On this page

Atomicorp WAF Rule 350147

Rule Summary

Rule ID: 350147
Status: Active
Alert message: Atomicorp.com WAF Rules: Potentially Untrusted Web Content Detected
Observed CWEs: CWE-20 (3), CWE-22 (3), CWE-73 (1), CWE-74 (2), CWE-78 (2), CWE-79 (565), CWE-80 (5), CWE-83 (3), CWE-87 (1), CWE-89 (7), CWE-94 (77), CWE-116 (5), CWE-119 (1), CWE-183 (1), CWE-200 (2), CWE-264 (2), CWE-287 (5), CWE-295 (2), CWE-306 (2), CWE-345 (3), CWE-352 (7), CWE-434 (7), CWE-444 (1), CWE-502 (4), CWE-601 (1), CWE-610 (1), CWE-611 (2), CWE-639 (1), CWE-693 (1), CWE-798 (1), CWE-862 (2), CWE-913 (1), CWE-915 (1), CWE-918 (1)
Revision: 168
Rule severity: Critical (2)
Phase: 2 (request body)
Request surfaces: Request argument names, Request arguments, JSON request data, SOAP request data
Rule action: deny
HTTP status: 403
Logging: log, auditlog

Description

This rules detects when potentially untrusted web content is used in a client request. For example, if javascript is included in a variable that appears to not be used for this purpose, or if web code is included in a portion of a request that is not known to be used for this purpose.

Troubleshooting

False Positives

This rule may produce a false positive if an application is used in a previously unknown or untested manner. The rules contain a large library of known trusted methods, however it is possible an application may be using a previously untested method. It is not recommended that you disable this rule if you have a false positive. If you believe this is a false positive, please report this to our security team to determine if this is a legitimate case, or if its clever attack on your system. Instructions to report false positives are detailed on the Reporting False Positives wiki page. If it is a false positive, we will fix the issue in the rules and get a release out to you promptly.

Tuning Guidance

See the Mod_security page for guidance on tuning this rule.

Additional Information

Similar Rules

WAF 350148

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

CVE	Vulnerability	Product	CVSS	Severity
CVE-2026-53753	Crawl4AI <= 0.8.6 - Remote Code Execution	crawl4ai	10.0 (v3.1)	Critical
CVE-2016-9269	Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities	interscan web security virtual appliance	9.9 (v3.0)	Critical
CVE-2012-1259	Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities	scrutinizer netflow & sflow analyzer	9.8 (v3.1)	Critical
CVE-2018-6220	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	9.8 (v3.0)	Critical
CVE-2018-6223	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	9.8 (v3.0)	Critical
CVE-2018-6228	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	9.8 (v3.0)	Critical
CVE-2018-6229	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	9.8 (v3.0)	Critical
CVE-2019-1935	Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities	integrated management controller supervisor	9.8 (v3.1)	Critical
CVE-2019-1937	Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities	integrated management controller supervisor	9.8 (v3.0)	Critical
CVE-2021-1472	Cisco Small Business RV Series - OS Command Injection	rv160 firmware	9.8 (v3.1)	Critical
CVE-2021-21307	Lucee Admin - Remote Code Execution	lucee server	9.8 (v3.1)	Critical
CVE-2021-42325	Froxlor 0.10.29.1 - SQL Injection (Authenticated)	froxlor	9.8 (v3.1)	Critical
CVE-2023-29300	Adobe ColdFusion - Pre-Auth Remote Code Execution	coldfusion	9.8 (v3.1)	Critical
CVE-2023-38203	Adobe ColdFusion - Deserialization of Untrusted Data	coldfusion	9.8 (v3.1)	Critical
CVE-2023-44353	Adobe ColdFusion WDDX Deserialization Gadgets	coldfusion	9.8 (v3.1)	Critical
CVE-2025-53770	Microsoft SharePoint Server - Remote Code Execution (ToolShell)	sharepoint server	9.8 (v3.1)	Critical
CVE-2026-67688	ICS-Park Smart Park Management System v2.0 Arbitrary Code Execution Vulnerability	ICS-Park Smart Park Management System v2.0	9.8 (v3.1)	Critical
CVE-2020-20982	shadoweb wdja v1.5.1 - Cross-Site Scripting	wdja cms	9.6 (v3.1)	Critical
CVE-2021-32853	Erxes <0.23.0 - Cross-Site Scripting	erxes	9.6 (v3.1)	Critical
CVE-2023-1892	Sidekiq < 7.0.8 - Cross-Site Scripting	sidekiq	9.6 (v3.1)	Critical
CVE-2026-54694	NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover	skills-service	9.6 (v3.1)	Critical
CVE-2026-55085	Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite	etherpad	9.6 (v3.1)	Critical
CVE-2026-73043	SiYuan before v3.7.4 Remote Code Execution via Template Calculation	siyuan	9.4 (v4.0)	Critical
CVE-2026-73044	SiYuan before v3.7.4 Stored Cross-Site Scripting via Column Width	siyuan	9.4 (v4.0)	Critical
CVE-2026-73050	SiYuan before v3.7.4 Stored XSS via select option color	siyuan	9.4 (v4.0)	Critical
CVE-2026-73052	SiYuan before v3.7.4 Stored XSS via Attribute-View Field Names	siyuan	9.4 (v4.0)	Critical
CVE-2026-73053	SiYuan before v3.7.4 Cross-Site Scripting via unicode2Emoji	siyuan	9.4 (v4.0)	Critical
CVE-2024-58355	Cal.com through 4.7.15 Cross-Site Scripting via booking questions	cal.diy	9.3 (v4.0)	Critical
CVE-2026-42849	authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover	authentik	9.3 (v3.1)	Critical
CVE-2026-45118	MyBB: Contact page reflected XSS	mybb	9.3 (v3.1)	Critical
CVE-2026-66394	SiYuan before v3.7.3 Stored and Reflected XSS via SVG Sanitizer Bypass	siyuan	9.3 (v4.0)	Critical
CVE-2026-66418	OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field	openclaw agent dashboard	9.3 (v4.0)	Critical
CVE-2026-74902	SiYuan before v3.7.4 XSS-to-RCE via malicious filename upload	siyuan	9.3 (v4.0)	Critical
CVE-2026-78997	UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314) Cross-Site Scripting Vulnerability	UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314)	9.3 (v3.1)	Critical
CVE-2026-84189	LibreNMS before 26.7.0 Stored XSS via Oxidized API	librenms	9.2 (v4.0)	Critical
CVE-2014-5308	TestLink 1.9.11 - Multiple SQL Injections	testlink	9.0 (v2.0)	High
CVE-2019-7671	Prima Access Control 2.3.35 - 'HwName' Persistent Cross-Site Scripting	flexair	9.0 (v3.1)	Critical
CVE-2023-34192	Zimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site Scripting	collaboration	9.0 (v3.1)	Critical
CVE-2026-34448	SiYuan: Stored XSS in Attribute View gallery/kanban cover rendering allows arbitrary command execution in the desktop cl	siyuan	9.0 (v3.1)	Critical
CVE-2026-35198	HeyForm vulnerable to stored XSS via form field titles	heyform	9.0 (v3.1)	Critical
CVE-2026-42556	Postiz stored XSS in public preview page	postiz	9.0 (v3.1)	Critical
CVE-2026-43984	Tautulli has stored XSS in logFile via guest-controlled log_js_errors input	Tautulli	8.9 (v3.1)	High
CVE-2016-8526	Aruba AirWave 8.2.3 - XML External Entity Injection / Cross-Site Scripting	airwave	8.8 (v3.0)	High
CVE-2016-9315	Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities	interscan web security virtual appliance	8.8 (v3.0)	High
CVE-2018-11442	EasyService Billing 1.0 - Cross-Site Request Forgery	easyservice billing	8.8 (v3.0)	High
CVE-2018-11445	EasyService Billing 1.0 - Cross-Site Request Forgery	easyservice billing	8.8 (v3.0)	High
CVE-2018-15884	RICOH MP C4504ex Printer - Cross-Site Request Forgery (Add Admin)	mp c4504ex firmware	8.8 (v3.0)	High
CVE-2018-6224	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	8.8 (v3.0)	High
CVE-2019-9189	Prima Access Control 2.3.35 - Arbitrary File Upload	flexair	8.8 (v3.0)	High
CVE-2020-7991	Adive Framework 2.0.8 - Cross-Site Request Forgery (Change Admin Password)	framework	8.8 (v3.1)	High
CVE-2025-56798	Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier Cross-Site Request Forgery Vulnerability	Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier	8.8 (v3.1)	High
CVE-2026-12968	Product Addons – WowAddons < 1.6.15 - Unauthenticated Stored XSS via Arbitrary SVG Upload	Product Addons and Product Options With Custom Fields	8.8 (v3.1)	High
CVE-2026-41473	CyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner Endpoints	cyberpanel	8.8 (v4.0)	High
CVE-2026-12496	Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server	LIP-ME20xC	8.7 (v4.0)	High
CVE-2026-15217	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab	gitlab	8.7 (v3.1)	High
CVE-2026-44667	Faction: Stored XSS in Remediation Verification Attachment Filename Preview Rendering	faction	8.7 (v3.1)	High
CVE-2026-44729	Twenty: Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers)	twenty	8.7 (v3.1)	High
CVE-2026-45115	MyBB: Buddy/ignore list username XSS	mybb	8.7 (v3.1)	High
CVE-2026-46518	OpenEMR: Stored XSS in prescription CSS/HTML print view via patient demographics	openemr	8.7 (v3.1)	High
CVE-2026-47665	Penpot: Stored XSS via comment content, innerHTML renders unsanitized HTML	penpot	8.7 (v3.1)	High
CVE-2026-48026	lakeFS vulnerable to stored XSS in rendered markdown previews via raw HTML	lakeFS	8.7 (v3.1)	High
CVE-2026-53758	Emlog: Stored XSS via Parsedown Markdown Processing - Raw HTML Not Sanitized	emlog	8.7 (v4.0)	High
CVE-2026-54347	Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover	froxlor	8.7 (v3.1)	High
CVE-2026-68899	Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallback	wekan	8.7 (v3.1)	High
CVE-2026-69096	OpenWrt luci-app-dockerman Read ACL Remote Code Execution	luci	8.7 (v4.0)	High
CVE-2026-34463	MantisBT has Stored HTML Injection/XSS via Clone Issue Form	mantisbt	8.6 (v4.0)	High
CVE-2026-49864	wetty vulnerable to DOM XSS via file-download filename	wetty	8.6 (v4.0)	High
CVE-2026-34932	hoppscotch: Stored XSS via mock server responses on backend origin	hoppscotch	8.5 (v4.0)	High
CVE-2026-58113	Teamcenter V2412 Cross-site Scripting Vulnerability	Teamcenter V2412	8.5 (v4.0)	High
CVE-2026-63361	LimeSurvey Community Edition 7.0.5+260623 - Reflected XSS in HTML editor popup	LimeSurvey	8.5 (v4.0)	High
CVE-2026-64851	Grav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlers	grav-plugin-shortcode-core	8.5 (v4.0)	High
CVE-2026-65986	CVAT has stored XSS via annotation guide assets	cvat	8.5 (v4.0)	High
CVE-2026-15973	LimeSurvey 7.0.5 - Stored XSS in Survey Menu Entries	LimeSurvey	8.4 (v4.0)	High
CVE-2026-5385	GLPI 11.0.0 - Stored XSS in knowledge base	glpi	8.4 (v4.0)	High
CVE-2026-77072	n8n before 1.123.69 Stored XSS via Form Completion Page	n8n	8.4 (v4.0)	High
CVE-2026-85613	OpenPanel Unauthenticated XSS via SVG Favicon Proxy	openpanel	8.4 (v4.0)	High
CVE-2026-87814	SiYuan before v3.8.2 Stored XSS via Asset Preview	siyuan	8.4 (v4.0)	High
CVE-2024-5420	SEH utnserver Pro/ProMAX/INU-100 20.1.22 - Cross-Site Scripting	utnserver Pro	8.3 (v4.0)	High
CVE-2026-34725	dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration	dbgate	8.2 (v3.1)	High
CVE-2026-56670	ComfyUI: Stored XSS via SVG file upload on the /view endpoint	ComfyUI	8.2 (v3.1)	High
CVE-2018-6221	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	8.1 (v3.0)	High
CVE-2026-39344	Reflected XSS the login page through the 'username' parameter	churchcrm	8.1 (v3.0)	High
CVE-2026-48060	Litestar: HTML Injection Through CSRF Token	litestar	8.1 (v3.1)	High
CVE-2026-50758	DayuanJiang next-ai-draw-io 0.4.13 Arbitrary Code Execution Vulnerability	DayuanJiang next-ai-draw-io 0.4.13	8.1 (v3.1)	High
CVE-2016-9314	Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities	interscan web security virtual appliance	7.8 (v3.0)	High
CVE-2018-6222	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	7.8 (v3.0)	High
CVE-2026-16969	DFIR-IRIS Stored XSS in Assets	iris-web	7.6 (v3.1)	High
CVE-2026-18360	DFIR-IRIS Stored XSS in Custom Attributes	iris-web	7.6 (v3.1)	High
CVE-2026-18361	DFIR-IRIS Stored XSS in Datastore Upload	iris-web	7.6 (v3.1)	High
CVE-2002-1131	SquirrelMail 1.2.6/1.2.7 - Cross-Site Scripting	squirrelmail	7.5 (v2.0)	High
CVE-2014-6389	PHPCompta/NOALYSS 6.7.1 5638 - Remote Command Execution	phpcompta/noalyss	7.5 (v2.0)	High
CVE-2015-1518	RedaxScript CMS 2.2.0 - SQL Injection	redaxscript	7.5 (v2.0)	High
CVE-2023-0905	Employee Task Management System v1.0 - Broken Authentication	employee task management system	7.5 (v3.1)	High
CVE-2026-44657	MantisBT: Stored XSS in File Download	mantisbt	7.5 (v4.0)	High
CVE-2026-7460	mailcow-dockerized 2026-03b - Stored XSS in Queue Manager via unescaped	mailcow-dockerized	7.4 (v4.0)	High
CVE-2026-87812	SiYuan before v3.8.2 Stored XSS via Bazaar iconURL	siyuan	7.4 (v4.0)	High
CVE-2026-30819	Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameter	iTop	7.3 (v3.1)	High
CVE-2026-6735	XSS within PHP-FPM status endpoint	php	7.3 (v4.0)	High
CVE-2026-8203	Concrete CMS 9.5.0 and below has Stored XSS on the height parameter	concrete cms	7.3 (v4.0)	High
CVE-2019-1936	Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities	integrated management controller supervisor	7.2 (v3.1)	High
CVE-2026-18756	HumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button rendering	HumHub	7.2 (v4.0)	High
CVE-2022-35499	In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint Cross-Site Scripting Vulnerability	-	7.1 (v3.1)	High
CVE-2024-41357	phpIPAM 1.6 - Reflected-Cross-Site Scripting (XSS)	phpipam	7.1 (v3.1)	High
CVE-2026-12970	LearnPress < 4.4.1 - Reflected XSS via c_search	LearnPress	7.1 (v3.1)	High
CVE-2026-34598	YesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter"	yeswiki	7.1 (v4.0)	High
CVE-2026-6858	Transbank Webpay < 1.14.0 - Unauthenticated Stored XSS	Transbank Webpay	7.1 (v3.1)	High
CVE-2026-84192	LibreNMS before 26.3.1 Stored XSS via SNMP/Syslog Data	librenms	7.1 (v4.0)	High
CVE-2026-55746	Cotonti stored XSS via PFS folder title	Cotonti	7.0 (v4.0)	High
CVE-2026-58411	ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values	CRM	7.0 (v4.0)	High
CVE-2018-3238	Oracle Fusion Middleware WebCenter Sites 11.1.1.8.0 - Cross-Site Scripting	webcenter sites	6.9 (v3.0)	Medium
CVE-2025-4388	Liferay Portal - Cross-Site Scripting	digital experience platform	6.9 (v4.0)	Medium
CVE-2025-4576	Liferay Portal & DXP - Cross-Site Scripting	digital experience platform	6.9 (v4.0)	Medium
CVE-2026-39838	ProofreadPage improperly sanitizes multiline styles using Sanitizer::checkCSS	MediaWiki - ProofreadPage Extension	6.9 (v4.0)	Medium
CVE-2026-39936	Stored XSS in Score due to usage of non-reserved data attributes	Mediawiki - Score Extension	6.9 (v4.0)	Medium
CVE-2026-40598	MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page	mantisbt	6.9 (v4.0)	Medium
CVE-2026-44651	SillyTavern: Reflected XSS vulnerability in the CORS proxy middleware	SillyTavern	6.9 (v4.0)	Medium
CVE-2026-59238	Stored XSS in Pentestify via unsanitized finding images and report client logo	Pentestify	6.9 (v4.0)	Medium
CVE-2026-69092	Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpoint	admidio	6.9 (v4.0)	Medium
CVE-2026-73848	Emlog: Stored XSS via Tag Name in Article Editor	emlog	6.9 (v4.0)	Medium
CVE-2026-86188	AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting	AVideo	6.9 (v4.0)	Medium
CVE-2007-0885	Jira Rainbow.Zen - Cross-Site Scripting	rainbow.zen	6.8 (v2.0)	Medium
CVE-2018-6230	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	6.8 (v3.0)	Medium
CVE-2026-15047	s2Member < 260805 - Contributor+ Stored XSS via Shortcode	s2Member	6.8 (v3.1)	Medium
CVE-2026-16559	YMC Filter < 3.12.9 - Author+ Stored XSS via SVG Icon Upload	YMC Filter	6.8 (v3.1)	Medium
CVE-2026-33741	EspoCRM: Stored XSS via SVG attachment loading same-origin JavaScript	espocrm	6.8 (v3.1)	Medium
CVE-2026-67352	luci-app-https-dns-proxy Stored XSS via resolver_url	luci	6.8 (v4.0)	Medium
CVE-2012-1258	Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities	scrutinizer netflow & sflow analyzer	6.5 (v3.1)	Medium
CVE-2018-6219	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	6.5 (v3.0)	Medium
CVE-2019-7439	JioFi 4G M2S 1.0.2 - Denial of Service	jiofi 4g m2s firmware	6.5 (v3.0)	Medium
CVE-2025-53771	Microsoft SharePoint Server - Authentication Bypass (ToolShell)	sharepoint server	6.5 (v3.1)	Medium
CVE-2026-40105	XWiki - Cross-Site Scripting	xwiki-platform	6.5 (v4.0)	Medium
CVE-2026-55549	Yamcs: Reflected XSS in the URL of the Authorize Endpoint	yamcs	6.5 (v3.1)	Medium
CVE-2026-78838	the grid_datasource.php component of AppNitro MachForm v30 Cross-Site Scripting Vulnerability	the grid datasource.php component of AppNitro MachForm v30	6.5 (v3.1)	Medium
CVE-2026-0737	Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode	WP Shortcodes Plugin — Shortcodes Ultimate	6.4 (v3.1)	Medium
CVE-2026-3885	WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_bo	Shortcodes Ultimate – Content Elements	6.4 (v3.1)	Medium
CVE-2026-45797	HeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Upload	heyform	6.4 (v4.0)	Medium
CVE-2026-43980	Malla: Stored XSS via Meshtastic node names in multiple frontend pages	malla	6.3 (v3.1)	Medium
CVE-2012-1260	Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities	scrutinizer netflow & sflow analyzer	6.1 (v3.1)	Medium
CVE-2012-1261	Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities	scrutinizer netflow & sflow analyzer	6.1 (v3.1)	Medium
CVE-2012-5193	Bitweaver 2.8.1 - Multiple Vulnerabilities	bitweaver	6.1 (v3.1)	Medium
CVE-2014-4535	Import Legacy Media <= 0.1 - Cross-Site Scripting	import legacy media	6.1 (v3.1)	Medium
CVE-2014-4536	Infusionsoft Gravity Forms Add-on < 1.5.7 - Cross-Site Scripting	infusionsoft gravity forms	6.1 (v3.1)	Medium
CVE-2014-4539	Movies <= 0.6 - Cross-Site Scripting	movies	6.1 (v3.1)	Medium
CVE-2014-4544	Podcast Channels < 0.28 - Cross-Site Scripting	podcast channels	6.1 (v3.1)	Medium
CVE-2014-4558	WooCommerce Swipe <= 2.7.1 - Cross-Site Scripting	swipehq-payment-gateway-woocommerce	6.1 (v3.1)	Medium
CVE-2014-4561	Ultimate Weather Plugin <= 1.0 - Cross-Site Scripting	ultimate-weather	6.1 (v3.1)	Medium
CVE-2014-9607	Netsweeper 4.0.4 - Cross-Site Scripting	netsweeper	6.1 (v3.1)	Medium
CVE-2015-6477	Nordex NC2 - Cross-Site Scripting	nordex control 2 scada	6.1 (v3.1)	Medium
CVE-2015-8349	SourceBans <2.0 - Cross-Site Scripting	sourcebans	6.1 (v3.0)	Medium
CVE-2015-9414	WordPress Symposium <=15.8.1 - Cross-Site Scripting	wp-symposium	6.1 (v3.1)	Medium
CVE-2016-1000126	WordPress Admin Font Editor <=1.8 - Cross-Site Scripting	admin-font-editor	6.1 (v3.0)	Medium
CVE-2016-1000127	WordPress AJAX Random Post <=2.00 - Cross-Site Scripting	ajax-random-post	6.1 (v3.0)	Medium
CVE-2016-1000128	WordPress anti-plagiarism <=3.60 - Cross-Site Scripting	anti-plagiarism	6.1 (v3.0)	Medium
CVE-2016-1000129	WordPress defa-online-image-protector <=3.3 - Cross-Site Scripting	defa-online-image-protector	6.1 (v3.0)	Medium
CVE-2016-1000130	WordPress e-search <=1.0 - Cross-Site Scripting	e-search	6.1 (v3.0)	Medium
CVE-2016-1000132	WordPress enhanced-tooltipglossary 3.2.8 - Cross-Site Scripting	tooltip glossary	6.1 (v3.0)	Medium
CVE-2016-1000133	WordPress forget-about-shortcode-buttons 1.1.1 - Cross-Site Scripting	forget about shortcode buttons	6.1 (v3.0)	Medium
CVE-2016-1000134	WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting	hdw-tube	6.1 (v3.0)	Medium
CVE-2016-1000135	WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting	hdw-tube	6.1 (v3.0)	Medium
CVE-2016-1000136	WordPress heat-trackr 1.0 - Cross-Site Scripting	heat-trackr	6.1 (v3.0)	Medium
CVE-2016-1000137	WordPress Hero Maps Pro 2.1.0 - Cross-Site Scripting	hero-maps-pro	6.1 (v3.0)	Medium
CVE-2016-1000138	WordPress Admin Font Editor <=1.8 - Cross-Site Scripting	indexisto	6.1 (v3.0)	Medium
CVE-2016-1000142	WordPress MW Font Changer <=4.2.5 - Cross-Site Scripting	parsi-font	6.1 (v3.0)	Medium
CVE-2016-1000143	WordPress Photoxhibit 2.1.8 - Cross-Site Scripting	photoxhibit	6.1 (v3.0)	Medium
CVE-2016-1000146	WordPress Pondol Form to Mail <=1.1 - Cross-Site Scripting	pondol-formmail	6.1 (v3.0)	Medium
CVE-2016-1000153	WordPress Tidio Gallery <=1.1 - Cross-Site Scripting	tidio-gallery	6.1 (v3.0)	Medium
CVE-2016-1000154	WordPress WHIZZ <=1.0.7 - Cross-Site Scripting	whizz	6.1 (v3.0)	Medium
CVE-2016-8527	Aruba AirWave 8.2.3 - XML External Entity Injection / Cross-Site Scripting	airwave	6.1 (v3.0)	Medium
CVE-2017-17059	WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting	amtythumb	6.1 (v3.0)	Medium
CVE-2017-18536	WordPress Stop User Enumeration <=1.3.7 - Cross-Site Scripting	stop user enumeration	6.1 (v3.0)	Medium
CVE-2017-3132	Fortinet FortiOS < 5.6.0 - Cross-Site Scripting	fortios	6.1 (v3.0)	Medium
CVE-2017-3133	Fortinet FortiOS < 5.6.0 - Cross-Site Scripting	fortios	6.1 (v3.0)	Medium
CVE-2017-5631	KMCIS CaseAware - Cross-Site Scripting	caseaware	6.1 (v3.0)	Medium
CVE-2017-7855	IceWarp WebMail 11.3.1.5 - Cross-Site Scripting	server	6.1 (v3.0)	Medium
CVE-2017-9288	WordPress Raygun4WP <=1.8.0 - Cross-Site Scripting	raygun4wp	6.1 (v3.0)	Medium
CVE-2018-10230	Zend Server <9.13 - Cross-Site Scripting	zend server	6.1 (v3.0)	Medium
CVE-2018-10383	Lantronix SecureLinx Spider (SLS) 2.2+ - Cross-Site Scripting	securelinx spider firmware	6.1 (v3.0)	Medium
CVE-2018-11709	WordPress wpForo Forum <= 1.4.11 - Cross-Site Scripting	wpforo forum	6.1 (v3.0)	Medium
CVE-2018-12998	Zoho manageengine - Cross-Site Scripting	firewall analyzer	6.1 (v3.1)	Medium
CVE-2018-14013	Synacor Zimbra Collaboration Suite Collaboration <8.8.11 - Cross-Site Scripting	zimbra collaboration suite	6.1 (v3.0)	Medium
CVE-2018-16139	BIBLIOsoft BIBLIOpac 2008 - Cross-Site Scripting	bibliopac	6.1 (v3.0)	Medium
CVE-2018-16833	ManageEngine Desktop Central 10.0.271 - Cross-Site Scripting	manageengine desktop central	6.1 (v3.0)	Medium
CVE-2018-17310	RICOH MP C1803 JPN Printer - Cross-Site Scripting	mp c1803 jpn firmware	6.1 (v3.0)	Medium
CVE-2018-17313	RICOH MP C1803 JPN Printer - Cross-Site Scripting	mp c307 firmware	6.1 (v3.0)	Medium
CVE-2018-20503	SirsiDynix e-Library 3.5.x - Cross-Site Scripting	8100l/8 firmware	6.1 (v3.0)	Medium
CVE-2018-5715	SugarCRM 3.5.1 - Cross-Site Scripting	sugarcrm	6.1 (v3.0)	Medium
CVE-2018-6882	zimbra collaboration suite Cross-Site Scripting Vulnerability	zimbra collaboration suite	6.1 (v3.1)	Medium
CVE-2018-7196	osTicket < 1.10.2 - Cross-Site Scripting	osticket	6.1 (v3.0)	Medium
CVE-2018-8006	Apache ActiveMQ <=5.15.5 - Cross-Site Scripting	activemq	6.1 (v3.1)	Medium
CVE-2018-9238	Yahei PHP Prober 0.4.7 - Cross-Site Scripting	yahei php prober	6.1 (v3.0)	Medium
CVE-2019-1010287	Timesheet Next Gen <=1.5.3 - Cross-Site Scripting	timesheet next gen	6.1 (v3.0)	Medium
CVE-2019-10475	Jenkins build-metrics 1.3 - Cross-Site Scripting	build-metrics	6.1 (v3.1)	Medium
CVE-2019-11844	RICOH SP 4520DN Printer - HTML Injection	sp 4520dn firmware	6.1 (v3.0)	Medium
CVE-2019-11845	RICOH SP 4510DN Printer - HTML Injection	sp 4510dn firmware	6.1 (v3.0)	Medium
CVE-2019-12461	WebPort 1.19.1 - Cross-Site Scripting	web port	6.1 (v3.0)	Medium
CVE-2019-13392	MindPalette NateMail 3.0.15 - Cross-Site Scripting	natemail	6.1 (v3.1)	Medium
CVE-2019-14696	Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting	open-school	6.1 (v3.0)	Medium
CVE-2019-15501	L-Soft LISTSERV <16.5-2018a - Cross-Site Scripting	listserv	6.1 (v3.0)	Medium
CVE-2019-15713	WordPress My Calendar <= 3.1.9 - Cross-Site Scripting	my calendar	6.1 (v3.0)	Medium
CVE-2019-15889	WordPress Download Manager <2.9.94 - Cross-Site Scripting	wordpress download manager	6.1 (v3.0)	Medium
CVE-2019-16332	WordPress API Bearer Auth <20190907 - Cross-Site Scripting	api bearer auth	6.1 (v3.1)	Medium
CVE-2019-16525	WordPress Checklist <1.1.9 - Cross-Site Scripting	checklist	6.1 (v3.1)	Medium
CVE-2019-19368	Rumpus FTP Web File Manager 8.2.9.1 - Cross-Site Scripting	rumpus	6.1 (v3.1)	Medium
CVE-2019-19908	phpMyChat-Plus 1.98 - Cross-Site Scripting	phpmychat-plus	6.1 (v3.1)	Medium
CVE-2019-20141	WordPress Laborator Neon Theme 2.0 - Cross-Site Scripting	neon	6.1 (v3.1)	Medium
CVE-2019-20210	WordPress CTHthemes - Cross-Site Scripting	citybook	6.1 (v3.1)	Medium
CVE-2019-3911	LabKey Server Community Edition <18.3.0 - Cross-Site Scripting	labkey server	6.1 (v3.1)	Medium
CVE-2019-6112	WordPress Sell Media 2.4.1 - Cross-Site Scripting	sell media	6.1 (v3.1)	Medium
CVE-2019-7219	Zarafa WebApp <=2.0.1.47791 - Cross-Site Scripting	webaccess	6.1 (v3.0)	Medium
CVE-2019-7438	JioFi 4G M2S 1.0.2 - 'mask' Cross-Site Scripting	jiofi 4g m2s firmware	6.1 (v3.0)	Medium
CVE-2019-8390	qdPM 9.1 - 'search[keywords]' Cross-Site Scripting	qdpm	6.1 (v3.0)	Medium
CVE-2019-8937	HotelDruid 2.3.0 - Cross-Site Scripting	hoteldruid	6.1 (v3.0)	Medium
CVE-2020-1106	Microsoft Office SharePoint XSS Vulnerability	sharepoint enterprise server	6.1 (v3.1)	Medium
CVE-2020-13258	Contentful <=2020-05-21 - Cross-Site Scripting	python example	6.1 (v3.1)	Medium
CVE-2020-14413	NeDi 1.9C - Cross-Site Scripting	nedi	6.1 (v3.1)	Medium
CVE-2020-15500	TileServer GL <=3.0.0 - Cross-Site Scripting	tileservergl	6.1 (v3.1)	Medium
CVE-2020-17362	Nova Lite < 1.3.9 - Cross-Site Scripting	nova lite	6.1 (v3.1)	Medium
CVE-2020-19283	Jeesns 1.4.2 - Cross-Site Scripting	jeesns	6.1 (v3.1)	Medium
CVE-2020-23517	Aryanic HighMail (High CMS) - Cross-Site Scripting	high cms	6.1 (v3.1)	Medium
CVE-2020-27982	IceWarp WebMail 11.4.5.0 - Cross-Site Scripting	mail server	6.1 (v3.1)	Medium
CVE-2020-3580	Cisco ASA/FTD Software - Cross-Site Scripting	firepower threat defense	6.1 (v3.1)	Medium
CVE-2020-6171	CLink Office 2.0 - Cross-Site Scripting	clink office	6.1 (v3.1)	Medium
CVE-2020-7107	WordPress Ultimate FAQ <1.8.30 - Cross-Site Scripting	ultimate faq	6.1 (v3.1)	Medium
CVE-2020-8191	Citrix ADC/Gateway - Cross-Site Scripting	application delivery controller firmware	6.1 (v3.1)	Medium
CVE-2020-9344	Jira Subversion ALM for Enterprise <8.8.2 - Cross-Site Scripting	subversion application lifecycle management	6.1 (v3.1)	Medium
CVE-2021-21799	Advantech R-SeeNet 2.4.12 - Cross-Site Scripting	r-seenet	6.1 (v3.1)	Medium
CVE-2021-21800	Advantech R-SeeNet 2.4.12 - Cross-Site Scripting	r-seenet	6.1 (v3.1)	Medium
CVE-2021-24298	WordPress Simple Giveaways <2.36.2 - Cross-Site Scripting	simple giveaways	6.1 (v3.1)	Medium
CVE-2021-24316	WordPress Mediumish Theme <=1.0.47 - Cross-Site Scripting	mediumish	6.1 (v3.1)	Medium
CVE-2021-24320	WordPress Bello Directory & Listing Theme <1.6.0 - Cross-Site Scripting	bello	6.1 (v3.1)	Medium
CVE-2021-24335	WordPress Car Repair Services & Auto Mechanic Theme <4.0 - Cross-Site Scripting	car repair services & auto mechanic	6.1 (v3.1)	Medium
CVE-2021-24342	WordPress JNews Theme <8.0.6 - Cross-Site Scripting	jnews	6.1 (v3.1)	Medium
CVE-2021-24389	WordPress FoodBakery <2.2 - Cross-Site Scripting	foodbakery	6.1 (v3.1)	Medium
CVE-2021-24495	Wordpress Marmoset Viewer <1.9.3 - Cross-Site Scripting	marmoset viewer	6.1 (v3.1)	Medium
CVE-2021-24498	WordPress Calendar Event Multi View <1.4.01 - Cross-Site Scripting	calendar event multi view	6.1 (v3.1)	Medium
CVE-2021-26247	Cacti - Cross-Site Scripting	cacti	6.1 (v3.1)	Medium
CVE-2021-26475	EPrints 3.4.2 - Cross-Site Scripting	eprints	6.1 (v3.1)	Medium
CVE-2021-26710	Redwood Report2Web 4.3.4.5 & 4.5.3 - Cross-Site Scripting	report2web	6.1 (v3.1)	Medium
CVE-2021-26723	Jenzabar 9.2x-9.2.2 - Cross-Site Scripting	jenzabar	6.1 (v3.1)	Medium
CVE-2021-27309	Clansphere CMS 2011.4 - Cross-Site Scripting	clansphere	6.1 (v3.1)	Medium
CVE-2021-27310	Clansphere CMS 2011.4 - Cross-Site Scripting	clansphere	6.1 (v3.1)	Medium
CVE-2021-30049	SysAid Technologies 20.3.64 b14 - Cross-Site Scripting	sysaid	6.1 (v3.1)	Medium
CVE-2021-30213	Knowage Suite 7.3 - Cross-Site Scripting	knowage	6.1 (v3.1)	Medium
CVE-2021-31682	WebCTRL OEM <= 6.5 - Cross-Site Scripting	webctrl	6.1 (v3.1)	Medium
CVE-2021-34630	GTranslate < 2.8.65 - Cross-Site Scripting	gtranslate	6.1 (v3.1)	Medium
CVE-2021-36450	Verint Workforce Optimization 15.2.8.10048 - Cross-Site Scripting	workforce optimization	6.1 (v3.1)	Medium
CVE-2021-36646	KodExplorer - Cross-Site Scripting	kod-explorer	6.1 (v3.1)	Medium
CVE-2021-37833	Hotel Druid 3.0.2 - Cross-Site Scripting	hoteldruid	6.1 (v3.1)	Medium
CVE-2021-38702	Cyberoam NetGenie Cross-Site Scripting	netgenie c0101b1-20141120-ng11vo firmware	6.1 (v3.1)	Medium
CVE-2021-38704	ClinicCases 7.3.3 Cross-Site Scripting	cliniccases	6.1 (v3.1)	Medium
CVE-2021-40868	Cloudron 6.2 Cross-Site Scripting	cloudron	6.1 (v3.1)	Medium
CVE-2021-41467	JustWriting - Cross-Site Scripting	justwriting	6.1 (v3.1)	Medium
CVE-2021-42565	myfactory FMS - Cross-Site Scripting	fms	6.1 (v3.1)	Medium
CVE-2021-45380	AppCMS - Cross-Site Scripting	appcms	6.1 (v3.1)	Medium
CVE-2021-45422	Reprise License Manager 14.2 - Cross-Site Scripting	reprise license manager	6.1 (v3.1)	Medium
CVE-2021-45425	SAFARI Montage 8.5 - Reflected Cross Site Scripting (XSS)	safari montage	6.1 (v3.1)	Medium
CVE-2021-46387	Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting (XSS)	zywall 2 plus internet security appliance firmware	6.1 (v3.1)	Medium
CVE-2022-0208	WordPress Plugin MapPress <2.73.4 - Cross-Site Scripting	mappress	6.1 (v3.1)	Medium
CVE-2022-0678	Microweber <1.2.11 - Cross-Site Scripting	microweber	6.1 (v3.1)	Medium
CVE-2022-1170	JobMonster < 4.5.2.9 - Cross-Site Scripting	jobmonster	6.1 (v3.1)	Medium
CVE-2022-1221	WordPress Gwyn's Imagemap Selector <=0.3.3 - Cross-Site Scripting	gwyn's imagemap selector	6.1 (v3.1)	Medium
CVE-2022-2130	Microweber < 1.2.17 - Cross-Site Scripting	microweber	6.1 (v3.1)	Medium
CVE-2022-2174	microweber 1.2.18 - Cross-site Scripting	microweber	6.1 (v3.1)	Medium
CVE-2022-24384	SmarterTools SmarterTrack - Cross-Site Scripting	smartertrack	6.1 (v3.1)	Medium
CVE-2022-26564	HotelDruid Hotel Management Software 3.0.3 - Cross-Site Scripting	hoteldruid	6.1 (v3.1)	Medium
CVE-2022-27926	Zimbra Collaboration (ZCS) - Cross Site Scripting	collaboration	6.1 (v3.1)	Medium
CVE-2022-28363	Reprise License Manager 14.2 - Cross-Site Scripting	reprise license manager	6.1 (v3.1)	Medium
CVE-2022-28508	MantisBT < 2.25.2 - Cross-Site Scripting	mantisbt	6.1 (v3.1)	Medium
CVE-2022-30489	Wavlink WN-535G3 - Cross-Site Scripting	wn535g3 firmware	6.1 (v3.1)	Medium
CVE-2022-30777	Parallels H-Sphere 3.6.1713 - Cross-Site Scripting	h-sphere	6.1 (v3.1)	Medium
CVE-2022-3242	Microweber <1.3.2 - Cross-Site Scripting	microweber	6.1 (v3.1)	Medium
CVE-2022-32770	WWBN AVideo 11.6 - Cross-Site Scripting	avideo	6.1 (v3.1)	Medium
CVE-2022-32771	WWBN AVideo 11.6 - Cross-Site Scripting	avideo	6.1 (v3.1)	Medium
CVE-2022-34328	PMB 7.3.10 - Cross-Site Scripting	pmb	6.1 (v3.1)	Medium
CVE-2022-35493	eShop 3.0.4 - Cross-Site Scripting	eshop - ecommerce / store website	6.1 (v3.1)	Medium
CVE-2022-35653	Moodle LTI module Reflected - Cross-Site Scripting	moodle	6.1 (v3.1)	Medium
CVE-2022-38295	Cuppa CMS v1.0 - Cross Site Scripting	cuppacms	6.1 (v3.1)	Medium
CVE-2022-38553	Academy Learning Management System <5.9.1 - Cross-Site Scripting	academy learning management system	6.1 (v3.1)	Medium
CVE-2022-41441	ReQlogic v11.3 - Cross Site Scripting	reqlogic	6.1 (v3.1)	Medium
CVE-2022-4301	WordPress Sunshine Photo Cart <2.9.15 - Cross-Site Scripting	sunshine photo cart	6.1 (v3.1)	Medium
CVE-2022-4321	PDF Generator for WordPress < 1.1.2 - Cross Site Scripting	pdf generator for wordpress	6.1 (v3.1)	Medium
CVE-2022-46073	Helmet Store Showroom - Cross Site Scripting	helmet store showroom	6.1 (v3.1)	Medium
CVE-2022-46381	Linear eMerge E3-Series - Cross-Site Scripting	linear emerge e3 access control firmware	6.1 (v3.1)	Medium
CVE-2022-46888	NexusPHP <1.7.33 - Cross-Site Scripting	nexusphp	6.1 (v3.1)	Medium
CVE-2022-48197	Yahoo User Interface library (YUI2) TreeView v2.8.2 - Cross-Site Scripting	yui	6.1 (v3.1)	Medium
CVE-2023-0099	Simple URLs < 115 - Cross Site Scripting	simple urls	6.1 (v3.1)	Medium
CVE-2023-0236	WordPress Tutor LMS <2.0.10 - Cross Site Scripting	tutor lms	6.1 (v3.1)	Medium
CVE-2023-0334	ShortPixel Adaptive Images < 3.6.3 - Cross Site Scripting	shortpixel adaptive images	6.1 (v3.1)	Medium
CVE-2023-1119	WP-Optimize WordPress plugin < 3.2.13 - Cross-Site Scripting	wp-optimize,srbtranslatin	6.1 (v3.1)	Medium
CVE-2023-1880	Phpmyfaq v3.1.11 - Cross-Site Scripting	phpmyfaq	6.1 (v3.1)	Medium
CVE-2023-24657	phpIPAM - 1.6 - Cross-Site Scripting	phpipam	6.1 (v3.1)	Medium
CVE-2023-25346	ChurchCRM 4.5.3 - Cross-Site Scripting	churchcrm	6.1 (v3.1)	Medium
CVE-2023-27641	L-Soft LISTSERV 16.5 - Cross-Site Scripting	listserv	6.1 (v3.1)	Medium
CVE-2023-2813	Wordpress Multiple Themes - Reflected Cross-Site Scripting	connections reloaded	6.1 (v3.1)	Medium
CVE-2023-2822	Ellucian Ethos Identity CAS - Cross-Site Scripting	ethos identity	6.1 (v3.1)	Medium
CVE-2023-30212	OURPHP <= 7.2.0 - Cross Site Scripting	ourphp	6.1 (v3.1)	Medium
CVE-2023-34599	Gibbon v25.0.0 - Cross-Site Scripting	gibbon	6.1 (v3.1)	Medium
CVE-2023-3479	Hestiacp <= 1.7.7 - Cross-Site Scripting	control panel	6.1 (v3.1)	Medium
CVE-2023-3521	FOSSBilling < 0.5.3 - Cross-Site Scripting	fossbilling	6.1 (v3.1)	Medium
CVE-2023-36306	Adiscon LogAnalyzer v.4.1.13 - Cross-Site Scripting	loganalyzer	6.1 (v3.1)	Medium
CVE-2023-37580	Zimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site Scripting	zimbra	6.1 (v3.1)	Medium
CVE-2023-38194	SuperWebMailer - Cross-Site Scripting	superwebmailer	6.1 (v3.1)	Medium
CVE-2023-38875	PHP Login System 2.0.1 - Cross-Site Scripting	php-login-system	6.1 (v3.1)	Medium
CVE-2023-38910	CSZ CMS 1.3.0 - Stored Cross-Site Scripting ('Photo URL' and 'YouTube URL' )	csz cms	6.1 (v3.1)	Medium
CVE-2023-38964	Academy LMS 6.0 - Cross-Site Scripting	academy lms	6.1 (v3.1)	Medium
CVE-2023-39598	IceWarp Email Client - Cross Site Scripting	webclient	6.1 (v3.1)	Medium
CVE-2023-4110	PHPJabbers Availability Booking Calendar 5.0 - Cross-Site Scripting	availability booking calendar	6.1 (v3.1)	Medium
CVE-2023-4111	PHPJabbers Bus Reservation System 1.1 - Cross-Site Scripting	bus reservation system	6.1 (v3.1)	Medium
CVE-2023-4113	PHPJabbers Service Booking Script 1.0 - Cross Site Scripting	service booking script	6.1 (v3.1)	Medium
CVE-2023-4114	PHP Jabbers Night Club Booking 1.0 - Cross Site Scripting	night club booking software	6.1 (v3.1)	Medium
CVE-2023-4115	PHPJabbers Cleaning Business 1.0 - Cross-Site Scripting	cleaning business software	6.1 (v3.1)	Medium
CVE-2023-4116	PHPJabbers Taxi Booking 2.0 - Cross Site Scripting	taxi booking script	6.1 (v3.1)	Medium
CVE-2023-41538	PHPJabbers PHP Forum Script 3.0 - Cross-Site Scripting	php forum script	6.1 (v3.1)	Medium
CVE-2023-41597	EyouCms v1.6.2 - Cross-Site Scripting	eyoucms	6.1 (v3.1)	Medium
CVE-2023-4174	mooSocial 3.1.6 - Reflected Cross Site Scripting	moostore	6.1 (v3.1)	Medium
CVE-2023-42343	OpenCMS - Cross-Site Scripting	opencms	6.1 (v3.1)	Medium
CVE-2023-44012	mojoPortal v.2.7.0.0 - Cross-Site Scripting	mojoportal	6.1 (v3.1)	Medium
CVE-2023-4547	SPA-Cart eCommerce CMS 1.9.0.3 - Cross-Site Scripting	ecommerce cms	6.1 (v3.1)	Medium
CVE-2023-45542	MooSocial 3.1.8 - Cross-Site Scripting	moosocial	6.1 (v3.1)	Medium
CVE-2023-46020	Blood Bank v1.0 - Stored Cross Site Scripting (XSS)	blood bank	6.1 (v3.1)	Medium
CVE-2023-46732	XWiki < 14.10.14 - Cross-Site Scripting	xwiki	6.1 (v3.1)	Medium
CVE-2023-48728	WWBN AVideo 11.6 - Cross-Site Scripting	avideo	6.1 (v3.1)	Medium
CVE-2023-49293	Vite dev server - Cross-Site Scripting	vite	6.1 (v3.1)	Medium
CVE-2023-5758	firefox mobile Cross-Site Scripting Vulnerability	firefox mobile	6.1 (v3.1)	Medium
CVE-2023-6275	TOTVS Fluig Platform - Cross-Site Scripting	fluig	6.1 (v3.1)	Medium
CVE-2023-6379	OpenCMS 14 & 15 - Cross Site Scripting	opencms	6.1 (v3.1)	Medium
CVE-2024-13727	MemberSpace WordPress - Cross-Site Scripting	memberspace	6.1 (v3.1)	Medium
CVE-2024-13853	WordPress SEO Tools Plugin 4.0.7 - Cross-Site Scripting	seo-automatic-seo-tools	6.1 (v3.1)	Medium
CVE-2024-28734	Coda v.2024Q1 - Cross-Site Scripting	Unit4 Financials by Coda prior to 2023Q4	6.1 (v3.1)	Medium
CVE-2024-3231	Popup4Phone <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting	popup4phone	6.1 (v3.1)	Medium
CVE-2024-41810	Twisted - Open Redirect & XSS	twisted	6.1 (v3.1)	Medium
CVE-2025-46349	YesWiki Reflected XSS via File Upload	yeswiki	6.1 (v3.1)	Medium
CVE-2025-47204	Bootstrap Multiselect <= 1.1.2 - Cross-Site Scripting	bootstrap multiselect	6.1 (v3.1)	Medium
CVE-2025-51501	Microweber CMS2.0 - Cross-Site Scripting	microweber	6.1 (v3.1)	Medium
CVE-2025-5301	ONLYOFFICE Docs (DocumentServer) - Reflected Cross-Site Scripting	Docs (DocumentServer)	6.1 (v3.1)	Medium
CVE-2025-54589	Copyparty <=1.18.6 - Cross-Site Scripting	copyparty	6.1 (v3.1)	Medium
CVE-2025-54597	Heimdall Application Dashboard < 2.7.3 - Reflected XSS	heimdall	6.1 (v3.1)	Medium
CVE-2025-63607	TechStore 1.0 Cross-Site Scripting Vulnerability	-	6.1 (v3.1)	Medium
CVE-2026-0594	WordPress List Site Contributors < 1.1.8 - Reflected XSS	List Site Contributors	6.1 (v3.1)	Medium
CVE-2026-11588	EONSR AEO Agent <= 3.7.9 - Unauthenticated Stored XSS via Scheduled Post Creation	EONSR AEO Agent	6.1 (v3.1)	Medium
CVE-2026-11881	Fluent Forms < 6.2.6 - Contributor+ Stored XSS via Date/Time Field	Fluent Forms	6.1 (v3.1)	Medium
CVE-2026-13330	Animation Addons for Elementor < 2.7.0 - Author+ Stored XSS via SVG Upload	Animation Addons for Elementor	6.1 (v3.1)	Medium
CVE-2026-13400	Simply Schedule Appointments < 1.6.12.4 - Unauthenticated Stored XSS via Booking Customer Information	Simply Schedule Appointments	6.1 (v3.1)	Medium
CVE-2026-26028	CryptPad: Sanitizer Bypass in Diffmarked.js Allows Arbitrary HTML Injection and Potential XSS	cryptpad	6.1 (v3.1)	Medium
CVE-2026-30251	zenshare suite Cross-Site Scripting Vulnerability	zenshare suite	6.1 (v3.1)	Medium
CVE-2026-30252	zencrm Cross-Site Scripting Vulnerability	zencrm	6.1 (v3.1)	Medium
CVE-2026-34229	Emlog: Stored XSS in Comment Module via URI Scheme Validation Bypass	emlog	6.1 (v3.1)	Medium
CVE-2026-34396	AVideo: Stored XSS via Unescaped Plugin Configuration Values in Admin Panel	avideo	6.1 (v3.1)	Medium
CVE-2026-34739	AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php	avideo	6.1 (v3.1)	Medium
CVE-2026-36324	SourceCodester Doctor Appointment System 1.0 Cross-Site Scripting Vulnerability	-	6.1 (v3.1)	Medium
CVE-2026-37750	School Management System by mahmoudai1 Cross-Site Scripting Vulnerability	School Management System by mahmoudai1	6.1 (v3.1)	Medium
CVE-2026-38432	erpnext Cross-Site Scripting Vulnerability	erpnext	6.1 (v3.1)	Medium
CVE-2026-38472	forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 Cross-Site Scripting Vulnerability	forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449	6.1 (v3.1)	Medium
CVE-2026-41580	Stirling-PDF: Reflected XSS through crafted PDF metadata fields (Title and Author)	stirling pdf	6.1 (v3.1)	Medium
CVE-2026-51565	Modules/Docs/DocsController.php in Milk admin <=0.9.8 Cross-Site Scripting Vulnerability	Modules/Docs/DocsController.php in Milk admin <=0.9.8	6.1 (v3.1)	Medium
CVE-2026-52475	aiflowy <= 2.1.2 Cross-Site Scripting Vulnerability	aiflowy <= 2.1.2	6.1 (v3.1)	Medium
CVE-2026-55087	Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (ope	etherpad	6.1 (v3.1)	Medium
CVE-2026-61526	AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler	http-server	6.1 (v3.1)	Medium
CVE-2026-75170	the /loginController/doLogin endpoint of the HubCore platform (version 14.1.1) Cross-Site Scripting Vulnerability	the /loginController/doLogin endpoint of the HubCore platform (version 14.1.1)	6.1 (v3.1)	Medium
CVE-2026-78742	Silverpeas Core <=6.4.6 Cross-Site Scripting Vulnerability	-	6.1 (v3.1)	Medium
CVE-2026-8447	Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untruste	langflow	6.1 (v3.1)	Medium
CVE-2023-6717	Keycloak: xss via assertion consumer service url in saml post-binding flow	Red Hat AMQ Broker 7	6.0 (v3.1)	Medium
CVE-2026-8245	Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection	concrete cms	6.0 (v4.0)	Medium
CVE-2026-63428	HeyForm: completeSubmission persists submitter-supplied hidden fields verbatim without validating against the form's dec	heyform	5.8 (v3.1)	Medium
CVE-2026-84193	LibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP	librenms	5.8 (v4.0)	Medium
CVE-2016-10993	ScoreMe Theme - Cross-Site Scripting	scoreme	5.4 (v3.1)	Medium
CVE-2016-9316	Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities	interscan web security virtual appliance	5.4 (v3.0)	Medium
CVE-2017-3131	Fortinet FortiOS < 5.6.0 - Cross-Site Scripting	fortios	5.4 (v3.0)	Medium
CVE-2018-15917	Jorani Leave Management System 0.6.5 - Cross-Site Scripting	jorani	5.4 (v3.0)	Medium
CVE-2018-6226	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	5.4 (v3.0)	Medium
CVE-2018-6227	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	5.4 (v3.0)	Medium
CVE-2018-8024	Apache Spark UI - Cross-Site Scripting	spark	5.4 (v3.0)	Medium
CVE-2020-12256	rConfig 3.9.4 - Cross-Site Scripting	rconfig	5.4 (v3.1)	Medium
CVE-2020-12259	rConfig 3.9.4 - Cross-Site Scripting	rconfig	5.4 (v3.1)	Medium
CVE-2020-20988	DomainMOD 4.13.0 - Cross-Site Scripting	domainmod	5.4 (v3.1)	Medium
CVE-2020-27533	DedeCMS v.5.8 - keyword Cross-Site Scripting	dedecms	5.4 (v3.1)	Medium
CVE-2020-35774	twitter-server Cross-Site Scripting	twitter-server	5.4 (v3.1)	Medium
CVE-2021-31250	CHIYU TCP/IP Converter - Cross-Site Scripting	bf-430 firmware	5.4 (v3.1)	Medium
CVE-2021-35956	AKCP sensorProbe SPX476 - 'Multiple' Cross-Site Scripting (XSS)	sensorprobe2 firmware	5.4 (v3.1)	Medium
CVE-2021-46005	Sourcecodester Car Rental Management System 1.0 - Stored Cross-Site Scripting	car rental management system	5.4 (v3.1)	Medium
CVE-2022-0928	Microweber < 1.2.12 - Stored Cross-Site Scripting	microweber	5.4 (v3.1)	Medium
CVE-2022-0954	Microweber <1.2.11 - Stored Cross-Site Scripting	microweber	5.4 (v3.1)	Medium
CVE-2023-34537	Hoteldruid 3.0.5 - Cross-Site Scripting	hoteldruid	5.4 (v3.1)	Medium
CVE-2023-38911	CSZ CMS 1.3.0 - Stored Cross-Site Scripting (Plugin 'Gallery')	csz cms	5.4 (v3.1)	Medium
CVE-2024-33724	SOPlanning 1.52.00 Cross Site Scripting	soplanning	5.4 (v3.1)	Medium
CVE-2024-52762	Ganglia Web Interface (v3.7.3 - v3.7.6) - Cross-Site Scripting	ganglia-web	5.4 (v3.1)	Medium
CVE-2026-11569	Quay: quay: stored xss via filedrop svg upload	Red Hat Quay 3	5.4 (v3.1)	Medium
CVE-2026-15245	BNE Testimonials < 2.0.8.2 - Contributor+ Stored XSS via Slider Shortcode	BNE Testimonials	5.4 (v3.1)	Medium
CVE-2026-16063	Event Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event Timeline Content	Event Booking Manager for WooCommerce	5.4 (v3.1)	Medium
CVE-2026-16537	Slick Slider < 0.5.3 - Contributor+ Stored XSS via Gallery Shortcode	Slick Slider	5.4 (v3.1)	Medium
CVE-2026-18395	Child Pages Card < 1.09 - Contributor+ Stored XSS via Shortcode Attributes	Child Pages Card	5.4 (v3.1)	Medium
CVE-2026-34848	hoppscotch: Stored XSS in team member overflow tooltip via display name	hoppscotch	5.4 (v3.1)	Medium
CVE-2026-34974	phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding leads to Stored XSS and Privilege Escalation	phpmyfaq	5.4 (v3.1)	Medium
CVE-2026-35403	LORIS has potential cross-site scripting in survey_accounts module	loris	5.4 (v3.1)	Medium
CVE-2026-38473	the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 Cross-Site Scripting Vulnerability	the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449	5.4 (v3.1)	Medium
CVE-2026-39380	Open Source Point of Sale has Stored XSS in Stock Location (Configuration)	open source point of sale	5.4 (v3.1)	Medium
CVE-2026-39964	TypeBot: Stored XSS via javascript: URI in text bubble links — bot author executes JS on visitors' browsers	typebot.io	5.4 (v3.1)	Medium
CVE-2026-45580	WWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute	avideo	5.4 (v3.1)	Medium
CVE-2026-45694	LibreNMS: Reflected XSS in the Proxmox app view via unsanitized instance/vmid parameters	librenms	5.4 (v3.1)	Medium
CVE-2026-72570	cube-root directory-serve - Stored Cross-Site Scripting via Malicious Filename	directory-serve	5.4 (v3.1)	Medium
CVE-2026-72583	fastschema - Stored Cross-Site Scripting via MIME Type Bypass in File Upload	fastschema	5.4 (v3.1)	Medium
CVE-2026-82396	Sulu: Stored XSS via media download inline-disposition override	sulu	5.4 (v3.1)	Medium
CVE-2026-9278	Form Builder CP < 1.2.47 - Editor+ Stored XSS via form_structure	Form Builder CP	5.4 (v3.1)	Medium
CVE-2023-30943	Moodle - Cross-Site Scripting/Remote Code Execution	moodle	5.3 (v3.1)	Medium
CVE-2024-9007	123Solar 1.8.4.5 - Cross-Site Scripting	123solar	5.3 (v4.0)	Medium
CVE-2025-2127	JoomlaUX JUX Real Estate 3.4.0 - Reflected XSS	jux real estate	5.3 (v4.0)	Medium
CVE-2025-2709	Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting	ufida erp-nc	5.3 (v4.0)	Medium
CVE-2025-2710	Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting	ufida erp-nc	5.3 (v4.0)	Medium
CVE-2025-2711	Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting	ufida erp-nc	5.3 (v4.0)	Medium
CVE-2025-2712	Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting	ufida erp-nc	5.3 (v4.0)	Medium
CVE-2026-41472	CyberPanel < 2.4.5 Stored XSS via AI Scanner Dashboard	cyberpanel	5.3 (v4.0)	Medium
CVE-2026-48094	ShareOpenly has Cross-Site Scripting (XSS) via Missing esc_url() on Shared URL in Content Output	shareopenly	5.3 (v4.0)	Medium
CVE-2026-5808	openstatusHQ openstatus Onboarding Endpoint client.tsx cross site scripting	openstatus	5.3 (v4.0)	Medium
CVE-2026-69116	FlyEnv < 4.18.0 Cross-Site Scripting via v-html	FlyEnv	5.3 (v4.0)	Medium
CVE-2026-73038	NodeBB < 4.15.0 Stored XSS via ActivityPub emoji tag.icon.url and tag.name	NodeBB	5.3 (v4.0)	Medium
CVE-2026-73422	Astro: Reflected XSS via unescaped View Transition animation properties	astro	5.3 (v4.0)	Medium
CVE-2026-73628	Serendipity 2.3.5 Reflected XSS via search clean-URL route	Serendipity	5.3 (v4.0)	Medium
CVE-2026-76837	Baserow before 2.3.0 Stored Cross-Site Scripting via Rich Text Mention Display Name	Baserow	5.3 (v4.0)	Medium
CVE-2026-82646	WWBN AVideo Unauthenticated Reflected XSS via url2Embed.json.php	AVideo	5.3 (v4.0)	Medium
CVE-2026-84191	LibreNMS before 26.5.0 Stored XSS via SNMP VRF fields	librenms	5.3 (v4.0)	Medium
CVE-2026-85158	AVideo Reflected XSS via videoEmbeded.php link parameter	AVideo	5.3 (v4.0)	Medium
CVE-2026-85159	AVideo Reflected XSS via cancelUri in userLogin.php	AVideo	5.3 (v4.0)	Medium
CVE-2018-25349	userSpice 4.3.24 Cross-Site Scripting via X-Forwarded-For Header	userSpice	5.1 (v4.0)	Medium
CVE-2021-47931	Exponent CMS 2.6 Multiple Vulnerabilities Stored XSS Authentication	Exponent CMS	5.1 (v4.0)	Medium
CVE-2022-50943	Moodle LMS 4.0 Cross-Site Scripting via course search.php	moodle	5.1 (v4.0)	Medium
CVE-2022-50962	uBidAuction 2.0.1 myOrders Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2022-50963	uBidAuction 2.0.1 myAuctions active Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2022-50964	uBidAuction 2.0.1 myAuctions loose Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2022-50965	uBidAuction 2.0.1 posts manage Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2022-50966	uBidAuction 2.0.1 news manage Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2022-50968	uBidAuction 2.0.1 auctions manage Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2022-50969	uBidAuction 2.0.1 mailingLog manage Reflected XSS	uBidAuction	5.1 (v4.0)	Medium
CVE-2026-19434	Stored Cross-site Scripting in Pentestify finding severity field	Pentestify	5.1 (v4.0)	Medium
CVE-2026-19716	Stored Cross-site Scripting in Pentestify user account deletion via unescaped username	Pentestify	5.1 (v4.0)	Medium
CVE-2026-22675	OCS Inventory NG Server Stored XSS via User-Agent	ocs inventory server	5.1 (v4.0)	Medium
CVE-2026-25557	Evoluted PHP Directory Listing Script 4.0.5 Reflected XSS via dir parameter	PHP Directory Listing Script	5.1 (v4.0)	Medium
CVE-2026-27176	MajorDoMo - Cross-Site Scripting	majordomo	5.1 (v4.0)	Medium
CVE-2026-34416	OSCAL-GUI Reflected XSS via project parameter in oscal.php	OSCAL-GUI	5.1 (v4.0)	Medium
CVE-2026-34417	OSCAL-GUI Reflected XSS via project parameter in oscal-forms.php	OSCAL-GUI	5.1 (v4.0)	Medium
CVE-2026-34798	Endian Firewall /cgi-bin/routing.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34799	Endian Firewall /manage/dnsmasq/hosts/ remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34801	Endian Firewall /manage/dhcp/fixed_leases/ remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34802	Endian Firewall /cgi-bin/salearn.cgi remark user ham spam Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34804	Endian Firewall /manage/qos/rules/ dscp Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34805	Endian Firewall /cgi-bin/dnat.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34806	Endian Firewall /cgi-bin/snat.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34807	Endian Firewall /cgi-bin/incoming.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34808	Endian Firewall /cgi-bin/outgoingfw.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34809	Endian Firewall /cgi-bin/zonefw.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34810	Endian Firewall /cgi-bin/vpnfw.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34811	Endian Firewall /cgi-bin/xtaccess.cgi remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34812	Endian Firewall /cgi-bin/proxypolicy.cgi mimetypes Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34813	Endian Firewall /cgi-bin/proxyuser.cgi user Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34814	Endian Firewall /cgi-bin/proxygroup.cgi group Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34815	Endian Firewall /cgi-bin/smtpdomains.cgi DOMAIN Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34816	Endian Firewall /manage/smtpscan/domainrouting/ domain Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34817	Endian Firewall /cgi-bin/smtprouting.cgi ADDRESS BCC Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34818	Endian Firewall /manage/dnsmasq/localdomains/ remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34819	Endian Firewall /cgi-bin/openvpnclient.cgi REMARK Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34820	Endian Firewall /manage/ipsec/ remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34821	Endian Firewall /manage/vpnauthentication/user/ remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34822	Endian Firewall /manage/ca/certificate/ new_cert_name Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-34823	Endian Firewall /manage/password/web/ remark Stored Cross-Site Scripting	firewall community	5.1 (v4.0)	Medium
CVE-2026-35007	Open ISES Tickets < 3.44.2 Reflected XSS via single_unit.php id Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35008	Open ISES Tickets < 3.44.2 Reflected XSS via single.php ticket_id Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35009	Open ISES Tickets < 3.44.2 Reflected XSS via add_note.php ticket_id Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35010	Open ISES Tickets < 3.44.2 Reflected XSS via patient_JF.php ticket_id Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35011	Open ISES Tickets < 3.44.2 Reflected XSS via opena.php frm_call Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35012	Open ISES Tickets < 3.44.2 Reflected XSS via add_facnote.php ticket_id Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35014	Open ISES Tickets < 3.44.2 Reflected XSS via routes_nm.php ticket_id Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35015	Open ISES Tickets < 3.44.2 Reflected XSS via do_unit_mail.php the_ticket Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-35016	Open ISES Tickets < 3.44.2 Reflected XSS via search.php frm_query Parameter	tickets	5.1 (v4.0)	Medium
CVE-2026-40508	OpenEMR < 8.3.0 Stored XSS via Patient Portal Template Import Handler	openemr	5.1 (v4.0)	Medium
CVE-2026-42840	ERPNext 16.16.0 - Stored XSS in POS customer section via unescaped template literals	ERPNext	5.1 (v4.0)	Medium
CVE-2026-45551	Group-Office: Authenticated Stored XSS in Administrator Context via Arbitrary Cross-User Setting Write	groupoffice	5.1 (v4.0)	Medium
CVE-2026-47106	Ellucian Banner Self-Service Stored XSS via getFacultyMeetingTimes API	Banner Self-Service	5.1 (v4.0)	Medium
CVE-2026-48214	Open ISES Tickets < 3.44.2 Reflected XSS via add_nm.php ticket_id Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48215	Open ISES Tickets < 3.44.2 Reflected XSS via circle.php frm_id Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48218	Open ISES Tickets < 3.44.2 Reflected XSS via icons/buttons/landb.php frm_name and frm_id Parameters	Tickets	5.1 (v4.0)	Medium
CVE-2026-48219	Open ISES Tickets < 3.44.2 Reflected XSS via ics202.php frm_add_str Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48220	Open ISES Tickets < 3.44.2 Reflected XSS via ics205.php frm_add_str Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48221	Open ISES Tickets < 3.44.2 Reflected XSS via ics205a.php frm_add_str Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48222	Open ISES Tickets < 3.44.2 Reflected XSS via ics213.php frm_add_str Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48223	Open ISES Tickets < 3.44.2 Reflected XSS via ics213rr.php frm_add_str Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48224	Open ISES Tickets < 3.44.2 Reflected XSS via ics214.php frm_add_str Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48225	Open ISES Tickets < 3.44.2 Reflected XSS via landb.php _type Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48226	Open ISES Tickets < 3.44.2 Reflected XSS via os_watch.php ref and mode_orig Parameters	Tickets	5.1 (v4.0)	Medium
CVE-2026-48227	Open ISES Tickets < 3.44.2 Reflected XSS via patient.php id and ticket_id Parameters	Tickets	5.1 (v4.0)	Medium
CVE-2026-48228	Open ISES Tickets < 3.44.2 Reflected XSS via patient_w.php id and ticket_id Parameters	Tickets	5.1 (v4.0)	Medium
CVE-2026-48229	Open ISES Tickets < 3.44.2 Reflected XSS via routes_i.php ticket_id Parameter	Tickets	5.1 (v4.0)	Medium
CVE-2026-48530	GFI Archiver < 15.13 Stored XSS via CategorizationPolicyWizard.aspx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48531	GFI Archiver < 15.13 Stored XSS via RetentionPolicyWizard.aspx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48532	GFI Archiver < 15.13 Stored XSS via FAARetentionPolicyWizard.aspx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48534	GFI Archiver < 15.13 Stored XSS via ImapServerWizard.aspx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48535	GFI Archiver < 15.13 Stored XSS via CallHomeSettingsWizard.aspx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48536	GFI Archiver < 15.13 Stored XSS via GeneralSettingsWizard.aspx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48537	GFI Archiver < 15.13 Stored XSS via FileArchiveAssistantWizard.aspx	GFI Archiver	5.1 (v4.0)	Medium
CVE-2026-48552	Nagios Core / XI DOM-based XSS via jsonquery.js	Nagios Core	5.1 (v4.0)	Medium
CVE-2026-48559	Lightweight Music Server 3.76.0 Stored XSS via Media File Metadata Tags	lms	5.1 (v4.0)	Medium
CVE-2026-50230	Lyrion Music Server <= 9.2.0 - Cross-Site Scripting	Lyrion Music Server	5.1 (v4.0)	Medium
CVE-2026-53992	Reflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date Parameters	ProjectSend	5.1 (v4.0)	Medium
CVE-2026-56126	pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php	pfSense Plus	5.1 (v4.0)	Medium
CVE-2026-64628	Grav Stored Cross-Site Scripting via Shortcode Attribute Handlers	grav	5.1 (v4.0)	Medium
CVE-2026-65697	Fathom Lite 1.3.1 Stored XSS via /collect Endpoint	fathom	5.1 (v4.0)	Medium
CVE-2026-66296	Reflected XSS in oaskit's default HTML error handler	oaskit	5.1 (v4.0)	Medium
CVE-2026-67333	better-auth before 1.6.13 Stored XSS via javascript redirect_uri	better-auth	5.1 (v4.0)	Medium
CVE-2026-68583	luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name	luci	5.1 (v4.0)	Medium
CVE-2026-71503	Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template	dolibarr	5.1 (v4.0)	Medium
CVE-2026-72747	AVideo Stored Cross-Site Scripting via Unauthenticated Registration	AVideo	5.1 (v4.0)	Medium
CVE-2026-72821	Grav Form Plugin before 9.1.15 Stored XSS via Radio Toggle	grav	5.1 (v4.0)	Medium
CVE-2026-73319	XenForo < 2.3.13 XSS via Dynamic Redirect Handler	XenForo	5.1 (v4.0)	Medium
CVE-2026-75831	Grav before 2.0.15 Stored XSS via audio/video source URL	grav	5.1 (v4.0)	Medium
CVE-2026-85593	phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode	phpMyFAQ	5.1 (v4.0)	Medium
CVE-2026-85600	Grav Admin before 2.0.21 Stored XSS via username	grav-plugin-admin2	5.1 (v4.0)	Medium
CVE-2026-86197	Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox	grav	5.1 (v4.0)	Medium
CVE-2012-5192	Bitweaver 2.8.1 - Multiple Vulnerabilities	bitweaver	5.0 (v2.0)	Medium
CVE-2019-19742	D-Link DIR-615 Wireless Router - Persistent Cross-Site Scripting	dir-615 firmware	4.8 (v3.1)	Medium
CVE-2021-46068	Vehicle Service Management System - Stored Cross-Site Scripting	vehicle service management system	4.8 (v3.1)	Medium
CVE-2021-46071	ehicle Service Management System 1.0 - Cross-Site Scripting	vehicle service management system	4.8 (v3.1)	Medium
CVE-2021-46072	Vehicle Service Management System 1.0 - Stored Cross Site Scripting	vehicle service management system	4.8 (v3.1)	Medium
CVE-2021-46073	Vehicle Service Management System 1.0 - Cross Site Scripting	vehicle service management system	4.8 (v3.1)	Medium
CVE-2023-0563	Bank Locker Management System - Cross-Site Scripting	bank locker management system	4.8 (v3.1)	Medium
CVE-2024-3822	Base64 Encoder/Decoder <= 0.9.2 - Reflected XSS	base64 encoderdecoder	4.8 (v3.1)	Medium
CVE-2026-39390	CI4MS has Stored XSS via srcdoc attribute bypass in Google Maps iframe setting	ci4ms	4.8 (v3.1)	Medium
CVE-2026-67612	OpenEMR 8.2.0 Stored XSS via import_template.php Template Management	openemr	4.8 (v4.0)	Medium
CVE-2026-67617	Microweber CMS 2.0.20 Stored XSS via tag_names Parameter	microweber	4.8 (v4.0)	Medium
CVE-2026-70560	Ultimate POS Stored XSS via First Name Field in Leave Notifications	Ultimate POS (Stock Management & Point of Sale)	4.8 (v4.0)	Medium
CVE-2026-79663	Ech0 before 4.7.3 Stored XSS via RSS feed tag names	Ech0	4.8 (v4.0)	Medium
CVE-2026-79670	Ech0 before 4.4.3 Stored XSS via SVG Upload	Ech0	4.8 (v4.0)	Medium
CVE-2026-84188	librenms before 26.7.0 Stored XSS via graph_descr settings	librenms	4.8 (v4.0)	Medium
CVE-2026-3093	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab	gitlab	4.7 (v3.1)	Medium
CVE-2026-16273	Narrative Publisher <= 1.0.7 - Contributor+ Stored XSS via narrative_post_script Post Meta	Narrative Publisher	4.6 (v3.1)	Medium
CVE-2026-75331	tamguo 1.5.3 Cross-Site Scripting Vulnerability	-	4.6 (v3.1)	Medium
CVE-2005-3128	SquirrelMail Address Add 1.4.2 - Cross-Site Scripting	address add plugin	4.3 (v2.0)	Medium
CVE-2005-4385	Cofax <=2.0RC3 - Cross-Site Scripting	cofax	4.3 (v2.0)	Medium
CVE-2009-1872	Adobe Coldfusion <=8.0.1 - Cross-Site Scripting	coldfusion	4.3 (v2.0)	Medium
CVE-2011-4624	GRAND FlAGallery 1.57 - Cross-Site Scripting	grand flagallery	4.3 (v2.0)	Medium
CVE-2011-5106	WordPress Plugin Flexible Custom Post Type < 0.1.7 - Cross-Site Scripting	flexible custom post type	4.3 (v2.0)	Medium
CVE-2011-5265	Featurific For WordPress 1.6.2 - Cross-Site Scripting	featurific-for-wordpress	4.3 (v2.0)	Medium
CVE-2012-2371	WP-FaceThumb 0.1 - Cross-Site Scripting	wp-facethumb	4.3 (v2.0)	Medium
CVE-2012-4242	WordPress Plugin MF Gig Calendar 0.9.2 - Cross-Site Scripting	mf gig calendar	4.3 (v2.0)	Medium
CVE-2012-4273	2 Click Socialmedia Buttons < 0.34 - Cross-Site Scripting	2-click-social-media-buttons	4.3 (v2.0)	Medium
CVE-2012-4768	WordPress Plugin Download Monitor < 3.3.5.9 - Cross-Site Scripting	download monitor	4.3 (v2.0)	Medium
CVE-2012-4889	ManageEngine Firewall Analyzer 7.2 - Cross-Site Scripting	firewall analyzer	4.3 (v2.0)	Medium
CVE-2012-5913	WordPress Integrator 1.32 - Cross-Site Scripting	wordpress integrator	4.3 (v2.0)	Medium
CVE-2013-4117	WordPress Plugin Category Grid View Gallery 2.3.1 - Cross-Site Scripting	category-grid-view-gallery	4.3 (v2.0)	Medium
CVE-2013-4625	WordPress Plugin Duplicator < 0.4.5 - Cross-Site Scripting	duplicator	4.3 (v2.0)	Medium
CVE-2014-2908	Siemens SIMATIC S7-1200 CPU - Cross-Site Scripting	simatic s7 cpu 1200 firmware	4.3 (v2.0)	Medium
CVE-2014-9094	WordPress DZS-VideoGallery Plugin Cross-Site Scripting	video gallery	4.3 (v2.0)	Medium
CVE-2014-9444	Frontend Uploader <= 0.9.2 - Cross-Site Scripting	frontend uploader	4.3 (v2.0)	Medium
CVE-2015-1389	Aruba ClearPass Policy Manager - Persistent Cross-Site Scripting	clearpass policy manager	4.3 (v2.0)	Medium
CVE-2015-1880	Fortinet FortiOS <=5.2.3 - Cross-Site Scripting	fortios	4.3 (v2.0)	Medium
CVE-2015-2807	Navis DocumentCloud <0.1.1 - Cross-Site Scripting	navis documentcloud	4.3 (v2.0)	Medium
CVE-2015-4127	WordPress Church Admin <0.810 - Cross-Site Scripting	church admin	4.3 (v2.0)	Medium
CVE-2015-6920	WordPress sourceAFRICA <=0.1.3 - Cross-Site Scripting	sourceafrica	4.3 (v2.0)	Medium
CVE-2018-6225	Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities	email encryption gateway	4.3 (v3.0)	Medium
CVE-2024-34061	Changedetection.io <=v0.45.21 - Cross-Site Scripting	changedetection.io	4.3 (v3.1)	Medium
CVE-2024-4348	osCommerce v4.0 - Cross-site Scripting	oscommerce	4.3 (v3.1)	Medium
CVE-2025-41228	VMware vSphere Client 8.0.3.0 - Reflected Cross-Site Scripting (XSS)	vCenter Server	4.3 (v3.1)	Medium
CVE-2026-12724	Kirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-password	Kirki	4.3 (v3.1)	Medium
CVE-2026-32250	NamelessMC has Reflected Cross-Site Scripting (XSS) in id parameter of /index.php?route=/queries/user/	Nameless	4.3 (v3.1)	Medium
CVE-2026-55566	Yamcs: DOM XSS in Extension Routing	yamcs	4.3 (v3.1)	Medium
CVE-2026-17011	Nexter Blocks < 5.0.2 - Contributor+ Stored CSS Injection	Nexter Blocks	3.8 (v3.1)	Low
CVE-2026-10827	Spectra (Ultimate Addons for Gutenberg) < 2.20.0 - Contributor+ Stored CSS Injection via Block Attributes	Spectra Legacy	3.5 (v3.1)	Low
CVE-2024-55550	Mitel MiCollab - Arbitary File Read	cmg suite	2.7 (v3.1)	Low
CVE-2025-0133	PAN-OS - Reflected Cross-Site Scripting	PAN-OS	2.7 (v4.0)	Low
CVE-2026-66300	SNOMED International Snowstorm reflected XSS	Snowstorm	2.3 (v4.0)	Low
CVE-2026-10153	westboy CicadasCMS AbstractCacheManager.java search cross site scripting	CicadasCMS	2.1 (v4.0)	Low
CVE-2026-10173	Orthanc Explorer 2 URL StudyList.vue cross site scripting	Explorer 2	2.1 (v4.0)	Low
CVE-2026-10289	code-projects Hotel and Tourism Reservation System tour.php cross site scripting	Hotel and Tourism Reservation System	2.1 (v4.0)	Low
CVE-2026-11436	Mage AI Sign-in Flow index.tsx useMutation cross site scripting	Mage AI	2.1 (v4.0)	Low
CVE-2026-11512	itsourcecode Hospital Management System billing.php cross site scripting	Hospital Management System	2.1 (v4.0)	Low
CVE-2026-11518	SourceCodester Inventory System User Management users.php cross site scripting	Inventory System	2.1 (v4.0)	Low
CVE-2026-16220	code-projects Online Examination System account.php cross site scripting	Online Examination System	2.1 (v4.0)	Low
CVE-2026-16485	SourceCodester Class and Exam Timetabling System class.php cross site scripting	Class and Exam Timetabling System	2.1 (v4.0)	Low
CVE-2026-16486	SourceCodester Class and Exam Timetabling System BSIS.php cross site scripting	Class and Exam Timetabling System	2.1 (v4.0)	Low
CVE-2026-19378	code-projects Task Management System CommentSave.php cross site scripting	Task Management System	2.1 (v4.0)	Low
CVE-2026-5825	code-projects Simple Laundry System delmemberinfo.php cross site scripting	Simple Laundry System	2.1 (v4.0)	Low
CVE-2026-5826	code-projects Simple IT Discussion Forum edit-category.php cross site scripting	Simple IT Discussion Forum	2.1 (v4.0)	Low
CVE-2026-59727	Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands	astro	2.1 (v4.0)	Low
CVE-2026-66882	Reflected XSS in AshAuthentication confirmation and magic link interaction forms	ash authentication	2.1 (v4.0)	Low
CVE-2026-75077	SourceCodester Class and Exam Timetabling System BSCE2.php cross site scripting	Class and Exam Timetabling System	2.1 (v4.0)	Low
CVE-2026-75078	SourceCodester Class and Exam Timetabling System BSHRM1.php cross site scripting	Class and Exam Timetabling System	2.1 (v4.0)	Low
CVE-2026-78054	SourceCodester Class and Exam Timetabling System BSIS1.php cross site scripting	Class and Exam Timetabling System	2.1 (v4.0)	Low
CVE-2026-78055	SourceCodester Class and Exam Timetabling System BSIT2.php cross site scripting	Class and Exam Timetabling System	2.1 (v4.0)	Low
CVE-2026-78059	SourceCodester Stock Management System printOrder.php cross site scripting	Stock Management System	2.1 (v4.0)	Low
CVE-2026-78060	SourceCodester Stock Management System getOrderReport.php cross site scripting	Stock Management System	2.1 (v4.0)	Low
CVE-2026-79793	code-projects Online Shopping System sumit_form.php cross site scripting	Online Shopping System	2.1 (v4.0)	Low
CVE-2026-82625	code-projects Simple Inventory System User Registration register.php cross site scripting	Simple Inventory System	2.1 (v4.0)	Low
CVE-2026-82664	yaojingang GEOFlow JSON-LD Theme HomeController.php cross site scripting	GEOFlow	2.1 (v4.0)	Low
CVE-2026-85021	langgenius dify Splash Layout splash.tsx router.replace cross site scripting	dify	2.1 (v4.0)	Low
CVE-2026-86216	code-projects Hotel and Tourism Reservation in PHP details.php cross site scripting	Hotel and Tourism Reservation in PHP	2.1 (v4.0)	Low
CVE-2026-86244	FastAdmin User Controller User.php login cross site scripting	FastAdmin	2.1 (v4.0)	Low
CVE-2026-86668	aircheng-org iWebShop-5 pic.php uploadFile cross site scripting	iWebShop-5	2.1 (v4.0)	Low
CVE-2026-9415	code-projects Employee Management System eloginwel.php cross site scripting	Employee Management System	2.1 (v4.0)	Low
CVE-2026-9416	code-projects Employee Management System myprofile.php cross site scripting	Employee Management System	2.1 (v4.0)	Low
CVE-2026-9417	code-projects Employee Management System myprofileup.php cross site scripting	Employee Management System	2.1 (v4.0)	Low
CVE-2026-9418	code-projects Employee Management System changepassemp.php cross site scripting	Employee Management System	2.1 (v4.0)	Low
CVE-2026-9419	code-projects Employee Management System empproject.php cross site scripting	Employee Management System	2.1 (v4.0)	Low
CVE-2026-9448	code-projects Employee Management System applyleave.php cross site scripting	Employee Management System	2.1 (v4.0)	Low
CVE-2026-9518	hemant6488 CodeIgniter-StudentManagementSystem Students Controller view_students.php addStudent cross site scripting	CodeIgniter-StudentManagementSystem	2.1 (v4.0)	Low
CVE-2026-9519	stonith404 pingvin-share Sign-in Auto-Redirect signIn.tsx getServerSideProps cross site scripting	pingvin-share	2.1 (v4.0)	Low
CVE-2026-9527	itsourcecode Electronic Judging System judges.php cross site scripting	Electronic Judging System	2.1 (v4.0)	Low
CVE-2026-9566	teableio teable Sign-up LoginPage.tsx cross site scripting	teable	2.1 (v4.0)	Low
CVE-2026-10228	raisulislamg4 student_management_system_by_php admission_form_check.php cross site scripting	student management system by php	2.0 (v4.0)	Low
CVE-2026-10234	Mettle sendportal Campaign webview cross site scripting	sendportal	2.0 (v4.0)	Low
CVE-2026-10244	SourceCodester Pharmacy Sales and Inventory System main create_medicine_name cross site scripting	Pharmacy Sales and Inventory System	2.0 (v4.0)	Low
CVE-2026-10245	SourceCodester Pharmacy Sales and Inventory System main create_supplier cross site scripting	Pharmacy Sales and Inventory System	2.0 (v4.0)	Low
CVE-2026-10246	SourceCodester Pharmacy Sales and Inventory System main create_medicine_presentation cross site scripting	Pharmacy Sales and Inventory System	2.0 (v4.0)	Low
CVE-2026-10247	SourceCodester Pharmacy Sales and Inventory System main create_generic_name cross site scripting	Pharmacy Sales and Inventory System	2.0 (v4.0)	Low
CVE-2026-16155	SourceCodester Class and Exam Timetabling System schoolyr.php cross site scripting	Class and Exam Timetabling System	2.0 (v4.0)	Low
CVE-2026-16156	SourceCodester Class and Exam Timetabling System forexam.php cross site scripting	Class and Exam Timetabling System	2.0 (v4.0)	Low
CVE-2026-16202	SourceCodester Class and Exam Timetabling System CYS.php cross site scripting	Class and Exam Timetabling System	2.0 (v4.0)	Low
CVE-2026-16203	SourceCodester Class and Exam Timetabling System forCYS.php cross site scripting	Class and Exam Timetabling System	2.0 (v4.0)	Low
CVE-2026-19209	SourceCodester Photo Share Website index.php home cross site scripting	Photo Share Website	2.0 (v4.0)	Low
CVE-2026-19922	code-projects Online Shopping System checkout.php cross site scripting	Online Shopping System	2.0 (v4.0)	Low
CVE-2026-5810	SourceCodester Sales and Inventory System GET Parameter delete.php cross site scripting	Sales and Inventory System	2.0 (v4.0)	Low
CVE-2026-7222	code-projects Coaching Management System Complaint Form complaint.php cross site scripting	Coaching Management System	2.0 (v4.0)	Low
CVE-2026-8139	Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName	concrete cms	2.0 (v4.0)	Low
CVE-2026-82483	coppermine-gallery Coppermine Photo Gallery Hidden Album Update Endpoint db_input.php cross site scripting	Coppermine Photo Gallery	2.0 (v4.0)	Low
CVE-2026-82488	Beetel 450TC3 User Management cross site scripting	450TC3	2.0 (v4.0)	Low
CVE-2026-82665	yaojingang GEOFlow Image Library Cleanup ImageLibraryController.php unlink path traversal	GEOFlow	2.0 (v4.0)	Low
CVE-2026-82666	yaojingang GEOFlow Superadmin Theme Editor SiteThemeEditorController.php preview code injection	GEOFlow	2.0 (v4.0)	Low
CVE-2026-82667	yaojingang GEOFlow GenericHttpEndpointResolver.php DistributionController.isValidHttpEndpoint server-side request forger	GEOFlow	2.0 (v4.0)	Low
CVE-2026-84437	OpenCart Autocomplete Workflow address.php cross site scripting	OpenCart	2.0 (v4.0)	Low
CVE-2026-84438	OpenCart Autocomplete Workflow edit.php cross site scripting	OpenCart	2.0 (v4.0)	Low
CVE-2026-85022	langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting	dify	2.0 (v4.0)	Low
CVE-2026-85207	itsourcecode Online Medicine Delivery System index.php cross site scripting	Online Medicine Delivery System	2.0 (v4.0)	Low
CVE-2026-86181	code-projects Task Management System User Profile Update UpdateUserProfile.php cross site scripting	Task Management System	2.0 (v4.0)	Low
CVE-2026-86301	code-projects Hospital Information System Patient Management editPatient.php cross site scripting	Hospital Information System	2.0 (v4.0)	Low
CVE-2026-86644	star7th showdoc API Page Save Endpoint editormd.js cross site scripting	showdoc	2.0 (v4.0)	Low
CVE-2026-10529	westboy CicadasCMS Task Scheduling Management ScheduleJobController.java cross site scripting	CicadasCMS	1.9 (v4.0)	Low
CVE-2026-11468	SourceCodester Hospitals Patient Records Management System page room_types cross site scripting	Hospitals Patient Records Management System	1.9 (v4.0)	Low
CVE-2026-16205	Pluck CMS Albums albums.admin.php htmlspecialchars_decode cross site scripting	CMS	1.9 (v4.0)	Low
CVE-2026-19110	DataGear Chart Name HtmlTplDashboardWidgetHtmlRenderer.java HtmlTplDashboardWidgetHtmlRenderer cross site scripting	DataGear	1.9 (v4.0)	Low
CVE-2026-19207	PHPGurukul Company Visitor Management System manage-newvisitors.php cross site scripting	Company Visitor Management System	1.9 (v4.0)	Low
CVE-2026-9564	SourceCodester/oretnom23 Hospitals Patient Records Management System view_patient cross site scripting	Hospitals Patient Records Management System	1.9 (v4.0)	Low
CVE-2026-78187	Piwigo Public Authentication cross site scripting	Piwigo	1.3 (v4.0)	Low
CVE-2026-78849	Netgate pfSense Plus software versions <= 26.03 pfSense CE software versions <= 2.8.1 Arbitrary Code Execution Vulnerability	Netgate pfSense Plus software versions <= 26.03 pfSense CE software versions <= 2.8.1	N/A	N/A

Observed CWEs

These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.

CWE	Related Published CVEs
CWE-20	CVE-2026-54694 , CVE-2019-1936 , CVE-2026-63428
CWE-22	CVE-2012-5192 , CVE-2024-55550 , CVE-2026-82665
CWE-73	CVE-2023-30943
CWE-74	CVE-2018-6220 , CVE-2026-82666
CWE-78	CVE-2026-69096 , CVE-2018-6222
CWE-79	CVE-2020-20982 , CVE-2021-32853 , CVE-2023-1892 , CVE-2026-54694 , CVE-2026-55085 , CVE-2026-73043 , CVE-2026-73044 , CVE-2026-73050 , CVE-2026-73052 , CVE-2026-73053 , CVE-2026-42849 , CVE-2026-66394 , CVE-2026-66418 , CVE-2026-74902 , CVE-2026-78997 , CVE-2026-84189 , CVE-2019-7671 , CVE-2023-34192 , CVE-2026-34448 , CVE-2026-35198 , CVE-2026-42556 , CVE-2026-43984 , CVE-2018-15884 , CVE-2026-12968 , CVE-2026-12496 , CVE-2026-15217 , CVE-2026-44667 , CVE-2026-44729 , CVE-2026-45115 , CVE-2026-46518 , CVE-2026-47665 , CVE-2026-48026 , CVE-2026-53758 , CVE-2026-54347 , CVE-2026-34463 , CVE-2026-49864 , CVE-2026-34932 , CVE-2026-58113 , CVE-2026-63361 , CVE-2026-64851 , CVE-2026-65986 , CVE-2026-15973 , CVE-2026-5385 , CVE-2026-77072 , CVE-2026-85613 , CVE-2026-87814 , CVE-2024-5420 , CVE-2026-34725 , CVE-2026-56670 , CVE-2026-39344 , CVE-2026-48060 , CVE-2026-50758 , CVE-2026-16969 , CVE-2026-18360 , CVE-2026-18361 , CVE-2026-44657 , CVE-2026-7460 , CVE-2026-87812 , CVE-2026-30819 , CVE-2026-6735 , CVE-2026-8203 , CVE-2026-18756 , CVE-2022-35499 , CVE-2024-41357 , CVE-2026-12970 , CVE-2026-34598 , CVE-2026-6858 , CVE-2026-84192 , CVE-2026-55746 , CVE-2026-58411 , CVE-2025-4388 , CVE-2025-4576 , CVE-2026-39838 , CVE-2026-39936 , CVE-2026-40598 , CVE-2026-44651 , CVE-2026-59238 , CVE-2026-69092 , CVE-2026-73848 , CVE-2026-86188 , CVE-2026-15047 , CVE-2026-16559 , CVE-2026-33741 , CVE-2026-67352 , CVE-2026-55549 , CVE-2026-78838 , CVE-2026-0737 , CVE-2026-3885 , CVE-2026-45797 , CVE-2026-43980 , CVE-2012-1260 , CVE-2012-1261 , CVE-2012-5193 , CVE-2014-4535 , CVE-2014-4536 , CVE-2014-4539 , CVE-2014-4544 , CVE-2014-4558 , CVE-2014-4561 , CVE-2014-9607 , CVE-2015-6477 , CVE-2015-8349 , CVE-2015-9414 , CVE-2016-1000126 , CVE-2016-1000127 , CVE-2016-1000128 , CVE-2016-1000129 , CVE-2016-1000130 , CVE-2016-1000132 , CVE-2016-1000133 , CVE-2016-1000134 , CVE-2016-1000135 , CVE-2016-1000136 , CVE-2016-1000137 , CVE-2016-1000138 , CVE-2016-1000142 , CVE-2016-1000143 , CVE-2016-1000146 , CVE-2016-1000153 , CVE-2016-1000154 , CVE-2016-8527 , CVE-2017-17059 , CVE-2017-18536 , CVE-2017-3132 , CVE-2017-3133 , CVE-2017-5631 , CVE-2017-7855 , CVE-2017-9288 , CVE-2018-10230 , CVE-2018-10383 , CVE-2018-11709 , CVE-2018-12998 , CVE-2018-14013 , CVE-2018-16139 , CVE-2018-16833 , CVE-2018-17310 , CVE-2018-17313 , CVE-2018-20503 , CVE-2018-5715 , CVE-2018-6882 , CVE-2018-7196 , CVE-2018-8006 , CVE-2018-9238 , CVE-2019-1010287 , CVE-2019-10475 , CVE-2019-11844 , CVE-2019-11845 , CVE-2019-12461 , CVE-2019-13392 , CVE-2019-14696 , CVE-2019-15501 , CVE-2019-15713 , CVE-2019-15889 , CVE-2019-16332 , CVE-2019-16525 , CVE-2019-19368 , CVE-2019-19908 , CVE-2019-20141 , CVE-2019-20210 , CVE-2019-3911 , CVE-2019-6112 , CVE-2019-7219 , CVE-2019-7438 , CVE-2019-8390 , CVE-2019-8937 , CVE-2020-1106 , CVE-2020-13258 , CVE-2020-14413 , CVE-2020-15500 , CVE-2020-17362 , CVE-2020-19283 , CVE-2020-23517 , CVE-2020-27982 , CVE-2020-3580 , CVE-2020-6171 , CVE-2020-7107 , CVE-2020-8191 , CVE-2020-9344 , CVE-2021-21799 , CVE-2021-21800 , CVE-2021-24298 , CVE-2021-24316 , CVE-2021-24320 , CVE-2021-24335 , CVE-2021-24342 , CVE-2021-24389 , CVE-2021-24495 , CVE-2021-24498 , CVE-2021-26247 , CVE-2021-26475 , CVE-2021-26710 , CVE-2021-26723 , CVE-2021-27309 , CVE-2021-27310 , CVE-2021-30049 , CVE-2021-30213 , CVE-2021-31682 , CVE-2021-34630 , CVE-2021-36450 , CVE-2021-36646 , CVE-2021-37833 , CVE-2021-38702 , CVE-2021-38704 , CVE-2021-40868 , CVE-2021-41467 , CVE-2021-42565 , CVE-2021-45380 , CVE-2021-45422 , CVE-2021-45425 , CVE-2021-46387 , CVE-2022-0208 , CVE-2022-0678 , CVE-2022-1170 , CVE-2022-1221 , CVE-2022-2130 , CVE-2022-2174 , CVE-2022-24384 , CVE-2022-26564 , CVE-2022-27926 , CVE-2022-28363 , CVE-2022-28508 , CVE-2022-30489 , CVE-2022-30777 , CVE-2022-3242 , CVE-2022-32770 , CVE-2022-32771 , CVE-2022-34328 , CVE-2022-35493 , CVE-2022-35653 , CVE-2022-38295 , CVE-2022-38553 , CVE-2022-41441 , CVE-2022-46073 , CVE-2022-46381 , CVE-2022-46888 , CVE-2022-48197 , CVE-2023-1880 , CVE-2023-24657 , CVE-2023-25346 , CVE-2023-27641 , CVE-2023-2822 , CVE-2023-30212 , CVE-2023-34599 , CVE-2023-3479 , CVE-2023-3521 , CVE-2023-36306 , CVE-2023-37580 , CVE-2023-38194 , CVE-2023-38875 , CVE-2023-38910 , CVE-2023-38964 , CVE-2023-39598 , CVE-2023-4110 , CVE-2023-4111 , CVE-2023-4113 , CVE-2023-4114 , CVE-2023-4115 , CVE-2023-4116 , CVE-2023-41538 , CVE-2023-41597 , CVE-2023-4174 , CVE-2023-42343 , CVE-2023-44012 , CVE-2023-4547 , CVE-2023-45542 , CVE-2023-46020 , CVE-2023-46732 , CVE-2023-48728 , CVE-2023-49293 , CVE-2023-5758 , CVE-2023-6275 , CVE-2023-6379 , CVE-2024-13727 , CVE-2024-13853 , CVE-2024-28734 , CVE-2024-3231 , CVE-2024-41810 , CVE-2025-46349 , CVE-2025-51501 , CVE-2025-5301 , CVE-2025-54589 , CVE-2025-54597 , CVE-2025-63607 , CVE-2026-0594 , CVE-2026-11588 , CVE-2026-11881 , CVE-2026-13330 , CVE-2026-13400 , CVE-2026-26028 , CVE-2026-30251 , CVE-2026-30252 , CVE-2026-34229 , CVE-2026-34396 , CVE-2026-34739 , CVE-2026-36324 , CVE-2026-37750 , CVE-2026-38432 , CVE-2026-38472 , CVE-2026-41580 , CVE-2026-51565 , CVE-2026-52475 , CVE-2026-55087 , CVE-2026-61526 , CVE-2026-75170 , CVE-2026-78742 , CVE-2026-8447 , CVE-2023-6717 , CVE-2026-84193 , CVE-2016-10993 , CVE-2016-9316 , CVE-2017-3131 , CVE-2018-15917 , CVE-2018-6226 , CVE-2018-6227 , CVE-2020-12256 , CVE-2020-12259 , CVE-2020-20988 , CVE-2020-27533 , CVE-2020-35774 , CVE-2021-31250 , CVE-2021-35956 , CVE-2021-46005 , CVE-2022-0928 , CVE-2022-0954 , CVE-2023-34537 , CVE-2023-38911 , CVE-2024-33724 , CVE-2024-52762 , CVE-2026-11569 , CVE-2026-15245 , CVE-2026-16063 , CVE-2026-16537 , CVE-2026-18395 , CVE-2026-34848 , CVE-2026-34974 , CVE-2026-35403 , CVE-2026-38473 , CVE-2026-39380 , CVE-2026-39964 , CVE-2026-45580 , CVE-2026-45694 , CVE-2026-72570 , CVE-2026-72583 , CVE-2026-82396 , CVE-2024-9007 , CVE-2025-2127 , CVE-2025-2709 , CVE-2025-2710 , CVE-2025-2711 , CVE-2025-2712 , CVE-2026-41472 , CVE-2026-48094 , CVE-2026-5808 , CVE-2026-69116 , CVE-2026-73038 , CVE-2026-73422 , CVE-2026-73628 , CVE-2026-76837 , CVE-2026-82646 , CVE-2026-84191 , CVE-2026-85158 , CVE-2026-85159 , CVE-2018-25349 , CVE-2021-47931 , CVE-2022-50943 , CVE-2022-50962 , CVE-2022-50963 , CVE-2022-50964 , CVE-2022-50965 , CVE-2022-50966 , CVE-2022-50968 , CVE-2022-50969 , CVE-2026-19434 , CVE-2026-19716 , CVE-2026-22675 , CVE-2026-25557 , CVE-2026-27176 , CVE-2026-34416 , CVE-2026-34417 , CVE-2026-34798 , CVE-2026-34799 , CVE-2026-34801 , CVE-2026-34802 , CVE-2026-34804 , CVE-2026-34805 , CVE-2026-34806 , CVE-2026-34807 , CVE-2026-34808 , CVE-2026-34809 , CVE-2026-34810 , CVE-2026-34811 , CVE-2026-34812 , CVE-2026-34813 , CVE-2026-34814 , CVE-2026-34815 , CVE-2026-34816 , CVE-2026-34817 , CVE-2026-34818 , CVE-2026-34819 , CVE-2026-34820 , CVE-2026-34821 , CVE-2026-34822 , CVE-2026-34823 , CVE-2026-35007 , CVE-2026-35008 , CVE-2026-35009 , CVE-2026-35010 , CVE-2026-35011 , CVE-2026-35012 , CVE-2026-35014 , CVE-2026-35015 , CVE-2026-35016 , CVE-2026-40508 , CVE-2026-42840 , CVE-2026-45551 , CVE-2026-47106 , CVE-2026-48214 , CVE-2026-48215 , CVE-2026-48218 , CVE-2026-48219 , CVE-2026-48220 , CVE-2026-48221 , CVE-2026-48222 , CVE-2026-48223 , CVE-2026-48224 , CVE-2026-48225 , CVE-2026-48226 , CVE-2026-48227 , CVE-2026-48228 , CVE-2026-48229 , CVE-2026-48530 , CVE-2026-48531 , CVE-2026-48532 , CVE-2026-48534 , CVE-2026-48535 , CVE-2026-48536 , CVE-2026-48537 , CVE-2026-48552 , CVE-2026-48559 , CVE-2026-50230 , CVE-2026-53992 , CVE-2026-56126 , CVE-2026-64628 , CVE-2026-65697 , CVE-2026-66296 , CVE-2026-67333 , CVE-2026-68583 , CVE-2026-71503 , CVE-2026-72747 , CVE-2026-72821 , CVE-2026-73319 , CVE-2026-75831 , CVE-2026-85593 , CVE-2026-85600 , CVE-2026-86197 , CVE-2019-19742 , CVE-2021-46068 , CVE-2021-46071 , CVE-2021-46072 , CVE-2021-46073 , CVE-2023-0563 , CVE-2024-3822 , CVE-2026-39390 , CVE-2026-67612 , CVE-2026-67617 , CVE-2026-70560 , CVE-2026-79663 , CVE-2026-84188 , CVE-2026-3093 , CVE-2026-16273 , CVE-2009-1872 , CVE-2011-4624 , CVE-2011-5106 , CVE-2011-5265 , CVE-2012-2371 , CVE-2012-4242 , CVE-2012-4273 , CVE-2012-4768 , CVE-2012-4889 , CVE-2012-5913 , CVE-2013-4117 , CVE-2013-4625 , CVE-2014-2908 , CVE-2014-9094 , CVE-2014-9444 , CVE-2015-1389 , CVE-2015-1880 , CVE-2015-2807 , CVE-2015-4127 , CVE-2015-6920 , CVE-2024-34061 , CVE-2024-4348 , CVE-2025-41228 , CVE-2026-32250 , CVE-2026-55566 , CVE-2025-0133 , CVE-2026-66300 , CVE-2026-10153 , CVE-2026-10173 , CVE-2026-10289 , CVE-2026-11436 , CVE-2026-11512 , CVE-2026-11518 , CVE-2026-16220 , CVE-2026-16485 , CVE-2026-16486 , CVE-2026-19378 , CVE-2026-5825 , CVE-2026-5826 , CVE-2026-59727 , CVE-2026-66882 , CVE-2026-75077 , CVE-2026-75078 , CVE-2026-78054 , CVE-2026-78055 , CVE-2026-78059 , CVE-2026-78060 , CVE-2026-79793 , CVE-2026-82625 , CVE-2026-82664 , CVE-2026-85021 , CVE-2026-86216 , CVE-2026-86244 , CVE-2026-86668 , CVE-2026-9415 , CVE-2026-9416 , CVE-2026-9417 , CVE-2026-9418 , CVE-2026-9419 , CVE-2026-9448 , CVE-2026-9518 , CVE-2026-9519 , CVE-2026-9527 , CVE-2026-9566 , CVE-2026-10228 , CVE-2026-10234 , CVE-2026-10244 , CVE-2026-10245 , CVE-2026-10246 , CVE-2026-10247 , CVE-2026-16155 , CVE-2026-16156 , CVE-2026-16202 , CVE-2026-16203 , CVE-2026-19209 , CVE-2026-19922 , CVE-2026-5810 , CVE-2026-7222 , CVE-2026-8139 , CVE-2026-82483 , CVE-2026-82488 , CVE-2026-84437 , CVE-2026-84438 , CVE-2026-85022 , CVE-2026-85207 , CVE-2026-86181 , CVE-2026-86301 , CVE-2026-86644 , CVE-2026-10529 , CVE-2026-11468 , CVE-2026-16205 , CVE-2026-19110 , CVE-2026-19207 , CVE-2026-9564 , CVE-2026-78187
CWE-80	CVE-2024-58355 , CVE-2026-39344 , CVE-2026-40105 , CVE-2024-41810 , CVE-2025-54589
CWE-83	CVE-2026-45118 , CVE-2026-8245 , CVE-2026-59727
CWE-87	CVE-2026-34598
CWE-89	CVE-2012-1259 , CVE-2018-6228 , CVE-2018-6229 , CVE-2021-42325 , CVE-2014-5308 , CVE-2015-1518 , CVE-2018-6230
CWE-94	CVE-2026-53753 , CVE-2026-34448 , CVE-2026-34725 , CVE-2014-6389 , CVE-2022-3242 , CVE-2025-2127 , CVE-2025-2709 , CVE-2025-2710 , CVE-2025-2711 , CVE-2025-2712 , CVE-2026-5808 , CVE-2026-10153 , CVE-2026-10173 , CVE-2026-10289 , CVE-2026-11436 , CVE-2026-11512 , CVE-2026-11518 , CVE-2026-16220 , CVE-2026-16485 , CVE-2026-16486 , CVE-2026-19378 , CVE-2026-5825 , CVE-2026-5826 , CVE-2026-75077 , CVE-2026-75078 , CVE-2026-78054 , CVE-2026-78055 , CVE-2026-78059 , CVE-2026-78060 , CVE-2026-79793 , CVE-2026-82625 , CVE-2026-82664 , CVE-2026-85021 , CVE-2026-86216 , CVE-2026-86244 , CVE-2026-86668 , CVE-2026-9415 , CVE-2026-9416 , CVE-2026-9417 , CVE-2026-9418 , CVE-2026-9419 , CVE-2026-9448 , CVE-2026-9518 , CVE-2026-9519 , CVE-2026-9527 , CVE-2026-9566 , CVE-2026-10228 , CVE-2026-10234 , CVE-2026-10244 , CVE-2026-10245 , CVE-2026-10246 , CVE-2026-10247 , CVE-2026-16155 , CVE-2026-16156 , CVE-2026-16202 , CVE-2026-16203 , CVE-2026-19209 , CVE-2026-19922 , CVE-2026-5810 , CVE-2026-7222 , CVE-2026-82483 , CVE-2026-82488 , CVE-2026-82666 , CVE-2026-84437 , CVE-2026-84438 , CVE-2026-85022 , CVE-2026-85207 , CVE-2026-86181 , CVE-2026-86301 , CVE-2026-86644 , CVE-2026-10529 , CVE-2026-11468 , CVE-2026-16205 , CVE-2026-19110 , CVE-2026-19207 , CVE-2026-9564 , CVE-2026-78187
CWE-116	CVE-2026-54694 , CVE-2026-12496 , CVE-2021-34630 , CVE-2026-26028 , CVE-2026-59727
CWE-119	CVE-2021-1472
CWE-183	CVE-2026-54694
CWE-200	CVE-2016-9314 , CVE-2018-8024
CWE-264	CVE-2016-9269 , CVE-2016-9315
CWE-287	CVE-2019-1937 , CVE-2021-1472 , CVE-2023-0905 , CVE-2012-1258 , CVE-2025-53771
CWE-295	CVE-2018-6221 , CVE-2018-6219
CWE-306	CVE-2018-6223 , CVE-2026-41473
CWE-345	CVE-2026-12724 , CVE-2026-17011 , CVE-2026-10827
CWE-352	CVE-2018-11442 , CVE-2018-11445 , CVE-2018-15884 , CVE-2018-6224 , CVE-2020-7991 , CVE-2025-56798 , CVE-2025-47204
CWE-434	CVE-2026-67688 , CVE-2019-9189 , CVE-2026-68899 , CVE-2026-65986 , CVE-2026-45797 , CVE-2026-79670 , CVE-2026-75331
CWE-444	CVE-2026-55087
CWE-502	CVE-2023-29300 , CVE-2023-38203 , CVE-2023-44353 , CVE-2025-53770
CWE-601	CVE-2026-55087
CWE-610	CVE-2023-30943
CWE-611	CVE-2016-8526 , CVE-2018-6225
CWE-639	CVE-2026-45551
CWE-693	CVE-2026-54694
CWE-798	CVE-2019-1935
CWE-862	CVE-2021-21307 , CVE-2026-46518
CWE-913	CVE-2026-53753
CWE-915	CVE-2026-63428
CWE-918	CVE-2026-82667

Documentation Source

Original wiki page: WAF 350147
Source revision: 3072
Source revision date: 2013-01-03