Search: xss.is

CVE-2026-115897 is a cross-site scripting (XSS) vulnerability in Microsoft product version 3.0 caused by unescaped </script sequences at the end of serialized JavaScript function bodies. This flaw allows injection of malicious scripts when serialized functions are improperly handled.

A cross-site scripting (XSS) vulnerability exists in serialize-javascript versions 7.0.1 before 7.1.3 due to unescaped </script sequences in function bodies. This flaw could allow injection of malicious scripts when untrusted data is serialized and rendered in a web context.

A cross-site scripting (XSS) vulnerability exists in the addlist.php file of the Add Product Page component in configuroweb inventariobasico. The vulnerability arises from improper handling of the product name argument, allowing remote attackers to inject malicious scripts. The product uses a rolling release model, so no specific affected or fixed versions are identified. The vulnerability has a low CVSS score of 3.5 and public exploit code is available. The project has been notified but has not yet responded or issued a fix.

An authentication endpoint reflects unsanitized request data in error messages, enabling cross-site scripting (XSS) attacks. Attackers can inject malicious scripts executed in victims' browsers, potentially redirecting users, altering the page interface, or stealing information. Session hijacking is mitigated by the httpOnly flag on session cookies.

A vulnerability in i18next-http-backend versions before 4.0.3 allows an attacker controlling the namespace (ns) value to cause the application to load translation JSON from an attacker-chosen origin. This occurs when the loadPath or addPath template places the namespace value immediately after a leading slash, resulting in a protocol-relative URL starting with //. This can lead to content injection into the UI and potential cross-site scripting (XSS) if translations are rendered as HTML. The issue is fixed in version 4.0.3.

Vue I18n versions before 11.4.14 and certain 12.0.0-alpha versions have a vulnerability where the escapeParameter feature does not properly escape named interpolation values when a translation call passes both a list and named values. This can lead to unescaped HTML markup being inserted, potentially enabling DOM-based XSS if untrusted named values are rendered as HTML. The issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.

Vue I18n versions prior to 11.4.14 and certain alpha versions of 12.0.0 contain a vulnerability where the escapeParameter feature does not properly sanitize the srcdoc attribute in iframe elements within translation messages. This allows an attacker to inject HTML content that the browser decodes and executes in the same origin, leading to DOM-based cross-site scripting (XSS). The issue arises because the sanitizer escapes characters using character references that are decoded inside srcdoc, bypassing the sanitization. The vulnerability is fixed in versions 11.4.14 and 12.0.0-alpha.5.

A reflected cross-site scripting (XSS) vulnerability exists in the labstack echo Go web framework in versions prior to 4.16.0 and between 5.0.0 and before 5.4.0. The vulnerability arises because Context.JSONP and Context.JSONPBlob methods concatenate an unvalidated callback parameter into a JavaScript response, allowing attacker-controlled input to execute script code. This flaw is fixed in versions 4.16.0 and 5.4.0.

FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under `admin/` perform privileged operations without `isLoggedIn()` authentication checks, CSRF protection or adequate `path` validation. On PHP's built-in development server, including the default Docker deployment, `router.php` checks an unnormalized admin URI prefix while the filesystem resolves dot segments, so `/./admin/` bypasses the admin login gate and executes those scripts directly. In `admin/debug_save_flow.php`, attacker-controlled `path` and `content` reach `file_put_contents` for arbitrary `.md` writes under `content`/ or outside it through `path` traversal, enabling site defacement and stored JavaScript in public pages; `print_r($_POST)` output without `htmlspecialchars` escaping also causes reflected cross-site scripting. The `admin/debug_content.php` `path` parameter reaches `scandir()`, `file_get_contents()` and `posix_getpwuid()`, permitting arbitrary directory enumeration and `.md` file reads that expose absolute paths, ownership, permissions, hashes and `content` previews. The `admin/preview-handler.php` endpoint accepts JSON `content` and `title` and writes enumerable files under `content/_preview/`, enabling stored cross-site scripting and disk exhaustion. The `admin/testdebug.php` endpoint appends to `admin/testdebug.log` without authentication, also enabling disk exhaustion. The `admin/test_redirect.php` script exposes a test artifact but escapes its inputs and is not itself an XSS sink. Stored script execution can steal sessions and compromise administrators when they view affected `content`. Reads and writes execute with PHP's privileges; the tested deployment runs PHP as root, amplifying filesystem impact. This issue is fixed in version 0.1.4.

n8n versions before 1.123.85, 2.0.0 up to but not including 2.43.5, and 2.44.0 up to but not including 2.44.1 contain a stored cross-site scripting (XSS) vulnerability. This occurs because certain webhook response paths omit the sandbox Content-Security-Policy header, allowing authenticated users who can create and activate workflows to serve malicious HTML. This HTML executes scripts in the context of the n8n origin, potentially hijacking sessions of users who open the webhook URL.

Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, contain a vulnerability that allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller. This behavior results in a cross-site scripting (XSS) vulnerability that could be exploited by attackers who control agent processes.

A cross-site scripting (XSS) vulnerability exists in Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier. The vulnerability arises because the URL of the link shown in the workspace browser for each file and directory is computed on the agent side, which can be exploited by attackers who control agent processes.

Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, contain a stored cross-site scripting (XSS) vulnerability due to improper escaping of tooltip text in the breadcrumb bar overflow menu entries. This flaw can be exploited by attackers who have Overall or Read permissions.

Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, have a vulnerability where item types in collections are not restricted after deserialization. This flaw allows attackers with access to POST config.xml API endpoints to submit crafted configuration files that can lead to stored cross-site scripting (XSS) vulnerabilities.

GFI KerioConnect versions before 10.0.9 Patch 2 contain a cross-site scripting (XSS) vulnerability in the Webmail component. This flaw allows a remote attacker to inject malicious HTML or script into a victim's authenticated Webmail session by sending a specially crafted email. The vulnerability arises from the link auto-formatter re-processing already-linked text and improperly handling quote characters, enabling script execution within the victim's session.

Highcharts JS versions from 2.0.0 up to but not including 3.2.0, and versions from 3.2.0 up to but not including 4.0.0, as well as versions before 13.0.0-beta.2, contain a cross-site scripting (XSS) vulnerability in the Grid component. This vulnerability arises because the credits.href property is applied without validating the URL scheme, allowing an attacker controlling the Grid configuration to inject a javascript: URL. Activating the credits link then executes arbitrary script in the context of the hosting page, potentially compromising application data and session state. The issue is fixed in versions 3.2.0, 4.0.0, and 13.0.0-beta.2.

Highcharts JS versions from 2.0.0 up to but not including 3.2.0 contain a cross-site scripting (XSS) vulnerability in the Grid pagination language strings. The vulnerability arises because pagination language strings are written into the DOM as markup rather than text, allowing an attacker controlling the Grid language configuration to inject elements with event handlers. This leads to script execution in the context of the hosting page without requiring additional user interaction. The issue is fixed in version 3.2.0 and later.

Highcharts JS versions prior to 11.4.9, 12.6.1, and 13.1.1 contain a cross-site scripting (XSS) vulnerability. The issue arises because the credits.href property is assigned directly to the window location without validating the URL scheme, allowing an attacker controlling the chart configuration to inject a javascript: URL. This can lead to script execution in the context of the hosting page when a user clicks the credits label. The vulnerability affects Highcharts and its related packages Highcharts Stock, Maps, and Gantt. Fixed versions are 11.4.9, 12.6.1, and 13.1.1.