Search: xss.is

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal MathJax: LaTeX for Drupal allows Cross-Site Scripting (XSS). This issue affects MathJax: LaTeX for Drupal versions: from 0.0.0 to 4.1.2.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Leaflet allows Stored XSS. This issue affects Leaflet versions: from 0.0.0 to 10.4.13.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Menu Link Attributes allows Stored XSS. This issue affects Menu Link Attributes versions: from 0.0.0 to 1.8.0.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Country allows Cross-Site Scripting (XSS). This issue affects Country versions: from 0.0.0 to 2.1.3, from 2.2.0 to 2.2.1.

CVE-2026-110738 is a Cross-Site Scripting (XSS) vulnerability in the Drupal Gin Admin Theme. It affects versions from 0.0.0 up to but not including 4.1.4, and from 5.0.0 up to but not including 5.0.16. The vulnerability arises from improper neutralization of input during web page generation. Fixed versions are 4.1.4 and 5.0.16.

A Cross-site Scripting (XSS) vulnerability exists in Drupal core affecting multiple version ranges from 8.9.0 up to but not including 10.6.19, 11.0.0 up to 11.3.19, 11.4.0 up to 11.4.10, and 12.0.0-alpha1 up to 12.0.0-beta2. The vulnerability is due to improper neutralization of input during web page generation. Fixed versions are available starting from 10.6.19, 11.3.19, 11.4.10, and 12.0.0-beta2.

A Cross-Site Scripting (XSS) vulnerability exists in Drupal core versions from 10.3.0 up to but not including 10.6.19, 11.0.0 up to but not including 11.3.19, 11.4.0 up to but not including 11.4.10, and 12.0.0-alpha1 up to but not including 12.0.0-beta2. This vulnerability is due to improper neutralization of input during web page generation, allowing injection of malicious scripts.

CVE-2026-114527 is a Cross-site Scripting (XSS) vulnerability in the Drupal UI Icons component. It affects UI Icons versions from 0.0.0 up to but not including 1.1.3, and from 2.0.0 up to but not including 2.0.2. The vulnerability arises from improper neutralization of input during web page generation, allowing injection of malicious scripts. Fixed versions are 1.1.3 and 2.0.2.

CVE-2026-114528 is a stored cross-site scripting (XSS) vulnerability in the Drupal Zero Point product. It affects versions from 0.0.0 up to but not including 1.30.0, and from 2.0.0 up to but not including 2.0.1. The vulnerability arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers. Fixed versions are 1.30.0 and 2.0.1.

A stored cross-site scripting (XSS) vulnerability exists in the Drupal Black Hole module affecting versions from 0.0.0 up to but not including 1.26.0, and from 2.0.0 up to but not including 2.0.1. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts that are stored and executed in users' browsers.

CVE-2026-114525 is a stored cross-site scripting (XSS) vulnerability in the Drupal ABC product. It affects versions from 0.0.0 up to but not including 1.25.0, and from 2.0.0 up to but not including 2.0.1. The vulnerability arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers. Fixed versions are 1.25.0 and 2.0.1.

A stored cross-site scripting (XSS) vulnerability exists in the Drupal CSV Field module affecting versions from 0.0.0 up to but not including 2.0.10, and from 3.0.0 up to but not including 3.0.7. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts.

CVE-2026-114531 is a stored cross-site scripting (XSS) vulnerability in the Drupal Swiper formatter module. It affects versions from 0.0.0 up to but not including 2.1.2, and from 3.0.1 up to but not including 3.1.0. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that are stored and executed in users' browsers.

CVE-2026-107260 is a stored cross-site scripting (XSS) vulnerability in the Drupal Sector Distribution. It affects versions from 0.0.0 up to but not including 10.3.3, and from 10.4.0 up to but not including 10.4.2. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that can be stored and executed in users' browsers. Fixed versions are 10.3.3 and 10.4.2.

CVE-2026-114532 is a Cross-Site Scripting (XSS) vulnerability in the Drupal UI Icons component. It affects UI Icons versions from 0.0.0 up to but not including 1.1.3, and from 2.0.0 up to but not including 2.0.2. The vulnerability arises from improper neutralization of input during web page generation, allowing injection of malicious scripts. Fixed versions 1.1.3 and 2.0.2 address this issue.

A stored cross-site scripting (XSS) vulnerability exists in the Drupal Block Attributes module affecting versions from 0.0.0 up to but not including 2.1.0. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The issue is fixed in version 2.1.0.

A stored cross-site scripting (XSS) vulnerability exists in Drupal USWDS Paragraph Components affecting versions from 0.0.0 up to but not including 3.1.3. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The issue is fixed in version 3.1.3.

A Cross-site Scripting (XSS) vulnerability exists in the Drupal Bootstrap theme affecting versions from 0.0.0 up to but not including 3.45.0. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The issue is fixed in version 3.45.0.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Data field allows Stored XSS. This issue affects Data field versions: from 0.0.0 to 2.0.14.

A Cross-site Scripting (XSS) vulnerability exists in Drupal Commerce Stripe versions 2.0.0 through 2.2.2. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The issue is fixed in version 2.2.3.