422 | Reprise License Manager 14.2 - Cross-Site Scripting | reprise license manager | 6.1 (v3.1) | Medium |
| CVE-2021-45425 | SAFARI Montage 8.5 - Reflected Cross Site Scripting (XSS) | safari montage | 6.1 (v3.1) | Medium |
| CVE-2021-46387 | Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting (XSS) | zywall 2 plus internet security appliance firmware | 6.1 (v3.1) | Medium |
| CVE-2022-0201 | WordPress Permalink Manager <2.2.15 - Cross-Site Scripting | permalink manager lite | 6.1 (v3.1) | Medium |
| CVE-2022-0208 | WordPress Plugin MapPress <2.73.4 - Cross-Site Scripting | mappress | 6.1 (v3.1) | Medium |
| CVE-2022-0346 | WordPress XML Sitemap Generator for Google <2.0.4 - Cross-Site Scripting/Remote Code Execution | xml sitemap generator | 6.1 (v3.1) | Medium |
| CVE-2022-0678 | Microweber <1.2.11 - Cross-Site Scripting | microweber | 6.1 (v3.1) | Medium |
| CVE-2022-0879 | Caldera Forms < 1.9.7 - Reflected Cross-Site Scripting | caldera forms | 6.1 (v3.1) | Medium |
| CVE-2022-1168 | WordPress WP JobSearch <1.5.1 - Cross-Site Scripting | jobsearch wp job board | 6.1 (v3.1) | Medium |
| CVE-2022-1170 | JobMonster < 4.5.2.9 - Cross-Site Scripting | jobmonster | 6.1 (v3.1) | Medium |
| CVE-2022-1221 | WordPress Gwyn's Imagemap Selector <=0.3.3 - Cross-Site Scripting | gwyn's imagemap selector | 6.1 (v3.1) | Medium |
| CVE-2022-2130 | Microweber < 1.2.17 - Cross-Site Scripting | microweber | 6.1 (v3.1) | Medium |
| CVE-2022-2174 | microweber 1.2.18 - Cross-site Scripting | microweber | 6.1 (v3.1) | Medium |
| CVE-2022-22242 | Juniper Web Device Manager - Cross-Site Scripting | junos | 6.1 (v3.1) | Medium |
| CVE-2022-24384 | SmarterTools SmarterTrack - Cross-Site Scripting | smartertrack | 6.1 (v3.1) | Medium |
| CVE-2022-26564 | HotelDruid Hotel Management Software 3.0.3 - Cross-Site Scripting | hoteldruid | 6.1 (v3.1) | Medium |
| CVE-2022-2733 | Openemr < 7.0.0.1 - Cross-Site Scripting | openemr | 6.1 (v3.1) | Medium |
| CVE-2022-27926 | Zimbra Collaboration (ZCS) - Cross Site Scripting | collaboration | 6.1 (v3.1) | Medium |
| CVE-2022-28363 | Reprise License Manager 14.2 - Cross-Site Scripting | reprise license manager | 6.1 (v3.1) | Medium |
| CVE-2022-28508 | MantisBT < 2.25.2 - Cross-Site Scripting | mantisbt | 6.1 (v3.1) | Medium |
| CVE-2022-29004 | Diary Management System 1.0 - Cross-Site Scripting | e-diary management system | 6.1 (v3.1) | Medium |
| CVE-2022-29005 | Online Birth Certificate System 1.2 - Stored Cross-Site Scripting | online birth certificate system | 6.1 (v3.1) | Medium |
| CVE-2022-30489 | Wavlink WN-535G3 - Cross-Site Scripting | wn535g3 firmware | 6.1 (v3.1) | Medium |
| CVE-2022-30776 | Atmail 6.5.0 - Cross-Site Scripting | atmail | 6.1 (v3.1) | Medium |
| CVE-2022-30777 | Parallels H-Sphere 3.6.1713 - Cross-Site Scripting | h-sphere | 6.1 (v3.1) | Medium |
| CVE-2022-31470 | Axigen WebMail - Cross-Site Scripting | webmail | 6.1 (v3.1) | Medium |
| CVE-2022-31798 | Nortek Linear eMerge E3-Series - Cross-Site Scripting | emerge e3 firmware | 6.1 (v3.1) | Medium |
| CVE-2022-32195 | Open edX <2022-06-06 - Cross-Site Scripting | open edx | 6.1 (v3.1) | Medium |
| CVE-2022-3242 | Microweber <1.3.2 - Cross-Site Scripting | microweber | 6.1 (v3.1) | Medium |
| CVE-2022-32770 | WWBN AVideo 11.6 - Cross-Site Scripting | avideo | 6.1 (v3.1) | Medium |
| CVE-2022-32771 | WWBN AVideo 11.6 - Cross-Site Scripting | avideo | 6.1 (v3.1) | Medium |
| CVE-2022-32772 | WWBN AVideo 11.6 - Cross-Site Scripting | avideo | 6.1 (v3.1) | Medium |
| CVE-2022-33119 | NUUO NVRsolo Video Recorder 03.06.02 - Cross-Site Scripting | nvrsolo firmware | 6.1 (v3.1) | Medium |
| CVE-2022-34093 | Software Publico Brasileiro i3geo v7.0.5 - Cross-Site Scripting | i3geo | 6.1 (v3.1) | Medium |
| CVE-2022-34094 | Software Publico Brasileiro i3geo v7.0.5 - Cross-Site Scripting | i3geo | 6.1 (v3.1) | Medium |
| CVE-2022-34305 | Apache Tomcat Examples Web Application - Cross-Site Scripting | tomcat | 6.1 (v3.1) | Medium |
| CVE-2022-34328 | PMB 7.3.10 - Cross-Site Scripting | pmb | 6.1 (v3.1) | Medium |
| CVE-2022-3484 | WordPress WPB Show Core - Cross-Site Scripting | wpb show core | 6.1 (v3.1) | Medium |
| CVE-2022-35155 | Bus Pass Management System 1.0 - Cross-Site Scripting (XSS) | bus pass management system | 6.1 (v3.1) | Medium |
| CVE-2022-35416 | H3C SSL VPN <=2022-07-10 - Cross-Site Scripting | ssl vpn | 6.1 (v3.1) | Medium |
| CVE-2022-35493 | eShop 3.0.4 - Cross-Site Scripting | eshop - ecommerce / store website | 6.1 (v3.1) | Medium |
| CVE-2022-35653 | Moodle LTI module Reflected - Cross-Site Scripting | moodle | 6.1 (v3.1) | Medium |
| CVE-2022-37153 | Artica Proxy 4.30.000000 - Cross-Site Scripting | artica proxy | 6.1 (v3.1) | Medium |
| CVE-2022-3766 | phpMyFAQ < 3.1.8 - Cross-Site Scripting | phpmyfaq | 6.1 (v3.1) | Medium |
| CVE-2022-38295 | Cuppa CMS v1.0 - Cross Site Scripting | cuppacms | 6.1 (v3.1) | Medium |
| CVE-2022-38467 | CRM Perks Forms < 1.1.1 - Cross Site Scripting | crm perks forms | 6.1 (v3.1) | Medium |
| CVE-2022-38553 | Academy Learning Management System <5.9.1 - Cross-Site Scripting | academy learning management system | 6.1 (v3.1) | Medium |
| CVE-2022-39195 | LISTSERV 17 - Cross-Site Scripting | listserv | 6.1 (v3.1) | Medium |
| CVE-2022-41441 | ReQlogic v11.3 - Cross Site Scripting | reqlogic | 6.1 (v3.1) | Medium |
| CVE-2022-41473 | RPCMS 3.0.2 - Cross-Site Scripting | rpcms | 6.1 (v3.1) | Medium |
| CVE-2022-42118 | Liferay Portal - Cross-site Scripting | liferay portal | 6.1 (v3.1) | Medium |
| CVE-2022-4301 | WordPress Sunshine Photo Cart <2.9.15 - Cross-Site Scripting | sunshine photo cart | 6.1 (v3.1) | Medium |
| CVE-2022-43016 | OpenCATS 0.9.6 - Cross-Site Scripting | opencats | 6.1 (v3.1) | Medium |
| CVE-2022-4321 | PDF Generator for WordPress < 1.1.2 - Cross Site Scripting | pdf generator for wordpress | 6.1 (v3.1) | Medium |
| CVE-2022-45836 | WordPress Download Manager <= 3.2.59 - Reflected XSS | download manager | 6.1 (v3.1) | Medium |
| CVE-2022-46073 | Helmet Store Showroom - Cross Site Scripting | helmet store showroom | 6.1 (v3.1) | Medium |
| CVE-2022-46381 | Linear eMerge E3-Series - Cross-Site Scripting | linear emerge e3 access control firmware | 6.1 (v3.1) | Medium |
| CVE-2022-46888 | NexusPHP <1.7.33 - Cross-Site Scripting | nexusphp | 6.1 (v3.1) | Medium |
| CVE-2022-48012 | OpenCATS 0.9.7 - Cross-Site Scripting | opencats | 6.1 (v3.1) | Medium |
| CVE-2022-48197 | Yahoo User Interface library (YUI2) TreeView v2.8.2 - Cross-Site Scripting | yui | 6.1 (v3.1) | Medium |
| CVE-2023-0099 | Simple URLs < 115 - Cross Site Scripting | simple urls | 6.1 (v3.1) | Medium |
| CVE-2023-0236 | WordPress Tutor LMS <2.0.10 - Cross Site Scripting | tutor lms | 6.1 (v3.1) | Medium |
| CVE-2023-0334 | ShortPixel Adaptive Images < 3.6.3 - Cross Site Scripting | shortpixel adaptive images | 6.1 (v3.1) | Medium |
| CVE-2023-0527 | Online Security Guards Hiring System - Cross-Site Scripting | online security guards hiring system | 6.1 (v3.1) | Medium |
| CVE-2023-0676 | phpIPAM 1.5.1 - Cross-site Scripting | phpipam | 6.1 (v3.1) | Medium |
| CVE-2023-1119 | WP-Optimize WordPress plugin < 3.2.13 - Cross-Site Scripting | wp-optimize,srbtranslatin | 6.1 (v3.1) | Medium |
| CVE-2023-1880 | Phpmyfaq v3.1.11 - Cross-Site Scripting | phpmyfaq | 6.1 (v3.1) | Medium |
| CVE-2023-2309 | wpForo Forum <= 2.1.8 - Cross-Site Scripting | wpforo forum | 6.1 (v3.1) | Medium |
| CVE-2023-23161 | Art Gallery Management System Project v1.0 - Cross-Site Scripting | art gallery management system | 6.1 (v3.1) | Medium |
| CVE-2023-24278 | Squidex <7.4.0 - Cross-Site Scripting | squidex | 6.1 (v3.1) | Medium |
| CVE-2023-24488 | Citrix Gateway and Citrix ADC - Cross-Site Scripting | gateway | 6.1 (v3.1) | Medium |
| CVE-2023-24657 | phpIPAM - 1.6 - Cross-Site Scripting | phpipam | 6.1 (v3.1) | Medium |
| CVE-2023-24733 | PMB 7.4.6 - Cross-Site Scripting | pmb | 6.1 (v3.1) | Medium |
| CVE-2023-24737 | PMB v7.4.6 - Cross-Site Scripting | pmb | 6.1 (v3.1) | Medium |
| CVE-2023-25346 | ChurchCRM 4.5.3 - Cross-Site Scripting | churchcrm | 6.1 (v3.1) | Medium |
| CVE-2023-27641 | L-Soft LISTSERV 16.5 - Cross-Site Scripting | listserv | 6.1 (v3.1) | Medium |
| CVE-2023-2813 | Wordpress Multiple Themes - Reflected Cross-Site Scripting | connections reloaded | 6.1 (v3.1) | Medium |
| CVE-2023-2822 | Ellucian Ethos Identity CAS - Cross-Site Scripting | ethos identity | 6.1 (v3.1) | Medium |
| CVE-2023-2949 | OpenEMR < 7.0.1 - Cross-site Scripting | openemr | 6.1 (v3.1) | Medium |
| CVE-2023-29623 | Purchase Order Management v1.0 - Cross Site Scripting (Reflected) | purchase order management | 6.1 (v3.1) | Medium |
| CVE-2023-30210 | OURPHP <= 7.2.0 - Cross Site Scripting | ourphp | 6.1 (v3.1) | Medium |
| CVE-2023-30212 | OURPHP <= 7.2.0 - Cross Site Scripting | ourphp | 6.1 (v3.1) | Medium |
| CVE-2023-34599 | Gibbon v25.0.0 - Cross-Site Scripting | gibbon | 6.1 (v3.1) | Medium |
| CVE-2023-3479 | Hestiacp <= 1.7.7 - Cross-Site Scripting | control panel | 6.1 (v3.1) | Medium |
| CVE-2023-35155 | XWiki - Cross-Site Scripting | xwiki | 6.1 (v3.1) | Medium |
| CVE-2023-3521 | FOSSBilling < 0.5.3 - Cross-Site Scripting | fossbilling | 6.1 (v3.1) | Medium |
| CVE-2023-36306 | Adiscon LogAnalyzer v.4.1.13 - Cross-Site Scripting | loganalyzer | 6.1 (v3.1) | Medium |
| CVE-2023-36346 | POS Codekop v2.0 - Cross Site Scripting | codekop | 6.1 (v3.1) | Medium |
| CVE-2023-37580 | Zimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site Scripting | zimbra | 6.1 (v3.1) | Medium |
| CVE-2023-37728 | IceWarp Webmail Server v10.2.1 - Cross Site Scripting | icewarp | 6.1 (v3.1) | Medium |
| CVE-2023-38192 | SuperWebMailer 9.00.0.01710 - Cross-Site Scripting | superwebmailer | 6.1 (v3.1) | Medium |
| CVE-2023-38194 | SuperWebMailer - Cross-Site Scripting | superwebmailer | 6.1 (v3.1) | Medium |
| CVE-2023-38501 | CopyParty v1.8.6 - Cross Site Scripting | copyparty | 6.1 (v3.1) | Medium |
| CVE-2023-38875 | PHP Login System 2.0.1 - Cross-Site Scripting | php-login-system | 6.1 (v3.1) | Medium |
| CVE-2023-38910 | CSZ CMS 1.3.0 - Stored Cross-Site Scripting ('Photo URL' and 'YouTube URL' ) | csz cms | 6.1 (v3.1) | Medium |
| CVE-2023-38964 | Academy LMS 6.0 - Cross-Site Scripting | academy lms | 6.1 (v3.1) | Medium |
| CVE-2023-39598 | IceWarp Email Client - Cross Site Scripting | webclient | 6.1 (v3.1) | Medium |
| CVE-2023-39600 | IceWarp 11.4.6.0 - Cross-Site Scripting | icewarp | 6.1 (v3.1) | Medium |
| CVE-2023-39700 | IceWarp Mail Server v10.4.5 - Cross-Site Scripting | mail server | 6.1 (v3.1) | Medium |
| CVE-2023-3990 | Mingsoft MCMS < 5.3.1 - Cross-Site Scripting | mcms | 6.1 (v3.1) | Medium |
| CVE-2023-40750 | PHPJabbers Yacht Listing Script v1.0 - Cross-Site Scripting | yacht listing script | 6.1 (v3.1) | Medium |
| CVE-2023-40751 | PHPJabbers Fundraising Script v1.0 - Cross-Site Scripting | fundraising script | 6.1 (v3.1) | Medium |
| CVE-2023-40752 | PHPJabbers Make an Offer Widget v1.0 - Cross-Site Scripting | make an offer widget | 6.1 (v3.1) | Medium |
| CVE-2023-40755 | PHPJabbers Callback Widget v1.0 - Cross-Site Scripting | callback widget | 6.1 (v3.1) | Medium |
| CVE-2023-4110 | PHPJabbers Availability Booking Calendar 5.0 - Cross-Site Scripting | availability booking calendar | 6.1 (v3.1) | Medium |
| CVE-2023-4111 | PHPJabbers Bus Reservation System 1.1 - Cross-Site Scripting | bus reservation system | 6.1 (v3.1) | Medium |
| CVE-2023-4113 | PHPJabbers Service Booking Script 1.0 - Cross Site Scripting | service booking script | 6.1 (v3.1) | Medium |
| CVE-2023-4114 | PHP Jabbers Night Club Booking 1.0 - Cross Site Scripting | night club booking software | 6.1 (v3.1) | Medium |
| CVE-2023-4115 | PHPJabbers Cleaning Business 1.0 - Cross-Site Scripting | cleaning business software | 6.1 (v3.1) | Medium |
| CVE-2023-4116 | PHPJabbers Taxi Booking 2.0 - Cross Site Scripting | taxi booking script | 6.1 (v3.1) | Medium |
| CVE-2023-4136 | CrafterCMS Engine - Cross-Site Scripting | craftercms | 6.1 (v3.1) | Medium |
| CVE-2023-41538 | PHPJabbers PHP Forum Script 3.0 - Cross-Site Scripting | php forum script | 6.1 (v3.1) | Medium |
| CVE-2023-41597 | EyouCms v1.6.2 - Cross-Site Scripting | eyoucms | 6.1 (v3.1) | Medium |
| CVE-2023-4174 | mooSocial 3.1.6 - Reflected Cross Site Scripting | moostore | 6.1 (v3.1) | Medium |
| CVE-2023-42343 | OpenCMS - Cross-Site Scripting | opencms | 6.1 (v3.1) | Medium |
| CVE-2023-44012 | mojoPortal v.2.7.0.0 - Cross-Site Scripting | mojoportal | 6.1 (v3.1) | Medium |
| CVE-2023-44812 | mooSocial v.3.1.8 - Cross-Site Scripting | moosocial | 6.1 (v3.1) | Medium |
| CVE-2023-4547 | SPA-Cart eCommerce CMS 1.9.0.3 - Cross-Site Scripting | ecommerce cms | 6.1 (v3.1) | Medium |
| CVE-2023-45542 | MooSocial 3.1.8 - Cross-Site Scripting | moosocial | 6.1 (v3.1) | Medium |
| CVE-2023-46020 | Blood Bank v1.0 - Stored Cross Site Scripting (XSS) | blood bank | 6.1 (v3.1) | Medium |
| CVE-2023-46732 | XWiki < 14.10.14 - Cross-Site Scripting | xwiki | 6.1 (v3.1) | Medium |
| CVE-2023-48728 | WWBN AVideo 11.6 - Cross-Site Scripting | avideo | 6.1 (v3.1) | Medium |
| CVE-2023-49293 | Vite dev server - Cross-Site Scripting | vite | 6.1 (v3.1) | Medium |
| CVE-2023-49489 | KodeExplorer 4.51 - Reflective Cross Site Scripting (XSS) | kodexplorer | 6.1 (v3.1) | Medium |
| CVE-2023-49494 | DedeCMS v5.7.111 - Cross-Site Scripting | dedecms | 6.1 (v3.1) | Medium |
| CVE-2023-5558 | LearnPress < 4.2.5.5 - Cross-Site Scripting | learnpress | 6.1 (v3.1) | Medium |
| CVE-2023-5758 | firefox mobile Cross-Site Scripting Vulnerability | firefox mobile | 6.1 (v3.1) | Medium |
| CVE-2023-5863 | phpMyFAQ < 3.2.0 - Cross-site Scripting | phpmyfaq | 6.1 (v3.1) | Medium |
| CVE-2023-6275 | TOTVS Fluig Platform - Cross-Site Scripting | fluig | 6.1 (v3.1) | Medium |
| CVE-2023-6379 | OpenCMS 14 & 15 - Cross Site Scripting | opencms | 6.1 (v3.1) | Medium |
| CVE-2024-13727 | MemberSpace WordPress - Cross-Site Scripting | memberspace | 6.1 (v3.1) | Medium |
| CVE-2024-13853 | WordPress SEO Tools Plugin 4.0.7 - Cross-Site Scripting | seo-automatic-seo-tools | 6.1 (v3.1) | Medium |
| CVE-2024-24494 | Daily Habit Tracker 1.0 - Stored Cross-Site Scripting (XSS) | daily habit tracker | 6.1 (v3.1) | Medium |
| CVE-2024-28734 | Coda v.2024Q1 - Cross-Site Scripting | Unit4 Financials by Coda prior to 2023Q4 | 6.1 (v3.1) | Medium |
| CVE-2024-3231 | Popup4Phone <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting | popup4phone | 6.1 (v3.1) | Medium |
| CVE-2024-33326 | LumisXP - Cross-site Scripting | lumis experience platform | 6.1 (v3.1) | Medium |
| CVE-2024-35693 | WordPress 12 Step Meeting List Plugin <= 3.14.33 - Cross-Site Scripting | 12 step meeting list | 6.1 (v3.1) | Medium |
| CVE-2024-37259 | WP Extended < 3.0.0 - Stored Cross-Site Scripting | wp extended | 6.1 (v3.1) | Medium |
| CVE-2024-41810 | Twisted - Open Redirect & XSS | twisted | 6.1 (v3.1) | Medium |
| CVE-2024-55218 | IceWarp Server 10.2.1 - Cross-Site Scripting | mail server | 6.1 (v3.1) | Medium |
| CVE-2025-1303 | Plugin Oficial – Getnet para WooCommerce <= 1.8.0 - Cross-Site Scripting | plugin oficial | 6.1 (v3.1) | Medium |
| CVE-2025-25296 | Label Studio < 1.16.0 - Cross-Site Scripting | label studio | 6.1 (v3.1) | Medium |
| CVE-2025-2609 | MagnusBilling Login Logs - Cross-Site Scripting | magnusbilling | 6.1 (v3.1) | Medium |
| CVE-2025-46349 | YesWiki Reflected XSS via File Upload | yeswiki | 6.1 (v3.1) | Medium |
| CVE-2025-4652 | Broadstreet WordPress plugin - Reflected XSS | broadstreet | 6.1 (v3.1) | Medium |
| CVE-2025-46549 | YesWiki <= 4.5.1 - Cross-Site Scripting | yeswiki | 6.1 (v3.1) | Medium |
| CVE-2025-46550 | YesWiki < 4.5.4 - Cross-Site Scripting | yeswiki | 6.1 (v3.1) | Medium |
| CVE-2025-47204 | Bootstrap Multiselect <= 1.1.2 - Cross-Site Scripting | bootstrap multiselect | 6.1 (v3.1) | Medium |
| CVE-2025-48954 | Discourse OAuth Social Login - Cross-site Scripting | discourse | 6.1 (v3.1) | Medium |
| CVE-2025-51501 | Microweber CMS2.0 - Cross-Site Scripting | microweber | 6.1 (v3.1) | Medium |
| CVE-2025-5301 | ONLYOFFICE Docs (DocumentServer) - Reflected Cross-Site Scripting | Docs (DocumentServer) | 6.1 (v3.1) | Medium |
| CVE-2025-54589 | Copyparty <=1.18.6 - Cross-Site Scripting | copyparty | 6.1 (v3.1) | Medium |
| CVE-2025-54597 | Heimdall Application Dashboard < 2.7.3 - Reflected XSS | heimdall | 6.1 (v3.1) | Medium |
| CVE-2025-6174 | WordPress Qwizcards < 3.95 - Cross-Site Scripting (Reflected) | Qwizcards | online quizzes and flashcards | 6.1 (v3.1) | Medium |
| CVE-2025-63607 | TechStore 1.0 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium |
| CVE-2025-65341 | Ecommerce Fruits Bazar 1.0 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium |
| CVE-2026-0594 | WordPress List Site Contributors < 1.1.8 - Reflected XSS | List Site Contributors | 6.1 (v3.1) | Medium |
| CVE-2026-11588 | EONSR AEO Agent <= 3.7.9 - Unauthenticated Stored XSS via Scheduled Post Creation | EONSR AEO Agent | 6.1 (v3.1) | Medium |
| CVE-2026-11881 | Fluent Forms < 6.2.6 - Contributor+ Stored XSS via Date/Time Field | Fluent Forms | 6.1 (v3.1) | Medium |
| CVE-2026-13330 | Animation Addons for Elementor < 2.7.0 - Author+ Stored XSS via SVG Upload | Animation Addons for Elementor | 6.1 (v3.1) | Medium |
| CVE-2026-13400 | Simply Schedule Appointments < 1.6.12.4 - Unauthenticated Stored XSS via Booking Customer Information | Simply Schedule Appointments | 6.1 (v3.1) | Medium |
| CVE-2026-26028 | CryptPad: Sanitizer Bypass in Diffmarked.js Allows Arbitrary HTML Injection and Potential XSS | cryptpad | 6.1 (v3.1) | Medium |
| CVE-2026-3001 | Gutenverse Plugin <= 3.4.6 - Cross-Site Scripting | gutenverse | 6.1 (v3.1) | Medium |
| CVE-2026-30251 | zenshare suite Cross-Site Scripting Vulnerability | zenshare suite | 6.1 (v3.1) | Medium |
| CVE-2026-30252 | zencrm Cross-Site Scripting Vulnerability | zencrm | 6.1 (v3.1) | Medium |
| CVE-2026-34206 | Captcha Protect: Reflected XSS in challenge page via unsanitized destination rendered with text/template | captcha protect | 6.1 (v3.1) | Medium |
| CVE-2026-34229 | Emlog: Stored XSS in Comment Module via URI Scheme Validation Bypass | emlog | 6.1 (v3.1) | Medium |
| CVE-2026-34396 | AVideo: Stored XSS via Unescaped Plugin Configuration Values in Admin Panel | avideo | 6.1 (v3.1) | Medium |
| CVE-2026-34739 | AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php | avideo | 6.1 (v3.1) | Medium |
| CVE-2026-36324 | SourceCodester Doctor Appointment System 1.0 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium |
| CVE-2026-37750 | School Management System by mahmoudai1 Cross-Site Scripting Vulnerability | School Management System by mahmoudai1 | 6.1 (v3.1) | Medium |
| CVE-2026-38432 | erpnext Cross-Site Scripting Vulnerability | erpnext | 6.1 (v3.1) | Medium |
| CVE-2026-38446 | Cross-Site Scripting | - | 6.1 (v3.1) | Medium |
| CVE-2026-38472 | forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 Cross-Site Scripting Vulnerability | forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 | 6.1 (v3.1) | Medium |
| CVE-2026-38947 | FluentCMS 1.2.3 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium |
| CVE-2026-41580 | Stirling-PDF: Reflected XSS through crafted PDF metadata fields (Title and Author) | stirling pdf | 6.1 (v3.1) | Medium |
| CVE-2026-50229 | Apache Tomcat - Cross-Site Scripting | tomcat | 6.1 (v3.1) | Medium |
| CVE-2026-51565 | Modules/Docs/DocsController.php in Milk admin <=0.9.8 Cross-Site Scripting Vulnerability | Modules/Docs/DocsController.php in Milk admin <=0.9.8 | 6.1 (v3.1) | Medium |
| CVE-2026-52232 | FS Inc S3150-8T2F Switch 2.2.0D Build 118101 Cross-Site Scripting Vulnerability | FS Inc S3150-8T2F Switch 2.2.0D Build 118101 | 6.1 (v3.1) | Medium |
| CVE-2026-52475 | aiflowy <= 2.1.2 Cross-Site Scripting Vulnerability | aiflowy <= 2.1.2 | 6.1 (v3.1) | Medium |
| CVE-2026-52774 | YesWiki Bazar Widget - Reflected XSS via 'id' Parameter | yeswiki | 6.1 (v3.1) | Medium |
| CVE-2026-55087 | Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (ope | etherpad | 6.1 (v3.1) | Medium |
| CVE-2026-61526 | AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler | http-server | 6.1 (v3.1) | Medium |
| CVE-2026-73084 | Activepieces: Reflected Cross-Site Scripting in OAuth Redirect Endpoint | activepieces | 6.1 (v3.1) | Medium |
| CVE-2026-75170 | the HubCore platform (version 14.1.1) Cross-Site Scripting Vulnerability | the HubCore platform (version 14.1.1) | 6.1 (v3.1) | Medium |
| CVE-2026-75307 | zhitan-ems 1.0.0 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium |
| CVE-2026-78742 | Silverpeas Core <=6.4.6 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium |
| CVE-2026-8447 | Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untruste | langflow | 6.1 (v3.1) | Medium |
| CVE-2023-6717 | Keycloak: xss via assertion consumer service url in saml post-binding flow | Red Hat AMQ Broker 7 | 6.0 (v3.1) | Medium |
| CVE-2026-8245 | Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection | concrete cms | 6.0 (v4.0) | Medium |
| CVE-2026-63428 | HeyForm: completeSubmission persists submitter-supplied hidden fields verbatim without validating against the form's dec | heyform | 5.8 (v3.1) | Medium |
| CVE-2026-84193 | LibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP | librenms | 5.8 (v4.0) | Medium |
| CVE-2026-5827 | code-projects Simple IT Discussion Forum question-function.php sql injection | Simple IT Discussion Forum | 5.5 (v4.0) | Medium |
| CVE-2026-88055 | AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in MetaGenerator | anything-llm | 5.5 (v3.1) | Medium |
| CVE-2016-10993 | ScoreMe Theme - Cross-Site Scripting | scoreme | 5.4 (v3.1) | Medium |
| CVE-2016-9316 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities | interscan web security virtual appliance | 5.4 (v3.0) | Medium |
| CVE-2017-3131 | Fortinet FortiOS < 5.6.0 - Cross-Site Scripting | fortios | 5.4 (v3.0) | Medium |
| CVE-2017-6340 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities | interscan web security virtual appliance | 5.4 (v3.0) | Medium |
| CVE-2018-15917 | Jorani Leave Management System 0.6.5 - Cross-Site Scripting | jorani | 5.4 (v3.0) | Medium |
| CVE-2018-16736 | Roundcube rcfilters plugin 2.1.6 - Cross-Site Scripting | rcfilters | 5.4 (v3.0) | Medium |
| CVE-2018-6226 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 5.4 (v3.0) | Medium |
| CVE-2018-6227 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 5.4 (v3.0) | Medium |
| CVE-2018-8024 | Apache Spark UI - Cross-Site Scripting | spark | 5.4 (v3.0) | Medium |
| CVE-2019-11370 | Carel pCOWeb <B1.2.4 - Cross-Site Scripting | pcoweb card firmware | 5.4 (v3.0) | Medium |
| CVE-2019-9556 | Fiberhome AN5506-04-F RP2669 - Persistent Cross-Site Scripting | an5506-04-f firmware | 5.4 (v3.1) | Medium |
| CVE-2020-11456 | LimeSurvey 4.1.11 - 'Survey Groups' Persistent Cross-Site Scripting | limesurvey | 5.4 (v3.1) | Medium |
| CVE-2020-11457 | pfSense 2.4.4-P3 - 'User Manager' Persistent Cross-Site Scripting | pfsense | 5.4 (v3.1) | Medium |
| CVE-2020-12256 | rConfig 3.9.4 - Cross-Site Scripting | rconfig | 5.4 (v3.1) | Medium |
| CVE-2020-12259 | rConfig 3.9.4 - Cross-Site Scripting | rconfig | 5.4 (v3.1) | Medium |
| CVE-2020-12262 | Intelbras TIP200/TIP200LITE/TIP300 - Cross-Site Scripting | tip300 | 5.4 (v3.1) | Medium |
| CVE-2020-20285 | ZZcms - Cross-Site Scripting | zzcms | 5.4 (v3.1) | Medium |
| CVE-2020-20988 | DomainMOD 4.13.0 - Cross-Site Scripting | domainmod | 5.4 (v3.1) | Medium |
| CVE-2020-27533 | DedeCMS v.5.8 - keyword Cross-Site Scripting | dedecms | 5.4 (v3.1) | Medium |
| CVE-2020-35774 | twitter-server Cross-Site Scripting | twitter-server | 5.4 (v3.1) | Medium |
| CVE-2020-9467 | Piwigo 2.10.1 - Cross Site Scripting | piwigo | 5.4 (v3.1) | Medium |
| CVE-2021-31250 | CHIYU TCP/IP Converter - Cross-Site Scripting | bf-430 firmware | 5.4 (v3.1) | Medium |
| CVE-2021-35956 | AKCP sensorProbe SPX476 - 'Multiple' Cross-Site Scripting (XSS) | sensorprobe2 firmware | 5.4 (v3.1) | Medium |
| CVE-2021-40577 | Online Enrollment Management System in PHP and PayPal 1.0 - 'U_NAME' Stored Cross-Site Scripting | online enrollment management system | 5.4 (v3.1) | Medium |
| CVE-2021-46005 | Sourcecodester Car Rental Management System 1.0 - Stored Cross-Site Scripting | car rental management system | 5.4 (v3.1) | Medium |
| CVE-2022-0020 | Palo Alto Cortex XSOAR 6.5.0 - Stored Cross-Site Scripting (XSS) | cortex xsoar | 5.4 (v3.1) | Medium |
| CVE-2022-0378 | Microweber Cross-Site Scripting | microweber | 5.4 (v3.1) | Medium |
| CVE-2022-0928 | Microweber < 1.2.12 - Stored Cross-Site Scripting | microweber | 5.4 (v3.1) | Medium |
| CVE-2022-0954 | Microweber <1.2.11 - Stored Cross-Site Scripting | microweber | 5.4 (v3.1) | Medium |
| CVE-2022-25489 | Atom CMS v2.0 - Cross-Site Scripting | atomcms | 5.4 (v3.1) | Medium |
| CVE-2022-48178 | X2CRM v6.6/6.9 - Stored Cross-Site Scripting (XSS) (Authenticated) | x2crm | 5.4 (v3.1) | Medium |
| CVE-2023-26842 | ChurchCRM 4.5.3 - Cross-Site Scripting | churchcrm | 5.4 (v3.1) | Medium |
| CVE-2023-31548 | ChurchCRM v4.5.3 - Cross-Site Scripting | churchcrm | 5.4 (v3.1) | Medium |
| CVE-2023-34537 | Hoteldruid 3.0.5 - Cross-Site Scripting | hoteldruid | 5.4 (v3.1) | Medium |
| CVE-2023-38911 | CSZ CMS 1.3.0 - Stored Cross-Site Scripting (Plugin 'Gallery') | csz cms | 5.4 (v3.1) | Medium |
| CVE-2023-5452 | SnipeIT 6.2.1 - Stored Cross Site Scripting | snipe-it | 5.4 (v3.1) | Medium |
| CVE-2024-33724 | SOPlanning 1.52.00 Cross Site Scripting | soplanning | 5.4 (v3.1) | Medium |
| CVE-2024-48120 | X2CRM 8.5 - Stored Cross-Site Scripting (XSS) | x2crm | 5.4 (v3.1) | Medium |
| CVE-2024-52762 | Ganglia Web Interface (v3.7.3 - v3.7.6) - Cross-Site Scripting | ganglia-web | 5.4 (v3.1) | Medium |
| CVE-2024-52763 | Ganglia Web Interface (v3.7.3 - v3.7.5) - Cross-Site Scripting | ganglia-web | 5.4 (v3.1) | Medium |
| CVE-2025-2610 | MagnusBilling Alarm Module - Cross-Site Scripting | magnusbilling | 5.4 (v3.1) | Medium |
| CVE-2026-11569 | Quay: quay: stored xss via filedrop svg upload | Red Hat Quay 3 | 5.4 (v3.1) | Medium |
| CVE-2026-14864 | JetEngine < 3.8.12 - Contributor+ Stored XSS via jet_engine Shortcode | JetEngine | 5.4 (v3.1) | Medium |
| CVE-2026-15245 | BNE Testimonials < 2.0.8.2 - Contributor+ Stored XSS via Slider Shortcode | BNE Testimonials | 5.4 (v3.1) | Medium |
| CVE-2026-16063 | Event Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event Timeline Content | Event Booking Manager for WooCommerce | 5.4 (v3.1) | Medium |
| CVE-2026-16537 | Slick Slider < 0.5.3 - Contributor+ Stored XSS via Gallery Shortcode | Slick Slider | 5.4 (v3.1) | Medium |
| CVE-2026-16558 | YMC Filter < 3.12.8 - Contributor+ Stored XSS via Layout Builder Schema | YMC Filter | 5.4 (v3.1) | Medium |
| CVE-2026-18395 | Child Pages Card < 1.09 - Contributor+ Stored XSS via Shortcode Attributes | Child Pages Card | 5.4 (v3.1) | Medium |
| CVE-2026-34848 | hoppscotch: Stored XSS in team member overflow tooltip via display name | hoppscotch | 5.4 (v3.1) | Medium |
| CVE-2026-34974 | phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding leads to Stored XSS and Privilege Escalation | phpmyfaq | 5.4 (v3.1) | Medium |
| CVE-2026-35403 | LORIS has potential cross-site scripting in survey_accounts module | loris | 5.4 (v3.1) | Medium |
| CVE-2026-36392 | FairSketch Rise CRM Version 3.9.6 Cross-Site Scripting Vulnerability | - | 5.4 (v3.1) | Medium |
| CVE-2026-38473 | the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 Cross-Site Scripting Vulnerability | the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 | 5.4 (v3.1) | Medium |
| CVE-2026-39380 | Open Source Point of Sale has Stored XSS in Stock Location (Configuration) | open source point of sale | 5.4 (v3.1) | Medium |
| CVE-2026-39964 | TypeBot: Stored XSS via javascript: URI in text bubble links — bot author executes JS on visitors' browsers | typebot.io | 5.4 (v3.1) | Medium |
| CVE-2026-45138 | CI4MS: Stored XSS in Blog Content via Broken html_purify Validation Rule | ci4ms | 5.4 (v3.1) | Medium |
| CVE-2026-45580 | WWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute | avideo | 5.4 (v3.1) | Medium |
| CVE-2026-45694 | LibreNMS: Reflected XSS in the Proxmox app view via unsanitized instance/vmid parameters | librenms | 5.4 (v3.1) | Medium |
| CVE-2026-72570 | cube-root directory-serve - Stored Cross-Site Scripting via Malicious Filename | directory-serve | 5.4 (v3.1) | Medium |
| CVE-2026-72583 | fastschema - Stored Cross-Site Scripting via MIME Type Bypass in File Upload | fastschema | 5.4 (v3.1) | Medium |
| CVE-2026-82396 | Sulu: Stored XSS via media download inline-disposition override | sulu | 5.4 (v3.1) | Medium |
| CVE-2026-9278 | Form Builder CP < 1.2.47 - Editor+ Stored XSS via form_structure | Form Builder CP | 5.4 (v3.1) | Medium |
| CVE-2019-17503 | Kirona-DRS 5.5.3.5 - Information Disclosure | dynamic resource scheduling | 5.3 (v3.1) | Medium |
| CVE-2019-25731 | Zuz Music 2.1 Persistent Cross-site Scripting via zuzconsole Contact | Zuz Music | 5.3 (v4.0) | Medium |
| CVE-2023-30943 | Moodle - Cross-Site Scripting/Remote Code Execution | moodle | 5.3 (v3.1) | Medium |
| CVE-2024-11587 | idcCMS V1.60 - Cross-Site Scripting | idccms | 5.3 (v4.0) | Medium |
| CVE-2024-9007 | 123Solar 1.8.4.5 - Cross-Site Scripting | 123solar | 5.3 (v4.0) | Medium |
| CVE-2025-2127 | JoomlaUX JUX Real Estate 3.4.0 - Reflected XSS | jux real estate | 5.3 (v4.0) | Medium |
| CVE-2025-2709 | Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting | ufida erp-nc | 5.3 (v4.0) | Medium |
| CVE-2025-2710 | Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting | ufida erp-nc | 5.3 (v4.0) | Medium |
| CVE-2025-2711 | Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting | ufida erp-nc | 5.3 (v4.0) | Medium |
| CVE-2025-2712 | Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting | ufida erp-nc | 5.3 (v4.0) | Medium |
| CVE-2026-35208 | lichess.org has an Unsanitized Stream Title Injection on /streamer | lila | 5.3 (v4.0) | Medium |
| CVE-2026-41472 | CyberPanel < 2.4.5 Stored XSS via AI Scanner Dashboard | cyberpanel | 5.3 (v4.0) | Medium |
| CVE-2026-48094 | ShareOpenly has Cross-Site Scripting (XSS) via Missing esc_url() on Shared URL in Content Output | shareopenly | 5.3 (v4.0) | Medium |
| CVE-2026-5808 | openstatusHQ openstatus Onboarding Endpoint client.tsx cross site scripting | openstatus | 5.3 (v4.0) | Medium |
| CVE-2026-59232 | Stored Cross-site Scripting in Prospero Flow CRM lead name field | Prospero Flow CRM | 5.3 (v4.0) | Medium |
| CVE-2026-69116 | FlyEnv < 4.18.0 Cross-Site Scripting via v-html | FlyEnv | 5.3 (v4.0) | Medium |
| CVE-2026-73038 | NodeBB < 4.15.0 Stored XSS via ActivityPub emoji tag.icon.url and tag.name | NodeBB | 5.3 (v4.0) | Medium |
| CVE-2026-73422 | Astro: Reflected XSS via unescaped View Transition animation properties | astro | 5.3 (v4.0) | Medium |
| CVE-2026-73628 | Serendipity 2.3.5 Reflected XSS via search clean-URL route | Serendipity | 5.3 (v4.0) | Medium |
| CVE-2026-76837 | Baserow before 2.3.0 Stored Cross-Site Scripting via Rich Text Mention Display Name | Baserow | 5.3 (v4.0) | Medium |
| CVE-2026-82451 | Formwork through 2.3.14 Stored XSS via Referer Header | Formwork | 5.3 (v4.0) | Medium |
| CVE-2026-82646 | WWBN AVideo Unauthenticated Reflected XSS via url2Embed.json.php | AVideo | 5.3 (v4.0) | Medium |
| CVE-2026-84191 | LibreNMS before 26.5.0 Stored XSS via SNMP VRF fields | librenms | 5.3 (v4.0) | Medium |
| CVE-2026-85158 | AVideo Reflected XSS via videoEmbeded.php link parameter | AVideo | 5.3 (v4.0) | Medium |
| CVE-2026-85159 | AVideo Reflected XSS via cancelUri in userLogin.php | AVideo | 5.3 (v4.0) | Medium |
| CVE-2026-85577 | AVideo userLogin.php Reflected XSS via error parameter | AVideo | 5.3 (v4.0) | Medium |
| CVE-2026-89240 | WWBN AVideo Reflected XSS via confirmLivePassword.php | AVideo | 5.3 (v4.0) | Medium |
| CVE-2026-89241 | WWBN AVideo Reflected XSS via confirmLivePassword.php | AVideo | 5.3 (v4.0) | Medium |
| CVE-2026-89244 | WWBN AVideo Reflected XSS via Gallery Category getBackURL | AVideo | 5.3 (v4.0) | Medium |
| CVE-2018-25248 | MyBB Downloads Plugin 2.0.3 Persistent XSS via downloads.php | mybb downloads | 5.1 (v4.0) | Medium |
| CVE-2018-25349 | userSpice 4.3.24 Cross-Site Scripting via X-Forwarded-For Header | userSpice | 5.1 (v4.0) | Medium |
| CVE-2021-47931 | Exponent CMS 2.6 Multiple Vulnerabilities Stored XSS Authentication | Exponent CMS | 5.1 (v4.0) | Medium |
| CVE-2021-47947 | Projectsend r1295 Stored Cross-Site Scripting via files-edit.php | Projectsend | 5.1 (v4.0) | Medium |
| CVE-2022-50943 | Moodle LMS 4.0 Cross-Site Scripting via course search.php | moodle | 5.1 (v4.0) | Medium |
| CVE-2022-50948 | Motopress Hotel Booking Lite 4.2.4 Stored Cross-Site Scripting | Motopress Hotel Booking Lite | 5.1 (v4.0) | Medium |
| CVE-2022-50958 | WordPress Plugin Jetpack 9.1 Cross Site Scripting via grunion-form-view.php | Jetpack | 5.1 (v4.0) | Medium |
| CVE-2022-50959 | WordPress Contact Form Builder 1.6.1 Cross-Site Scripting via code_generator.php | Contact Form Builder | 5.1 (v4.0) | Medium |
| CVE-2022-50962 | uBidAuction 2.0.1 myOrders Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium |
| CVE-2022-50963 | uBidAuction 2.0.1 myAuctions active Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium |
| CVE-2022-50964 | uBidAuction 2.0.1 myAuctions loose Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium |
| CVE-2022-50965 | uBidAuction 2.0.1 posts manage Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium |
| CVE-2022-50966 | uBidAuction 2.0.1 news manage Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium |
| CVE-2022-50968 | uBidAuction 2.0.1 auctions manage Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium |
| CVE-2022-50969 | uBidAuction 2.0.1 mailingLog manage Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium |
| CVE-2025-34032 | Moodle LMS Jmol Plugin <= 6.1 - Cross-Site Scripting | jmol | 5.1 (v4.0) | Medium |
| CVE-2025-34141 | ETQ Reliance - Reflected XSS via SQLConverterServlet | reliance | 5.1 (v4.0) | Medium |
| CVE-2025-41393 | Ricoh Web Image Monitor - Reflected XSS | Multiple laser printers and MFPs which implement Web Image Monitor | 5.1 (v4.0) | Medium |
| CVE-2025-71404 | better-auth before 1.1.16 Reflected XSS via error parameter | better-auth | 5.1 (v4.0) | Medium |
| CVE-2026-19434 | Stored Cross-site Scripting in Pentestify finding severity field | Pentestify | 5.1 (v4.0) | Medium |
| CVE-2026-19716 | Stored Cross-site Scripting in Pentestify user account deletion via unescaped username | Pentestify | 5.1 (v4.0) | Medium |
| CVE-2026-22675 | OCS Inventory NG Server Stored XSS via User-Agent | ocs inventory server | 5.1 (v4.0) | Medium |
| CVE-2026-25557 | Evoluted PHP Directory Listing Script 4.0.5 Reflected XSS via dir parameter | PHP Directory Listing Script | 5.1 (v4.0) | Medium |
| CVE-2026-27176 | MajorDoMo - Cross-Site Scripting | majordomo | 5.1 (v4.0) | Medium |
| CVE-2026-32856 | Ellucian Banner Self-Service Reflected XSS via dateConverter | Banner Self-Service | 5.1 (v4.0) | Medium |
| CVE-2026-34416 | OSCAL-GUI Reflected XSS via project parameter in oscal.php | OSCAL-GUI | 5.1 (v4.0) | Medium |
| CVE-2026-34417 | OSCAL-GUI Reflected XSS via project parameter in oscal-forms.php | OSCAL-GUI | 5.1 (v4.0) | Medium |
| CVE-2026-34798 | Endian Firewall /cgi-bin/routing.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34799 | Endian Firewall /manage/dnsmasq/hosts/ remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34800 | Endian Firewall /cgi-bin/uplinkeditor.cgi NAME Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34801 | Endian Firewall /manage/dhcp/fixed_leases/ remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34802 | Endian Firewall /cgi-bin/salearn.cgi remark user ham spam Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34803 | Endian Firewall /manage/qos/classes/ name Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34804 | Endian Firewall /manage/qos/rules/ dscp Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34805 | Endian Firewall /cgi-bin/dnat.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34806 | Endian Firewall /cgi-bin/snat.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34807 | Endian Firewall /cgi-bin/incoming.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34808 | Endian Firewall /cgi-bin/outgoingfw.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34809 | Endian Firewall /cgi-bin/zonefw.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34810 | Endian Firewall /cgi-bin/vpnfw.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34811 | Endian Firewall /cgi-bin/xtaccess.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34812 | Endian Firewall /cgi-bin/proxypolicy.cgi mimetypes Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34813 | Endian Firewall /cgi-bin/proxyuser.cgi user Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34814 | Endian Firewall /cgi-bin/proxygroup.cgi group Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34815 | Endian Firewall /cgi-bin/smtpdomains.cgi DOMAIN Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34816 | Endian Firewall /manage/smtpscan/domainrouting/ domain Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34817 | Endian Firewall /cgi-bin/smtprouting.cgi ADDRESS BCC Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34818 | Endian Firewall /manage/dnsmasq/localdomains/ remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34819 | Endian Firewall /cgi-bin/openvpnclient.cgi REMARK Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34820 | Endian Firewall /manage/ipsec/ remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34821 | Endian Firewall /manage/vpnauthentication/user/ remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34822 | Endian Firewall /manage/ca/certificate/ new_cert_name Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34823 | Endian Firewall /manage/password/web/ remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-35007 | Open ISES Tickets < 3.44.2 Reflected XSS via single_unit.php id Parameter | tickets | 5.1 (v4.0) | Medium |
| CVE-2026-35008 | Open ISES Tickets < 3.44.2 Reflected XSS via single.php ticket_id Parameter | tickets | 5.1 (v4.0) | Medium |
| CVE-2026-35009 | Open ISES Tickets < 3.44.2 Reflected XSS via add_note.php ticket_id Parameter | tickets | 5.1 (v4.0) | Medium |
| CVE-2026-35010 | Open ISES Tickets < 3.44.2 Reflected XSS via patient_JF.php ticket_id Parameter | tickets | 5.1 (v4.0) | Medium |
| CVE-2026-35011 | Open ISES Tickets < 3.44.2 Reflected XSS via opena.php frm_call Parameter | tickets | 5.1 (v4.0) | Medium |
| CVE-2026-35012 | Open ISES Tickets < 3.44.2 Reflected XSS via add_facnote.php ticket_id Parameter | tickets | 5.1 (v4.0) | Medium |
| CVE-2026-35014 | Open ISES Tickets < 3.44.2 Reflected XSS via routes_nm.php ticket_id Parameter | tickets | 5.1 (v4.0) | Medium |
| CVE-2026-35015 | Open ISES Tickets < 3.44.2 Reflected XSS via do_unit_mail.php the_ticket Parameter | tickets | 5.1 (v4.0) | Medium |
| CVE-2026-35016 | Open ISES Tickets < 3.44.2 Reflected XSS via search.php frm_query Parameter | tickets | 5.1 (v4.0) | Medium |
| CVE-2026-40507 | OpenEMR < 8.3.0 Reflected XSS via templateHtml Parameter in Patient Portal | openemr | 5.1 (v4.0) | Medium |
| CVE-2026-40508 | OpenEMR < 8.3.0 Stored XSS via Patient Portal Template Import Handler | openemr | 5.1 (v4.0) | Medium |
| CVE-2026-42840 | ERPNext 16.16.0 - Stored XSS in POS customer section via unescaped template literals | ERPNext | 5.1 (v4.0) | Medium |
| CVE-2026-45551 | Group-Office: Authenticated Stored XSS in Administrator Context via Arbitrary Cross-User Setting Write | groupoffice | 5.1 (v4.0) | Medium |
| CVE-2026-47106 | Ellucian Banner Self-Service Stored XSS via getFacultyMeetingTimes API | Banner Self-Service | 5.1 (v4.0) | Medium |
| CVE-2026-48214 | Open ISES Tickets < 3.44.2 Reflected XSS via add_nm.php ticket_id Parameter | Tickets | 5.1 (v4.0) | Medium |
| CVE-2026-48215 | Open ISES Tickets < 3.44.2 Reflected XSS via circle.php frm_id Parameter | Tickets | 5.1 (v4.0) | Medium |
| CVE-2026-48218 | Open ISES Tickets < 3.44.2 Reflected XSS via icons/buttons/landb.php frm_name and frm_id Parameters | Tickets | 5.1 (v4.0) | Medium |
| CVE-2026-48219 | Open ISES Tickets < 3.44.2 Reflected XSS via ics202.php frm_add_str Parameter | Tickets | 5.1 (v4.0) | Medium |
| CVE-2026-48220 | Open ISES Tickets < 3.44.2 Reflected XSS via ics205.php frm_add_str Parameter | Tickets | 5.1 (v4.0) | Medium |
| CVE-2026-48221 | Open ISES Tickets < 3.44.2 Reflected XSS via ics205a.php frm_add_str Parameter | Tickets | 5.1 (v4.0) | Medium |
| CVE-2026-48222 | Open ISES Tickets < 3.44.2 Reflected XSS via ics213.php frm_add_str Parameter | Tickets | 5.1 (v4.0) | Medium |
| CVE-2026-48223 | Open ISES Tickets < 3.44.2 Reflected XSS via ics213rr.php frm_add_str Parameter | Tickets | 5.1 (v4.0) | Medium |
| CVE-2026-48224 | Open ISES Tickets < 3.44.2 Reflected XSS via ics214.php frm_add_str Parameter | Tickets | 5.1 (v4.0) | Medium |
| CVE-2026-48225 | Open ISES Tickets < 3.44.2 Reflected XSS via landb.php _type Parameter | Tickets | 5.1 (v4.0) | Medium |
| CVE-2026-48226 | Open ISES Tickets < 3.44.2 Reflected XSS via os_watch.php ref and mode_orig Parameters | Tickets | 5.1 (v4.0) | Medium |
| CVE-2026-48227 | Open ISES Tickets < 3.44.2 Reflected XSS via patient.php id and ticket_id Parameters | Tickets | 5.1 (v4.0) | Medium |
| CVE-2026-48228 | Open ISES Tickets < 3.44.2 Reflected XSS via patient_w.php id and ticket_id Parameters | Tickets | 5.1 (v4.0) | Medium |
| CVE-2026-48229 | Open ISES Tickets < 3.44.2 Reflected XSS via routes_i.php ticket_id Parameter | Tickets | 5.1 (v4.0) | Medium |
| CVE-2026-48530 | GFI Archiver < 15.13 Stored XSS via CategorizationPolicyWizard.aspx | GFI Archiver | 5.1 (v4.0) | Medium |
| CVE-2026-48531 | GFI Archiver < 15.13 Stored XSS via RetentionPolicyWizard.aspx | GFI Archiver | 5.1 (v4.0) | Medium |
| CVE-2026-48532 | GFI Archiver < 15.13 Stored XSS via FAARetentionPolicyWizard.aspx | GFI Archiver | 5.1 (v4.0) | Medium |
| CVE-2026-48534 | GFI Archiver < 15.13 Stored XSS via ImapServerWizard.aspx | GFI Archiver | 5.1 (v4.0) | Medium |
| CVE-2026-48535 | GFI Archiver < 15.13 Stored XSS via CallHomeSettingsWizard.aspx | GFI Archiver | 5.1 (v4.0) | Medium |
| CVE-2026-48536 | GFI Archiver < 15.13 Stored XSS via GeneralSettingsWizard.aspx | GFI Archiver | 5.1 (v4.0) | Medium |
| CVE-2026-48537 | GFI Archiver < 15.13 Stored XSS via FileArchiveAssistantWizard.aspx | GFI Archiver | 5.1 (v4.0) | Medium |
| CVE-2026-48538 | GFI Archiver < 15.13 Stored XSS via ImportSettingsWizard.ashx | GFI Archiver | 5.1 (v4.0) | Medium |
| CVE-2026-48539 | GFI Archiver < 15.13 Stored XSS via MailInsights.aspx | GFI Archiver | 5.1 (v4.0) | Medium |
| CVE-2026-48552 | Nagios Core / XI DOM-based XSS via jsonquery.js | Nagios Core | 5.1 (v4.0) | Medium |
| CVE-2026-48559 | Lightweight Music Server 3.76.0 Stored XSS via Media File Metadata Tags | lms | 5.1 (v4.0) | Medium |
| CVE-2026-50230 | Lyrion Music Server <= 9.2.0 - Cross-Site Scripting | Lyrion Music Server | 5.1 (v4.0) | Medium |
| CVE-2026-53992 | Reflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date Parameters | ProjectSend | 5.1 (v4.0) | Medium |
| CVE-2026-56126 | pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php | pfSense Plus | 5.1 (v4.0) | Medium |
| CVE-2026-56127 | pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php | pfSense Plus | 5.1 (v4.0) | Medium |
| CVE-2026-56128 | pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php | pfSense Plus | 5.1 (v4.0) | Medium |
| CVE-2026-64628 | Grav Stored Cross-Site Scripting via Shortcode Attribute Handlers | grav | 5.1 (v4.0) | Medium |
| CVE-2026-65697 | Fathom Lite 1.3.1 Stored XSS via /collect Endpoint | fathom | 5.1 (v4.0) | Medium |
| CVE-2026-66296 | Reflected XSS in oaskit's default HTML error handler | oaskit | 5.1 (v4.0) | Medium |
| CVE-2026-67333 | better-auth before 1.6.13 Stored XSS via javascript redirect_uri | better-auth | 5.1 (v4.0) | Medium |
| CVE-2026-68583 | luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name | luci | 5.1 (v4.0) | Medium |
| CVE-2026-71503 | Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template | dolibarr | 5.1 (v4.0) | Medium |
| CVE-2026-72743 | SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html | SQLBot | 5.1 (v4.0) | Medium |
| CVE-2026-72747 | AVideo Stored Cross-Site Scripting via Unauthenticated Registration | AVideo | 5.1 (v4.0) | Medium |
| CVE-2026-72821 | Grav Form Plugin before 9.1.15 Stored XSS via Radio Toggle | grav | 5.1 (v4.0) | Medium |
| CVE-2026-73319 | XenForo < 2.3.13 XSS via Dynamic Redirect Handler | xenforo | 5.1 (v4.0) | Medium |
| CVE-2026-75831 | Grav before 2.0.15 Stored XSS via audio/video source URL | grav | 5.1 (v4.0) | Medium |
| CVE-2026-84477 | AVideo Stored XSS via Live Schedule Title Description | AVideo | 5.1 (v4.0) | Medium |
| CVE-2026-85593 | phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode | phpMyFAQ | 5.1 (v4.0) | Medium |
| CVE-2026-85600 | Grav Admin before 2.0.21 Stored XSS via username | grav-plugin-admin2 | 5.1 (v4.0) | Medium |
| CVE-2026-86197 | Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox | grav | 5.1 (v4.0) | Medium |
| CVE-2012-5192 | Bitweaver 2.8.1 - Multiple Vulnerabilities | bitweaver | 5.0 (v2.0) | Medium |
| CVE-2013-6043 | Webuzo 2.1.3 - Multiple Vulnerabilities | webuzo | 5.0 (v2.0) | Medium |
| CVE-2015-4666 | Xceedium Xsuite - Multiple Vulnerabilities | xsuite | 5.0 (v2.0) | Medium |
| CVE-2017-14651 | WSO2 Data Analytics Server 3.1.0 - Cross-Site Scripting | api manager | 4.8 (v3.1) | Medium |
| CVE-2018-1000856 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium |
| CVE-2018-1186 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon | 4.8 (v3.0) | Medium |
| CVE-2018-1187 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon | 4.8 (v3.0) | Medium |
| CVE-2018-1188 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon | 4.8 (v3.0) | Medium |
| CVE-2018-1189 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon | 4.8 (v3.0) | Medium |
| CVE-2018-1201 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon | 4.8 (v3.0) | Medium |
| CVE-2018-1202 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon | 4.8 (v3.0) | Medium |
| CVE-2018-19749 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium |
| CVE-2018-19751 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium |
| CVE-2018-19752 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium |
| CVE-2018-19892 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium |
| CVE-2018-19914 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium |
| CVE-2018-19915 | DomainMOD <=4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium |
| CVE-2018-20009 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium |
| CVE-2018-20010 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium |
| CVE-2018-20011 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium |
| CVE-2018-20418 | Craft CMS 3.0.25 - Cross-Site Scripting | craft cms | 4.8 (v3.0) | Medium |
| CVE-2019-19742 | D-Link DIR-615 Wireless Router - Persistent Cross-Site Scripting | dir-615 firmware | 4.8 (v3.1) | Medium |
| CVE-2020-29240 | LEPTON CMS 4.7.0 - 'URL' Persistent Cross-Site Scripting | leptoncms | 4.8 (v3.1) | Medium |
| CVE-2020-29470 | OpenCart 3.0.3.6 - 'subject' Stored Cross-Site Scripting | opencart | 4.8 (v3.1) | Medium |
| CVE-2020-29477 | Invision Community 4.5.4 - 'Field Name' Stored Cross-Site Scripting | community | 4.8 (v3.1) | Medium |
| CVE-2021-46068 | Vehicle Service Management System - Stored Cross-Site Scripting | vehicle service management system | 4.8 (v3.1) | Medium |
| CVE-2021-46069 | Vehicle Service Management System 1.0 - Stored Cross Site Scripting | vehicle service management system | 4.8 (v3.1) | Medium |
| CVE-2021-46071 | ehicle Service Management System 1.0 - Cross-Site Scripting | vehicle service management system | 4.8 (v3.1) | Medium |
| CVE-2021-46072 | Vehicle Service Management System 1.0 - Stored Cross Site Scripting | vehicle service management system | 4.8 (v3.1) | Medium |
| CVE-2021-46073 | Vehicle Service Management System 1.0 - Cross Site Scripting | vehicle service management system | 4.8 (v3.1) | Medium |
| CVE-2023-0563 | Bank Locker Management System - Cross-Site Scripting | bank locker management system | 4.8 (v3.1) | Medium |
| CVE-2024-3822 | Base64 Encoder/Decoder <= 0.9.2 - Reflected XSS | base64 encoderdecoder | 4.8 (v3.1) | Medium |
| CVE-2024-50857 | GestioIP - Reflected Cross-Site Scripting | gestioip | 4.8 (v3.1) | Medium |
| CVE-2025-15669 | Bit Form < 3.1.4 - Admin+ Stored XSS via Conversational Form Progress Label | Bit Form | 4.8 (v3.1) | Medium |
| CVE-2025-51990 | XWiki – Stored Cross-Site Scripting (XSS) | xwiki | 4.8 (v3.1) | Medium |
| CVE-2026-26211 | Ekushey Project Manager CRM 5.0 Stored XSS via System Name Field | Ekushey Project Manager CRM | 4.8 (v4.0) | Medium |
| CVE-2026-34246 | CtrlPanel: Stored XSS in Admin Role Management via Unescaped DataTable HTML Output | panel | 4.8 (v3.1) | Medium |
| CVE-2026-39390 | CI4MS has Stored XSS via srcdoc attribute bypass in Google Maps iframe setting | ci4ms | 4.8 (v3.1) | Medium |
| CVE-2026-39392 | CI4MS has Stored XSS in Pages Content Due to Missing html_purify Sanitization | ci4ms | 4.8 (v3.1) | Medium |
| CVE-2026-65930 | LimeSurvey Community Edition 7.0.5 - Stored XSS in replacement-fields | LimeSurvey | 4.8 (v4.0) | Medium |
| CVE-2026-67612 | OpenEMR 8.2.0 Stored XSS via import_template.php Template Management | openemr | 4.8 (v4.0) | Medium |
| CVE-2026-67617 | Microweber CMS 2.0.20 Stored XSS via tag_names Parameter | microweber | 4.8 (v4.0) | Medium |
| CVE-2026-70560 | Ultimate POS Stored XSS via First Name Field in Leave Notifications | Ultimate POS (Stock Management & Point of Sale) | 4.8 (v4.0) | Medium |
| CVE-2026-79663 | Ech0 before 4.7.3 Stored XSS via RSS feed tag names | Ech0 | 4.8 (v4.0) | Medium |
| CVE-2026-79670 | Ech0 before 4.4.3 Stored XSS via SVG Upload | Ech0 | 4.8 (v4.0) | Medium |
| CVE-2026-84188 | librenms before 26.7.0 Stored XSS via graph_descr settings | librenms | 4.8 (v4.0) | Medium |
| CVE-2024-24050 | Workout Journal App 1.0 - Stored XSS | workout journal app | 4.7 (v3.1) | Medium |
| CVE-2026-3093 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab | gitlab | 4.7 (v3.1) | Medium |
| CVE-2026-53468 | Typemill has Stored HTML Attribute Injection in Metadata Fields | typemill | 4.6 (v3.1) | Medium |
| CVE-2026-75331 | tamguo 1.5.3 Cross-Site Scripting Vulnerability | - | 4.6 (v3.1) | Medium |
| CVE-2005-3128 | SquirrelMail Address Add 1.4.2 - Cross-Site Scripting | address add plugin | 4.3 (v2.0) | Medium |
| CVE-2005-4385 | Cofax <=2.0RC3 - Cross-Site Scripting | cofax | 4.3 (v2.0) | Medium |
| CVE-2008-2398 | AppServ Open Project <=2.5.10 - Cross-Site Scripting | appserv | 4.3 (v2.0) | Medium |
| CVE-2008-6465 | Parallels H-Sphere 3.0.0 P9/3.1 P1 - Cross-Site Scripting | h-sphere | 4.3 (v2.0) | Medium |
| CVE-2008-6982 | Devalcms 1.4a - Cross-Site Scripting | devalcms | 4.3 (v2.0) | Medium |
| CVE-2009-1872 | Adobe Coldfusion <=8.0.1 - Cross-Site Scripting | coldfusion | 4.3 (v2.0) | Medium |
| CVE-2011-4618 | Advanced Text Widget < 2.0.2 - Cross-Site Scripting | advanced text widget plugin | 4.3 (v2.0) | Medium |
| CVE-2011-4624 | GRAND FlAGallery 1.57 - Cross-Site Scripting | grand flagallery | 4.3 (v2.0) | Medium |
| CVE-2011-4926 | Adminimize 1.7.22 - Cross-Site Scripting | adminimize | 4.3 (v2.0) | Medium |
| CVE-2011-5106 | WordPress Plugin Flexible Custom Post Type < 0.1.7 - Cross-Site Scripting | flexible custom post type | 4.3 (v2.0) | Medium |
| CVE-2011-5107 | Alert Before Your Post <= 0.1.1 - Cross-Site Scripting | alert before you post | 4.3 (v2.0) | Medium |
| CVE-2011-5179 | Skysa App Bar 1.04 - Cross-Site Scripting | skysa app bar integration plugin | 4.3 (v2.0) | Medium |
| CVE-2011-5181 | ClickDesk Live Support Live Chat 2.0 - Cross-Site Scripting | clickdesk live support-live chat plugin | 4.3 (v2.0) | Medium |
| CVE-2011-5265 | Featurific For WordPress 1.6.2 - Cross-Site Scripting | featurific-for-wordpress | 4.3 (v2.0) | Medium |
| CVE-2012-0901 | YouSayToo auto-publishing 1.0 - Cross-Site Scripting | yousaytoo | 4.3 (v2.0) | Medium |
| CVE-2012-1835 | WordPress Plugin All-in-One Event Calendar 1.4 - Cross-Site Scripting | all-in-one event calendar | 4.3 (v2.0) | Medium |
| CVE-2012-2371 | WP-FaceThumb 0.1 - Cross-Site Scripting | wp-facethumb | 4.3 (v2.0) | Medium |
| CVE-2012-4242 | WordPress Plugin MF Gig Calendar 0.9.2 - Cross-Site Scripting | mf gig calendar | 4.3 (v2.0) | Medium |
| CVE-2012-4273 | 2 Click Socialmedia Buttons < 0.34 - Cross-Site Scripting | 2-click-social-media-buttons | 4.3 (v2.0) | Medium |
| CVE-2012-4547 | AWStats 6.95/7.0 - 'awredir.pl' Cross-Site Scripting | awstats | 4.3 (v2.0) | Medium |
| CVE-2012-4768 | WordPress Plugin Download Monitor < 3.3.5.9 - Cross-Site Scripting | download monitor | 4.3 (v2.0) | Medium |
| CVE-2012-4889 | ManageEngine Firewall Analyzer 7.2 - Cross-Site Scripting | firewall analyzer | 4.3 (v2.0) | Medium |
| CVE-2012-5684 | ZPanel 10.0.1 - Cross-Site Request Forgery / Cross-Site Scripting / SQL Injection / Password Reset | zpanel | 4.3 (v2.0) | Medium |
| CVE-2012-5913 | WordPress Integrator 1.32 - Cross-Site Scripting | wordpress integrator | 4.3 (v2.0) | Medium |
| CVE-2013-2287 | WordPress Plugin Uploader 1.0.4 - Cross-Site Scripting | uploader | 4.3 (v2.0) | Medium |
| CVE-2013-3526 | WordPress Plugin Traffic Analyzer - 'aoid' Cross-Site Scripting | trafficanalyzer | 4.3 (v2.0) | Medium |
| CVE-2013-4117 | WordPress Plugin Category Grid View Gallery 2.3.1 - Cross-Site Scripting | category-grid-view-gallery | 4.3 (v2.0) | Medium |
| CVE-2013-4625 | WordPress Plugin Duplicator < 0.4.5 - Cross-Site Scripting | duplicator | 4.3 (v2.0) | Medium |
| CVE-2013-6042 | Webuzo 2.1.3 - Multiple Vulnerabilities | webuzo | 4.3 (v2.0) | Medium |
| CVE-2013-6281 | WordPress Spreadsheet - Cross-Site Scripting | dhtmlxspreadsheet | 4.3 (v2.0) | Medium |
| CVE-2014-2908 | Siemens SIMATIC S7-1200 CPU - Cross-Site Scripting | simatic s7 cpu 1200 firmware | 4.3 (v2.0) | Medium |
| CVE-2014-3110 | Honeywell XL Web Controller - Cross-Site Scripting | falcon xlweb linux controller | 4.3 (v2.0) | Medium |
| CVE-2014-4513 | ActiveHelper LiveHelp Server 3.1.0 - Cross-Site Scripting | activehelper livehelp live chat | 4.3 (v2.0) | Medium |
| CVE-2014-9094 | WordPress DZS-VideoGallery Plugin Cross-Site Scripting | video gallery | 4.3 (v2.0) | Medium |
| CVE-2014-9444 | Frontend Uploader <= 0.9.2 - Cross-Site Scripting | frontend uploader | 4.3 (v2.0) | Medium |
| CVE-2015-1389 | Aruba ClearPass Policy Manager - Persistent Cross-Site Scripting | clearpass policy manager | 4.3 (v2.0) | Medium |
| CVE-2015-1880 | Fortinet FortiOS <=5.2.3 - Cross-Site Scripting | fortios | 4.3 (v2.0) | Medium |
| CVE-2015-2068 | Magento Server Mass Importer - Cross-Site Scripting | magmi | 4.3 (v2.0) | Medium |
| CVE-2015-2275 | WoltLab Community Gallery - Persistent Cross-Site Scripting | community gallery | 4.3 (v2.0) | Medium |
| CVE-2015-2807 | Navis DocumentCloud <0.1.1 - Cross-Site Scripting | navis documentcloud | 4.3 (v2.0) | Medium |
| CVE-2015-4127 | WordPress Church Admin <0.810 - Cross-Site Scripting | church admin | 4.3 (v2.0) | Medium |
| CVE-2015-4420 | Opsview 4.6.2 - Multiple Cross-Site Scripting Vulnerabilities | opsview | 4.3 (v2.0) | Medium |
| CVE-2015-4665 | Xceedium Xsuite - Multiple Vulnerabilities | xsuite | 4.3 (v2.0) | Medium |
| CVE-2015-6402 | Cisco EPC 3928 - Multiple Vulnerabilities | epc3928 docsis 3.0 8x4 wireless residential gateway with embedded digital voice adapter | 4.3 (v2.0) | Medium |
| CVE-2015-6920 | WordPress sourceAFRICA <=0.1.3 - Cross-Site Scripting | sourceafrica | 4.3 (v2.0) | Medium |
| CVE-2018-6225 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 4.3 (v3.0) | Medium |
| CVE-2020-7318 | McAfee ePolicy Orchestrator <5.10.9 Update 9 - Cross-Site Scripting | epolicy orchestrator | 4.3 (v3.1) | Medium |
| CVE-2021-42663 | Sourcecodester Online Event Booking and Reservation System 2.3.0 - Cross-Site Scripting | online event booking and reservation system | 4.3 (v3.1) | Medium |
| CVE-2024-34061 | Changedetection.io <=v0.45.21 - Cross-Site Scripting | changedetection.io | 4.3 (v3.1) | Medium |
| CVE-2024-4348 | osCommerce v4.0 - Cross-site Scripting | oscommerce | 4.3 (v3.1) | Medium |
| CVE-2025-41228 | VMware vSphere Client 8.0.3.0 - Reflected Cross-Site Scripting (XSS) | vCenter Server | 4.3 (v3.1) | Medium |
| CVE-2026-12724 | Kirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-password | Kirki | 4.3 (v3.1) | Medium |
| CVE-2026-32250 | NamelessMC has Reflected Cross-Site Scripting (XSS) in id parameter of /index.php?route=/queries/user/ | Nameless | 4.3 (v3.1) | Medium |
| CVE-2026-55566 | Yamcs: DOM XSS in Extension Routing | yamcs | 4.3 (v3.1) | Medium |
| CVE-2026-17011 | Nexter Blocks < 5.0.2 - Contributor+ Stored CSS Injection | Nexter Blocks | 3.8 (v3.1) | Low |
| CVE-2026-13393 | ElementsKit Lite < 3.10.01 - Subsite Administrator+ Stored XSS via Megamenu Menu-Item Settings (Multisite) | ElementsKit Elementor Addons | 3.5 (v3.1) | Low |
| CVE-2025-0133 | PAN-OS - Reflected Cross-Site Scripting | PAN-OS | 2.7 (v4.0) | Low |
| CVE-2026-66300 | SNOMED International Snowstorm reflected XSS | Snowstorm | 2.3 (v4.0) | Low |
| CVE-2026-10153 | westboy CicadasCMS AbstractCacheManager.java search cross site scripting | CicadasCMS | 2.1 (v4.0) | Low |
| CVE-2026-10173 | Orthanc Explorer 2 URL StudyList.vue cross site scripting | Explorer 2 | 2.1 (v4.0) | Low |
| CVE-2026-10289 | code-projects Hotel and Tourism Reservation System tour.php cross site scripting | Hotel and Tourism Reservation System | 2.1 (v4.0) | Low |
| CVE-2026-10301 | itsourcecode Fees Management System index.php cross site scripting | Fees Management System | 2.1 (v4.0) | Low |
| CVE-2026-10810 | itsourcecode Fees Management System navbar.php cross site scripting | Fees Management System | 2.1 (v4.0) | Low |
| CVE-2026-11436 | Mage AI Sign-in Flow index.tsx useMutation cross site scripting | Mage AI | 2.1 (v4.0) | Low |
| CVE-2026-11512 | itsourcecode Hospital Management System billing.php cross site scripting | Hospital Management System | 2.1 (v4.0) | Low |
| CVE-2026-11518 | SourceCodester Inventory System User Management users.php cross site scripting | Inventory System | 2.1 (v4.0) | Low |
| CVE-2026-16220 | code-projects Online Examination System account.php cross site scripting | Online Examination System | 2.1 (v4.0) | Low |
| CVE-2026-16229 | itsourcecode Courier Management System index.php cross site scripting | Courier Management System | 2.1 (v4.0) | Low |
| CVE-2026-16485 | SourceCodester Class and Exam Timetabling System class.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low |
| CVE-2026-16486 | SourceCodester Class and Exam Timetabling System BSIS.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low |
| CVE-2026-18968 | ttttonyhe OBlog tags.php cross site scripting | OBlog | 2.1 (v4.0) | Low |
| CVE-2026-19378 | code-projects Task Management System CommentSave.php cross site scripting | Task Management System | 2.1 (v4.0) | Low |
| CVE-2026-5825 | code-projects Simple Laundry System delmemberinfo.php cross site scripting | Simple Laundry System | 2.1 (v4.0) | Low |
| CVE-2026-5826 | code-projects Simple IT Discussion Forum edit-category.php cross site scripting | Simple IT Discussion Forum | 2.1 (v4.0) | Low |
| CVE-2026-59727 | Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands | astro | 2.1 (v4.0) | Low |
| CVE-2026-66882 | Reflected XSS in AshAuthentication confirmation and magic link interaction forms | ash authentication | 2.1 (v4.0) | Low |
| CVE-2026-75077 | SourceCodester Class and Exam Timetabling System BSCE2.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low |
| CVE-2026-75078 | SourceCodester Class and Exam Timetabling System BSHRM1.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low |
| CVE-2026-78054 | SourceCodester Class and Exam Timetabling System BSIS1.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low |
| CVE-2026-78055 | SourceCodester Class and Exam Timetabling System BSIT2.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low |
| CVE-2026-78059 | SourceCodester Stock Management System printOrder.php cross site scripting | Stock Management System | 2.1 (v4.0) | Low |
| CVE-2026-78060 | SourceCodester Stock Management System getOrderReport.php cross site scripting | Stock Management System | 2.1 (v4.0) | Low |
| CVE-2026-79793 | code-projects Online Shopping System sumit_form.php cross site scripting | Online Shopping System | 2.1 (v4.0) | Low |
| CVE-2026-82601 | SeaCMS err.php cross site scripting | SeaCMS | 2.1 (v4.0) | Low |
| CVE-2026-82625 | code-projects Simple Inventory System User Registration register.php cross site scripting | Simple Inventory System | 2.1 (v4.0) | Low |
| CVE-2026-82664 | yaojingang GEOFlow JSON-LD Theme HomeController.php cross site scripting | GEOFlow | 2.1 (v4.0) | Low |
| CVE-2026-85021 | langgenius dify Splash Layout splash.tsx router.replace cross site scripting | dify | 2.1 (v4.0) | Low |
| CVE-2026-85382 | light0011 cms Chapter Content Output oneChapter.tpl htmlspecialchars_decode cross site scripting | cms | 2.1 (v4.0) | Low |
| CVE-2026-86216 | code-projects Hotel and Tourism Reservation in PHP details.php cross site scripting | Hotel and Tourism Reservation in PHP | 2.1 (v4.0) | Low |
| CVE-2026-86244 | FastAdmin User Controller User.php login cross site scripting | FastAdmin | 2.1 (v4.0) | Low |
| CVE-2026-86278 | SourceCodester Syllabus-Aligned Learning Management & Examination System manage_subjects.php cross site scripting | Syllabus-Aligned Learning Management & Examination System | 2.1 (v4.0) | Low |
| CVE-2026-86294 | SourceCodester Simple Traffic Offense System Settings Update Endpoint save-settings.php cross site scripting | Simple Traffic Offense System | 2.1 (v4.0) | Low |
| CVE-2026-86668 | aircheng-org iWebShop-5 pic.php uploadFile cross site scripting | iWebShop-5 | 2.1 (v4.0) | Low |
| CVE-2026-87926 | Rizwan17 inventory-management-system Login Page index.php cross site scripting | inventory-management-system | 2.1 (v4.0) | Low |
| CVE-2026-9415 | code-projects Employee Management System eloginwel.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low |
| CVE-2026-9416 | code-projects Employee Management System myprofile.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low |
| CVE-2026-9417 | code-projects Employee Management System myprofileup.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low |
| CVE-2026-9418 | code-projects Employee Management System changepassemp.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low |
| CVE-2026-9419 | code-projects Employee Management System empproject.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low |
| CVE-2026-9448 | code-projects Employee Management System applyleave.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low |
| CVE-2026-9518 | hemant6488 CodeIgniter-StudentManagementSystem Students Controller view_students.php addStudent cross site scripting | CodeIgniter-StudentManagementSystem | 2.1 (v4.0) | Low |
| CVE-2026-9519 | stonith404 pingvin-share Sign-in Auto-Redirect signIn.tsx getServerSideProps cross site scripting | pingvin-share | 2.1 (v4.0) | Low |
| CVE-2026-9520 | blitz-js blitz Sign-in LoginForm.tsx cross site scripting | blitz | 2.1 (v4.0) | Low |
| CVE-2026-9527 | itsourcecode Electronic Judging System judges.php cross site scripting | Electronic Judging System | 2.1 (v4.0) | Low |
| CVE-2026-9566 | teableio teable Sign-up LoginPage.tsx cross site scripting | teable | 2.1 (v4.0) | Low |
| CVE-2026-10228 | raisulislamg4 student_management_system_by_php admission_form_check.php cross site scripting | student management system by php | 2.0 (v4.0) | Low |
| CVE-2026-10234 | Mettle sendportal Campaign webview cross site scripting | sendportal | 2.0 (v4.0) | Low |
| CVE-2026-10244 | SourceCodester Pharmacy Sales and Inventory System main create_medicine_name cross site scripting | Pharmacy Sales and Inventory System | 2.0 (v4.0) | Low |
| CVE-2026-10245 | SourceCodester Pharmacy Sales and Inventory System main create_supplier cross site scripting | Pharmacy Sales and Inventory System | 2.0 (v4.0) | Low |
| CVE-2026-10246 | SourceCodester Pharmacy Sales and Inventory System main create_medicine_presentation cross site scripting | Pharmacy Sales and Inventory System | 2.0 (v4.0) | Low |
| CVE-2026-10247 | SourceCodester Pharmacy Sales and Inventory System main create_generic_name cross site scripting | Pharmacy Sales and Inventory System | 2.0 (v4.0) | Low |
| CVE-2026-16155 | SourceCodester Class and Exam Timetabling System schoolyr.php cross site scripting | Class and Exam Timetabling System | 2.0 (v4.0) | Low |
| CVE-2026-16156 | SourceCodester Class and Exam Timetabling System forexam.php cross site scripting | Class and Exam Timetabling System | 2.0 (v4.0) | Low |
| CVE-2026-16202 | SourceCodester Class and Exam Timetabling System CYS.php cross site scripting | Class and Exam Timetabling System | 2.0 (v4.0) | Low |
| CVE-2026-16203 | SourceCodester Class and Exam Timetabling System forCYS.php cross site scripting | Class and Exam Timetabling System | 2.0 (v4.0) | Low |
| CVE-2026-19209 | SourceCodester Photo Share Website index.php home cross site scripting | Photo Share Website | 2.0 (v4.0) | Low |
| CVE-2026-19922 | code-projects Online Shopping System checkout.php cross site scripting | Online Shopping System | 2.0 (v4.0) | Low |
| CVE-2026-5806 | code-projects Easy Blog Site update.php cross site scripting | Easy Blog Site | 2.0 (v4.0) | Low |
| CVE-2026-5810 | SourceCodester Sales and Inventory System GET Parameter delete.php cross site scripting | Sales and Inventory System | 2.0 (v4.0) | Low |
| CVE-2026-7222 | code-projects Coaching Management System Complaint Form complaint.php cross site scripting | Coaching Management System | 2.0 (v4.0) | Low |
| CVE-2026-8139 | Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName | concrete cms | 2.0 (v4.0) | Low |
| CVE-2026-82483 | coppermine-gallery Coppermine Photo Gallery Hidden Album Update Endpoint db_input.php cross site scripting | Coppermine Photo Gallery | 2.0 (v4.0) | Low |
| CVE-2026-82488 | Beetel 450TC3 User Management cross site scripting | 450TC3 | 2.0 (v4.0) | Low |
| CVE-2026-82622 | code-projects Employee Leave Managing System Employee Profile Update editaction.php cross site scripting | Employee Leave Managing System | 2.0 (v4.0) | Low |
| CVE-2026-82665 | yaojingang GEOFlow Image Library Cleanup ImageLibraryController.php unlink path traversal | GEOFlow | 2.0 (v4.0) | Low |
| CVE-2026-82666 | yaojingang GEOFlow Superadmin Theme Editor SiteThemeEditorController.php preview code injection | GEOFlow | 2.0 (v4.0) | Low |
| CVE-2026-82667 | yaojingang GEOFlow GenericHttpEndpointResolver.php DistributionController.isValidHttpEndpoint server-side request forger | GEOFlow | 2.0 (v4.0) | Low |
| CVE-2026-84437 | OpenCart Autocomplete Workflow address.php cross site scripting | OpenCart | 2.0 (v4.0) | Low |
| CVE-2026-84438 | OpenCart Autocomplete Workflow edit.php cross site scripting | OpenCart | 2.0 (v4.0) | Low |
| CVE-2026-85022 | langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting | dify | 2.0 (v4.0) | Low |
| CVE-2026-85207 | itsourcecode Online Medicine Delivery System index.php cross site scripting | Online Medicine Delivery System | 2.0 (v4.0) | Low |
| CVE-2026-86181 | code-projects Task Management System User Profile Update UpdateUserProfile.php cross site scripting | Task Management System | 2.0 (v4.0) | Low |
| CVE-2026-86301 | code-projects Hospital Information System Patient Management editPatient.php cross site scripting | Hospital Information System | 2.0 (v4.0) | Low |
| CVE-2026-86644 | star7th showdoc API Page Save Endpoint editormd.js cross site scripting | showdoc | 2.0 (v4.0) | Low |
| CVE-2026-10112 | sambitraj STUDENT-MANAGEMENT-SYSTEM Dashboard cross site scripting | STUDENT-MANAGEMENT-SYSTEM | 1.9 (v4.0) | Low |
| CVE-2026-10529 | westboy CicadasCMS Task Scheduling Management ScheduleJobController.java cross site scripting | CicadasCMS | 1.9 (v4.0) | Low |
| CVE-2026-11434 | FluentCMS Blocks Plugin blocks cross site scripting | FluentCMS | 1.9 (v4.0) | Low |
| CVE-2026-11468 | SourceCodester Hospitals Patient Records Management System page room_types cross site scripting | Hospitals Patient Records Management System | 1.9 (v4.0) | Low |
| CVE-2026-16205 | Pluck CMS Albums albums.admin.php htmlspecialchars_decode cross site scripting | CMS | 1.9 (v4.0) | Low |
| CVE-2026-19110 | DataGear Chart Name HtmlTplDashboardWidgetHtmlRenderer.java HtmlTplDashboardWidgetHtmlRenderer cross site scripting | DataGear | 1.9 (v4.0) | Low |
| CVE-2026-19207 | PHPGurukul Company Visitor Management System manage-newvisitors.php cross site scripting | Company Visitor Management System | 1.9 (v4.0) | Low |
| CVE-2026-5834 | code-projects Online Shoe Store admin_running.php cross site scripting | Online Shoe Store | 1.9 (v4.0) | Low |
| CVE-2026-5835 | code-projects Online Shoe Store admin_football.php cross site scripting | Online Shoe Store | 1.9 (v4.0) | Low |
| CVE-2026-5836 | code-projects Online Shoe Store admin_product.php cross site scripting | Online Shoe Store | 1.9 (v4.0) | Low |
| CVE-2026-9564 | SourceCodester/oretnom23 Hospitals Patient Records Management System view_patient cross site scripting | Hospitals Patient Records Management System | 1.9 (v4.0) | Low |
| CVE-2026-78187 | Piwigo Public Authentication cross site scripting | Piwigo | 1.3 (v4.0) | Low |
| CVE-2026-78849 | Netgate pfSense Plus software versions <= 26.03 pfSense CE software versions <= 2.8.1 Arbitrary Code Execution Vulnerability | Netgate pfSense Plus software versions <= 26.03 pfSense CE software versions <= 2.8.1 | N/A | N/A |
Observed CWEs
These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.