Search: xss.is

NextChat version 2.16.1 has a client-side cross-site scripting (XSS) vulnerability in its Plugin Editor. This flaw arises from unsafe rendering of externally supplied OpenAPI plugin schema content using React's dangerouslySetInnerHTML without proper sanitization. An attacker can host a malicious schema and trick users into loading it, leading to arbitrary JavaScript execution within the NextChat application context. Exploitation can expose JavaScript-accessible cookies and other client-side data.

Adobe Campaign Classic contains a reflected Cross-Site Scripting (XSS) vulnerability (CVE-2026-104350). This flaw allows attackers to inject malicious scripts via crafted URLs or compromised web pages, potentially enabling them to hijack user sessions or escalate privileges. Exploitation requires user interaction. The vulnerability has a critical severity rating with a CVSS score of 9.3.

TinyMCE versions from 7.9.3 up to but not including 7.9.4 and from 8.5.1 up to but not including 8.9.3 contain a stored cross-site scripting (XSS) vulnerability in the media plugin. The vulnerability arises because elements created through data-mce-object are inserted into the active document before proper sanitization, allowing malicious scripts to execute. This issue has been fixed in versions 7.9.4 and 8.9.3.

GFI KerioConnect before version 10.0.8 Patch 2 contains a stored cross-site scripting (XSS) vulnerability in its Webmail component. This flaw allows remote attackers to execute JavaScript in an authenticated user's Webmail session by uploading a crafted SVG email attachment that bypasses sanitization of event-handler attributes. Exploitation leverages the temporary-download endpoint's weak Content-Security-Policy sandbox, enabling script execution when the attachment is opened. This can lead to theft of user credentials and mailbox contents. The vulnerability is fixed in version 10.0.8 Patch 2.

CVE-2026-102638 is a stored cross-site scripting (XSS) vulnerability in Autodesk Fusion desktop application. It occurs when a malicious HTML payload is embedded in the description of an electronic library (.lbr) file and displayed in the Library Manager after import. Exploitation can allow an attacker to read local files or execute arbitrary code within the context of the current process.

CVE-2026-102637 is a Reflected Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. It occurs when a malicious HTML payload is injected into the documentName parameter of a Fusion protocol URL and invoked by a user. This flaw allows an attacker to execute arbitrary code or read local files within the context of the current process. The vulnerability affects versions from 2705.1.30 up to but not including 2706.1.14 and has been assigned a high severity score of 7.1. A fix is available in version 2706.1.14.

CVE-2026-102636 is a stored cross-site scripting (XSS) vulnerability in Autodesk Fusion desktop application. It occurs when a malicious HTML payload is embedded in a design name and triggered upon opening the manipulated design by another user. This vulnerability allows an attacker to execute arbitrary code or read local files within the context of the application process.

A cross-site scripting (XSS) vulnerability exists in the notifications feature of Devolutions PowerShell Universal 2026.3.0 and earlier. An authenticated user with permission to create notifications can inject arbitrary JavaScript code via a crafted notification target URL, which executes in the browser of another user.

LiteLLM versions from 1.65.5 up to but not including 1.85.0 contain a reflected cross-site scripting (XSS) vulnerability in the /sso/debug/callback endpoint. This endpoint reflects identity-provider-controlled fields into an inline script block without properly escaping HTML context characters, allowing an attacker to inject malicious JavaScript. The vulnerability can be exploited by an attacker with an account on the configured identity provider to execute scripts in the proxy origin, potentially leading to full admin account takeover.

Multiple security vulnerabilities in Roundcube Webmail versions 1.6.x have been fixed in updates 1.6.18 through 1.6.20. These include fixes for IMAP command injection, SSRF filter bypasses, remote content blocking bypasses, mail header injection, session object injection, XSS issues, CSRF validation bypass, and other security flaws. The updates are considered stable and recommended for all productive installations.

KGS Software tia Viewer is vulnerable to Stored XSS via the annotation API. Due to the lack of input validation, an authenticated attacker can inject arbitrary JavaScript payload into a stickynote annotation. When any user opens the document, the viewer renders the annotation and the browser executes the payload. This may lead to compromising the user's session. This issue has been fixed in version 1.2.8.

The Advanced Views – Display Framework for Gutenberg & Elementor WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in the 'comment' parameter in all versions up to and including 3.9.6. This flaw allows unauthenticated attackers to inject malicious scripts that execute whenever a user views a page containing the injected comment. The vulnerability affects even unapproved or pending comments because the plugin's comment retrieval function does not filter by approval status, enabling payload execution before comment review.

An unauthenticated stored cross-site scripting (XSS) vulnerability exists in the DJ-HelpfulArticles Joomla extension versions prior to 1.3.0. The vulnerability arises because the 'was this article helpful' voting widget accepts a client-supplied IP field via AJAX handlers without proper validation or output escaping. This field is stored and later rendered in the administrator backend without HTML escaping, allowing injection of malicious scripts. The lack of CSRF protection, rate limiting, and reliance on an attacker-controlled field for vote de-duplication exacerbates the risk.