CVE-2026-89290 is a stored cross-site scripting (XSS) vulnerability in the eimzamip product by İzometri IT Services Domestic and Foreign Trade Co. Ltd. It arises from improper neutralization of script-related HTML tags. The vulnerability affects versions from 1.6.4 up to but not including 1.6.7. The CVSS score is low (3.5), indicating limited impact primarily on confidentiality. There is no information about an available patch or vendor advisory. No known exploits are reported in the wild.
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearch extension allows Cross-Site Scripting (XSS).
This issue affects MediaWiki MediaSearch extension: 1.46, 1.45, and 1.43.
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata extension allows Cross-Site Scripting (XSS).
This issue affects MediaWiki CommonsMetadata extension: 1.46, 1.45, and 1.43.
A low-severity Cross-Site Scripting (XSS) vulnerability exists in the MediaWiki Wikbase extension versions 1.43, 1.45, and 1.46. This vulnerability is due to improper neutralization of script-related HTML tags, classified as CWE-80. It allows an attacker to inject script code into web pages, potentially impacting users with high privileges who interact with the affected extension. The vulnerability has a low CVSS score of 0.3 and no known exploits in the wild.
A low-severity Cross-Site Scripting (XSS) vulnerability exists in the MediaWiki Wikistories extension versions 1.43, 1.45, and 1.46. The issue is due to improper neutralization of script-related HTML tags, which can allow script injection in web pages. This vulnerability is identified as CWE-80. No known exploits are reported in the wild, and no official patch or remediation details are provided in the available data.
A reflected cross-site scripting (XSS) vulnerability exists in the MediaWiki ReadingLists extension versions 1.45 and 1.46. This vulnerability is due to improper neutralization of script-related HTML tags, which can allow an attacker to inject malicious scripts into web pages. The issue has a low severity rating and a CVSS 4.0 score of 1.1. No official patch or remediation guidance has been provided yet.
A stored cross-site scripting (XSS) vulnerability exists in the MediaWiki Page_Forms extension maintained by The Wikimedia Foundation. The flaw is due to improper neutralization of script-related HTML tags, allowing malicious scripts to be stored and executed in the context of affected web pages. This vulnerability affects specific versions 1.43, 1.45, and 1.46 of the extension. The CVSS 4.0 base score is low, indicating limited impact and exploitability. No known exploits are reported in the wild. No patch or remediation details are provided in the available data.
CVE-2026-103444 is a low-severity stored cross-site scripting (XSS) vulnerability in the MediaWiki WikiForum extension maintained by The Wikimedia Foundation. It involves improper neutralization of script-related HTML tags, allowing potentially malicious scripts to be stored and executed in the context of the affected web pages. The vulnerability affects the master branch of the WikiForum extension. No specific affected versions or patch information is provided.
A low-severity cross-site scripting (XSS) vulnerability exists in the MediaWiki Collection (Book) extension versions 1.43, 1.45, and 1.46. The issue involves improper neutralization of script-related HTML tags, allowing XSS targeting non-script elements. This vulnerability could potentially allow an attacker to inject malicious scripts into web pages generated by the affected extension versions.
Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.0 and 13.30.0.
The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with $wgEmbedVideoRequireConsent disabled (not the default), the urls for videos are passed into an iframe src attribute without sanitization. When given a malformed url or id, the src attribute can be escaped via double quotes, allowing for html/javascript injection. Version 4.1.0 contains a patch.
CVE-2026-91130 is a critical cross-site scripting (XSS) vulnerability in Home Assistant core prior to version 2026.7.0. The issue arises from improper escaping of entity names interpolated into ECharts tooltip HTML in the Statistics Graph card, allowing script execution when a viewer hovers over a data point. This affects Mean, State, Sum, and Change fields in the default Line chart configuration but not Bar charts. The vulnerability requires authentication or control over an integration that supplies entity names. It is fixed in version 2026.7.0.
IBM Cloud Pak for Business Automation is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type. Prior to 2.0.2, 3.0.2, and 4.0.1, depending on the release line, RichTextValue.output returns an unsanitized stored RichText value when mimeType equals outputMimeType, including values that claim the text/x-html-safe output type. This equality shortcut bypasses the safe_html transform even though the transform itself correctly removes event-handler attributes and unsafe URI schemes. Equal types can result from a RichText field configured with the same mimeType and outputMimeType or from REST API input that supplies text/x-html-safe as its content type. The raw stored value is then emitted through tal:content=structure without escaping, allowing a user who can set a RichText field to store JavaScript that executes in a viewer's browser. This issue is fixed in versions 2.0.2, 3.0.2, and 4.0.1.
There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later.
This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page.
Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.
CVE-2026-82838 is a medium severity vulnerability in the pretix venueless product where the default docker image did not properly prevent uploaded SVG files from containing executable JavaScript. This issue relates to improper neutralization of script-related HTML tags (CWE-80). A valid Content Security Policy is now set to mitigate this risk. No specific affected versions or patches are currently detailed.
CVE-2026-5218 is a medium severity vulnerability in Softtr Informatics Technology Trading Limited Company's E-Commerce Pack. It involves improper neutralization of script-related HTML tags, leading to a basic Cross-Site Scripting (XSS) issue. This vulnerability affects versions before 5.03.01.49. No official patch or remediation guidance is currently available.
CVAT is an open source interactive video and image annotation tool for computer vision. From 2.68.0 until 2.70.0, the audio-task annotation guide renderer in cvat-ui/src/audio/components/annotation-page/audio-workspace/top-bar/audio-right-group.tsx passes attacker-controlled guide Markdown to MDEditor without the rehype-sanitize plugin. A user who can create or edit an annotation guide can store malicious JavaScript that executes when another user opens the guide. The script can issue arbitrary CVAT requests with the victim user's privileges. This issue is fixed in version 2.70.0.
CVE-2026-52854 is a high-severity cross-site scripting (XSS) vulnerability in the ProfessionalWiki Maps extension for MediaWiki. Versions prior to 12.1.3 allow an attacker with edit permissions to inject malicious HTML via the overlays parameter in the display_map parser function. This malicious content is not properly escaped when used as a Leaflet layer-control label, leading to script execution in the browsers of users who preview or view the affected map. The vulnerability is fixed in version 12.1.3.