Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 4.8 Medium
Toptech TMS7 and TopHAT Cross-site Scripting
- Toptech Systems TMS7
- Toptech Systems TopHAT
- Cross-site scripting (XSS)
- CVSS 7.7 High
Lantronix G520 Series Cellular Gateway Cross-site Scripting
- Lantronix G520 Series
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Cross-site scripting in Google Chrome
- Google Chrome
- Cross-site scripting (XSS)
- CVSS 3.1 Low
Laravel: XSS in Debug Page Information
- Cross-site scripting (XSS)
<12.69.0 || >=13.0.0, <13.30.0 · fixed in 12.69.0, 13.30.0
GHSA-jh5r-qr3c-85q8 · CVE-2026-102279 - CVSS 6.1 Medium
Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation
- Cross-site scripting (XSS)
>=0.6.1, <4.0.0 · fixed in 4.0.0
GHSA-hj66-6f7g-4r5v · CVE-2026-49264 - CVSS 8.6 High
Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4
- balbooa.com Balbooa Forms extension for Joomla
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Stored XSS on Wikibase Special:SetSiteLink via unescaped system message
- Wikimedia Foundation Mediawiki - Wikibase Extension
- Cross-site scripting (XSS)
- CVSS 5.9 Medium
Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Stored XSS in WikiSEO author and image properties on action=info
- Wikimedia Foundation Mediawiki - WikiSEO Extension
- Cross-site scripting (XSS)
- CVSS 5.9 Medium
Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
- CVSS 7.1 High
Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3
- Joomla! Project Joomla! CMS
- Joomla! Project Joomla! Framework Filter package
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
Joomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
- CVSS 5.9 Medium
Joomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
- CVSS 7.1 High
Joomla! Core - [20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3
- Joomla! Project Joomla! CMS
- Joomla! Project Joomla! Framework Filter package
- Cross-site scripting (XSS)
- CVSS 5.9 Medium
Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Flow colon-separator and flow-guidedtour-optin-welcome-description messages allow stored XSS
- Wikimedia Foundation Mediawiki - Flow Extension
- Cross-site scripting (XSS)
- CVSS 9.6 CriticalCritical · CVSS 9+
Webmin: Reflected XSS in the Configuration module
- webmin
- Cross-site scripting (XSS)
- CVSS 2.1 Low
HTML injection
- pretix
- Cross-site scripting (XSS)
- CVSS 8.2 High
HPE OneView - Cross-site scripting vulnerability
- Hewlett Packard Enterprise HPE OneView
- Cross-site scripting (XSS)
- CVSS 8.2 High
HPE OneView - Cross-site scripting vulnerability
- Hewlett Packard Enterprise HPE OneView
- Cross-site scripting (XSS)
- CVSS 8.7 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
coolbeans1212 MateisHomePage-Website users.php cross site scripting
- coolbeans1212 MateisHomePage-Website
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
CodeCanyon Rocket LMS Student Profile Image Upload cross site scripting
- CodeCanyon Rocket LMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
mwasikz robo-cafe-rms Edit Profile Feature update-account.php cross site scripting
- mwasikz robo-cafe-rms
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.2 High
HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field
- htplugins HT Contact Form – Drag & Drop Form Builder for WordPress
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
GestSup before 3.2.62 Stored XSS via Double-Decoded Email Subject in OAuth IMAP Connector
- GestSup
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
GestSup before 3.2.61 Stored XSS via Email Body in LOGIN IMAP Connector
- GestSup
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Cross Site Scripting vulnerability in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the last name, first name, and username par…
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
httpdbg before 2.2.1 Stored Cross-Site Scripting via javascript URL
- cle-b httpdbg
- Cross-site scripting (XSS)
- CVSS 8.6 High
Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements
- Cross-site scripting (XSS)
- CWE-116
<=19.2.25 || >=20.0.0, <20.3.30 || >=21.0.0, <21.2.22 || >=22.0.0, <22.1.4 · fixed in 20.3.30, 21.2.22, 22.1.4
GHSA-j3r3-mxqp-r2p4 · CVE-2026-88058 - CVSS 5.1 Medium
Eleveo Call Recording Software Play Audio audio.jsp cross site scripting
- Eleveo Call Recording Software
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) < 6.4.6
- ordasoft.com Book Library (Free) extension for Joomla
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8
- ordasoft.com Vehicle Manager (Free) extension for Joomla
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.9
- ordasoft.com Real Estate Manager (Free) extension for Joomla
- Cross-site scripting (XSS)
- CVSS 9.6 CriticalCritical · CVSS 9+
Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher
- SUSE Rancher
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Multiple Reflected XSS in Dayforce ESS Excelity
- Dayforce ESS Excelity
- Cross-site scripting (XSS)
- CVSS 4.1 Medium
HTML Injection in Enocta Educational's Enocta Platform
- Enocta Educational Technologies Inc. Enocta Platform
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
HTML Injection in Rolantis Information Technologies' Agentis
- Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Stored Cross-Site Scripting (XSS) in TPVEnlanube
- TPVEnlanube Cloud Web application
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Stored Cross-Site Scripting (XSS) in TPVEnlanube
- TPVEnlanube Cloud Web application
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Stored Cross-Site Scripting (XSS) in TPVEnlanube
- TPVEnlanube Cloud Web application
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Apache Roller: Stored XSS in comment moderation via comment author URL
- Apache Software Foundation Apache Roller
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Stored XSS in BİMSER's eBA Plus
- Bimser Solution Software Trade Inc. eBA Plus Document and Workflow Management System
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Apache Roller: Stored cross-site scripting in the authoring UI
- Apache Software Foundation Apache Roller
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Apache Roller: Reflected cross-site scripting in the frontpage directory parameter
- Apache Software Foundation Apache Roller
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Apache Roller: Stored cross-site scripting via uploaded media content type
- Apache Software Foundation Apache Roller
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Apache Roller: Stored cross-site scripting through incoming Trackback links
- Apache Software Foundation Apache Roller
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Apache Roller: Stored javascript: URI in HTML comments
- Apache Software Foundation Apache Roller
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Apache Roller: Reflected XSS in the optional LDAP comment authenticator
- Apache Software Foundation Apache Roller
- Cross-site scripting (XSS)
- CVSS 7.5 High
Joomla Extension - regularlabs.com - Privileged stored XSS via data-rlta-url attributes in Tabs & Accordions (Pro) 2.3.0 - 3.1.0
- regularlabs.com Tabs & Accordions (Free, Pro) extension for Joomla
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
amirsanni mini-inventory-and-sales-management-system Items Management Items.php cross site scripting
- amirsanni mini-inventory-and-sales-management-system
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Krayin laravel-crm Admin Settings Endpoint index.blade.php cross site scripting
- Krayin laravel-crm
- Cross-site scripting (XSS)
- Code injection
- CVSS 2.1 Low
zhistaredu StarTraining application.yml cross site scripting
- zhistaredu StarTraining
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
zhistaredu StarTraining Upload Endpoint MimeTypeUtils.java cross site scripting
- zhistaredu StarTraining
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
mathurvishal CloudClassroom-PHP-Project registrationform.php cross site scripting
- mathurvishal CloudClassroom-PHP-Project
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0
- svenbluege.de Event Gallery for Joomla
- Cross-site scripting (XSS)
- Open redirect
- CVSS 6.8 Medium
PowerPress < 11.17.2 - Contributor+ Stored XSS via Podcast Player Block
- PowerPress Podcasting plugin by Blubrry
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Optima Express 8.6.0 - 8.7.5 - Author+ Stored XSS via faq_script
- Optima Express IDX
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
WP YouTube Lyte < 1.7.31 - Contributor+ Stored XSS via Embed Block Attributes
- WP YouTube Lyte
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Stored XSS via Feed Import
- WPeMatico RSS Feed Fetcher
- Cross-site scripting (XSS)