Search: xss.is

Semantic MediaWiki versions from 3.1.0 up to but not including 7.3.1 contain a reflected cross-site scripting (XSS) vulnerability in the Special:SMWAdmin ID lookup feature. This flaw allows unauthenticated attackers to inject malicious markup via the unescaped id parameter. By tricking an smw-admin administrator into clicking a crafted link, attackers can bypass the auto-satisfied edit-token check and execute scripts within the administrator's session, potentially performing privileged actions.

SemanticMediaWiki versions from 5.0.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability in the ext.smw.tooltip.tippy.js component. This flaw arises because data-* attributes are rendered via innerHTML with allowHTML enabled, allowing editors to insert malicious JavaScript in specific span elements. When users, including administrators, hover over these elements, the malicious script executes. The vulnerability is fixed in version 7.3.1.

Semantic MediaWiki versions from 3.1.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows authenticated users with the smw-schemaedit permission to inject arbitrary HTML through schema descriptions. The injected HTML is passed unescaped to Html::rawElement() in HtmlBuilder, which can alter pages and potentially target users who view the affected schema. The vulnerability is fixed in version 7.3.1.

Semantic MediaWiki versions from 4.2.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. Authenticated users with profile or schema editing permissions can inject malicious HTML into FacetedSearch exploration-link labels. This injected markup is rendered without proper escaping on the Special:FacetedSearch page, potentially allowing script execution in the browsers of users viewing that page. The vulnerability is fixed in version 7.3.1.

Semantic MediaWiki versions from 3.0.0 up to but not including 7.3.1 contain a cross-site scripting (XSS) vulnerability. This flaw arises because malicious semantic property values are rendered unescaped in autocomplete suggestions, allowing attackers to inject markup. Specifically, the jquery.autocomplete.js script inserts raw API values into HTML via container.html(), which can alter the dropdown content and potentially execute arbitrary scripts when a user opens the property-value autocomplete with an empty query. The vulnerability is fixed in version 7.3.1.

SemanticMediaWiki versions from 3.0.0 up to but not including 7.3.1 contain a reflected cross-site scripting (XSS) vulnerability in the Special:Ask feature. This flaw occurs because certain separator parameters are output without proper HTML escaping in various result printers. Unauthenticated attackers can exploit this by crafting malicious Special:Ask links that execute JavaScript in the victim's browser within the wiki's origin, potentially stealing session information or CSRF tokens. The vulnerability is fixed in version 7.3.1.

SemanticMediaWiki versions from 3.1.0 up to but not including 7.3.1 contain a reflected cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject malicious scripts via the unescaped default parameter in JsonResultPrinter. Exploitation involves tricking users into clicking a specially crafted Special:Ask link with a zero-result query and request_type=special_page, leading to JavaScript execution in the context of the wiki origin. The vulnerability was fixed in version 7.3.1.

CVE-2026-117494 is a high-severity Cross-Site Scripting (XSS) vulnerability in the Sisense Cloud BI Platform. It arises from unsafe processing of SVG images submitted via the /api/v2/ai/sessions API in base64-encoded SVG format. Malicious script tags embedded in the SVG can execute JavaScript when rendered in the assistant window, potentially altering displayed content.

CVE-2026-117493 is a stored cross-site scripting (XSS) vulnerability in the Sisense Cloud BI Platform affecting BloX widgets. The vulnerability arises because the /api/dashboards/<id>/widgets/<id> API accepts HTML and JavaScript content in the 'desc' and 'text' parameters, which is then executed in the browser when the widget is rendered. This can lead to compromise of confidentiality of information accessible in that context. The vulnerability has a high severity with a CVSS score of 8.3. A fix was released on 27 October 2026.

The Jupiter X Core WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in the 'forget_password_link' parameter. This flaw exists in all versions up to and including 4.61.0 and allows authenticated users with contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages.

The Analytics Insights – Google Analytics Dashboard for WordPress plugin is affected by a stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 6.3.12. This vulnerability arises from insufficient input sanitization and output escaping of the Page Title, allowing unauthenticated attackers to inject malicious scripts. These scripts execute when any user accesses the compromised page, potentially leading to data theft or session hijacking.

CVE-2026-116836 is a high-severity Stored Cross-Site Scripting (XSS) vulnerability affecting airMAX M devices. An attacker with access to the adjacent network could exploit this vulnerability under certain conditions to escalate privileges on the device. The vulnerability allows for execution of malicious scripts that can compromise confidentiality, integrity, and availability of the affected device.

CVE-2026-116640 is a cross-site scripting (XSS) vulnerability in the Saruf-Ratul HR-Payroll-Management-System. The flaw exists in an unspecified functionality of the chat.php file, where manipulation of the ID argument can lead to XSS. The vulnerability can be exploited remotely and exploit code has been published. The product uses a rolling release model, so no specific affected or fixed versions are available. The vendor has been informed but has not yet responded or issued a fix.

CVE-2026-116639 is a cross-site scripting (XSS) vulnerability in the MD-MAFUJUL-HASAN Online-Payroll-Management-System affecting an unspecified function in chat.php. The vulnerability arises from manipulation of the ID argument and can be exploited remotely. The product uses a rolling release model, so no specific affected or fixed versions are available. The issue was reported early but remains unaddressed. Public exploit code is available, and the CVSS 4.0 score rates this as a medium severity vulnerability.

YesWiki versions prior to 4.7.0 have a stored cross-site scripting (XSS) vulnerability in the handlers/page/referrers_sites.php component. This flaw allows unauthenticated attackers to inject malicious scripts via specially crafted Referer headers. When a victim visits the referrer-sites page, the injected JavaScript executes in their browser context, enabling same-origin authenticated actions.

YesWiki versions prior to 4.7.0 have a reflected cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject malicious JavaScript by manipulating query parameters that correspond to missing Bazar field names. The vulnerability arises because the application falls back to unsanitized user input rendered with Twig |raw templates, enabling execution of attacker-controlled scripts in the context of authenticated users.