Advisories · Weakness
CWE-84.
Every Advisory and CVE whose sources give the weakness CWE-84, newest first.
- CVSS 6.9 MediumCritical · KEVKEV
Plex Media Server URL injection
- Plex Media Server
- CWE-84
- CVSS 6.3 Medium
Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- CWE-84
- CVSS 5.9 Medium
Dashy: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
- lissy93 dashy
- Cross-site scripting (XSS)
- CWE-84
- CVSS 5.1 Medium
JupyterLab: Stored XSS in extension manager through package metadata unsanitized URI protocol
- CWE-84
<4.5.9 · fixed in 4.5.9
GHSA-vmhf-c436-hxj4 · CVE-2026-67338 - CVSS 9.3 CriticalCritical · CVSS 9+
Orval has Code Injection via unsanitized x-enum-descriptions using JS comments
- Code injection
- CWE-84
>=7.19.0, <7.21.0 || >=8.0.0, <8.2.0 · fixed in 7.21.0, 8.2.0
GHSA-gch2-phqh-fg9q · CVE-2026-25141 - CVSS 8.6 High
MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server
- Cross-site scripting (XSS)
- Code injection
<0.16.6 · fixed in 0.16.6
GHSA-g9hg-qhmf-q45m · CVE-2025-58444 - CVSS 6.1 Medium
IBM Engineering Lifecycle Optimization - Publishing cross-site scripting
- IBM Engineering Lifecycle Optimization - Publishing
- CWE-84
- CVSS 4.8 Medium
Tuleap allows XSS via the content of RSS feeds in the RSS widgets
- Enalean tuleap
- Cross-site scripting (XSS)
- CWE-84
- CVSS 5.5 Medium
An issue in Suning Commerce Group Suning EMall iOS 9.5.198 allows attackers to access sensitive user information via supplying a crafted link.
- CWE-84
- CVSS 5.5 Medium
An issue in Beitatong Technology LianJia iOS 9.83.50 allows attackers to access sensitive user information via supplying a crafted link.
- CWE-84
- CVSS 5.5 Medium
An issue in Boohee Technology Boohee Health iOS 13.0.13 allows attackers to access sensitive user information via supplying a crafted link.
- CWE-84
- CVSS 5.5 Medium
An issue in Tencent Technology (Beijing) Company Limited Tencent MicroVision iOS 8.137.0 allows attackers to access sensitive user information via supplying a crafted link.
- CWE-84
- CVSS 5.5 Medium
An issue in Merchants Union Consumer Finance Company Limited Merchants Union Finance iOS 6.19.0 allows attackers to access sensitive user information via supplying a crafted link.
- CWE-84
- CVSS 5.5 Medium
An issue in Yibin Fengguan Network Technology Co., Ltd YuPao DirectHire iOS 8.8.0 allows attackers to access sensitive user information via supplying a crafted link.
- CWE-84
- CVSS 5.5 Medium
An issue in Shandong Provincial Big Data Center AiShanDong iOS 5.0.0 allows attackers to access sensitive user information via supplying a crafted link.
- CWE-84
- CVSS 5.5 Medium
An issue in Qianjin Network Information Technology (Shanghai) Co., Ltd 51Job iOS 14.22.0 allows attackers to access sensitive user information via supplying a crafted link.
- CWE-84
- CVSS 2.5 Low
HCL BigFix Patch Download Plug-ins are affected by insecure support for file URI scheme
- HCL Software BigFix Patch Management Download Plug-ins
- CWE-84
- CVSS 6.3 Medium
JavaScript Injection via url encoded values in links in Collabora Office Android
- online
- CWE-84
- CVSS 4.1 Medium
Stored XSS via javascript URI in Apollo Change Requests comment
- com.palantir.apollo:autopilot
- CWE-84
- CVSS 6.8 Medium
Cross site scripting Vulnerability in backstage Software Catalog
- Cross-site scripting (XSS)
- CWE-84
<1.2.0 · fixed in 1.2.0
GHSA-7hv8-3fr9-j2hv · CVE-2023-25571 -
Siemens Desigo PXM30-1: A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41)…
- Siemens Desigo PXM30-1
- Siemens Desigo PXM30.E
- CWE-84
-
OpenVPN Access Server: OpenVPN Access Server 2.9.0 through 2.9.4 allow remote attackers to inject arbitrary web…
- OpenVPN Access Server
- CWE-84
-
Elastic App Search: Elastic App Search versions before 7.7.0 contain a cross site scripting (XSS) flaw when…
- Elastic App Search
- CWE-84