Search: xss.is

DOMPurify versions before 3.4.17 contain a cross-site scripting (XSS) vulnerability. This flaw occurs when an IN_PLACE hook removes a parent or sibling node, leaving attacker-controlled event handlers active in detached subtrees. As a result, malicious handlers such as img onerror can execute after the sanitize() function returns, causing DOM-based XSS.

DOMPurify versions before 3.4.17 contain a cross-site scripting (XSS) vulnerability. This flaw allows attackers to bypass the SMIL attributeName=href guard when parsing application/xhtml+xml content. The vulnerability arises because the transformCaseFunc function does not lowercase attribute names, enabling malicious SVG elements with animate or set tags to execute JavaScript when users click sanitized links. The issue is fixed in version 3.4.17.

CVE-2026-116556 is a cross-site scripting (XSS) vulnerability in Argilla versions 2.0 through 2.8.0. It arises from improper handling of the 'text' argument in a frontend Vue component, allowing remote attackers to inject malicious scripts. The vulnerability has a medium severity score of 4.8 and requires user interaction with high privileges. Public exploit code is available, but no official vendor response or patch has been issued yet.

CVE-2026-116555 is a cross-site scripting (XSS) vulnerability in Argilla versions up to 2.8.0. It arises from improper handling of the 'template' argument in a component within the frontend codebase. This flaw allows remote attackers to execute arbitrary scripts in the context of the affected application. The vulnerability has been publicly disclosed, but no official response or patch has been provided by the project at this time.

CVE-2026-116554 is a cross-site scripting (XSS) vulnerability in Argilla versions 2.0 through 2.8.0. The flaw exists in the Dataset.from_disk function within the SettingsInfo.vue component of the Settings Page. Manipulating the 'Name' argument can lead to XSS attacks, which can be launched remotely. Exploit code has been published, but the project has not yet responded or issued a fix.

CVE-2026-116514 is a cross-site scripting (XSS) vulnerability in itsourcecode Airline Reservation System version 1.0. The flaw exists in the /book_flight.php file, where manipulation of the 'max' argument can lead to XSS. The vulnerability can be exploited remotely and requires user interaction. Public exploit code is available.

Red Hat issued a security advisory for osbuild-composer, a service that builds customized OS artifacts and uploads images to cloud environments. The update addresses multiple vulnerabilities including authorization bypass, cross-site scripting (XSS), arbitrary code execution via XSS, unauthorized information disclosure, and man-in-the-middle attacks via untrusted intermediate certificates. These vulnerabilities stem from components such as gRPC-Go, golang.org/x/net/html, github.com/labstack/echo, and crypto/x509. The update is rated as Important by Red Hat Product Security and applies to Red Hat Enterprise Linux 8.6 variants.

A cross-site scripting (XSS) vulnerability exists in the lxsmnsyc seroval library versions 1.6.0 through 1.6.10. The issue arises because the JavaScript-output APIs derive a typed array's constructor name from a property that can be attacker-controlled if untrusted properties are copied onto a typed array and then serialized. This allows execution of attacker-controlled JavaScript in the context of the page receiving the output. The vulnerability is fixed in version 1.6.11.

A Cross-site Scripting (XSS) vulnerability exists in the lxsmnsyc seroval library's JavaScript-output APIs prior to version 1.0.0 and from 1.5.5 up to but not including 1.6.10. The issue arises when serializing RegExp sources containing a less-than character without proper escaping for embedding in HTML script elements. This can allow an attacker to inject malicious scripts if untrusted input is serialized and embedded in a script element. The vulnerability is fixed in version 1.6.10.

CVE-2026-116482 is a cross-site scripting (XSS) vulnerability in the subhajitkhan online-clinic-management-system affecting the patientregistration.php file. The flaw arises from improper handling of the pat_name argument, allowing remote attackers to inject malicious scripts. The vulnerability has been publicly disclosed, and exploit code may be available. The product lacks versioning, so specific affected or fixed versions are not identified.

CVE-2026-70382 is a cross-site scripting (XSS) vulnerability affecting multiple WolfVision Cynap devices. The flaw arises because some externally supplied values stored by the device are rendered in the web interface without proper output encoding. An attacker who can influence these stored values could cause script execution in the browser of a user who views the affected page. Exploitation requires both attacker control over a stored value and a user viewing the vulnerable page. The vulnerability has a medium severity rating with a CVSS score of 5.1.

CVE-2026-57196 is a reflected cross-site scripting (XSS) vulnerability in Asterisk's phone provisioning HTTP error pages. It affects versions prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1, and certain Certified Asterisk releases. An unauthenticated attacker can exploit this vulnerability to steal an authorized user's AMI session cookie and impersonate that user, but only if the HTTP server, AMI, and AMI HTTP access are enabled and the attacker can convince the user to click a malicious link. By default, the HTTP server binds to 127.0.0.1, limiting exposure. The issue is fixed in the stated versions.

A stored cross-site scripting (XSS) vulnerability exists in bPlugins Content Slider Block up to version 3.2.1. This flaw allows improper neutralization of input during web page generation, potentially enabling an attacker with limited privileges to execute malicious scripts in the context of other users. The vulnerability has a medium severity rating with a CVSS score of 6.5.

Bdtask Garage 24 Garage Management Software 1.0 contains a cross-site scripting (XSS) vulnerability in the /edit_profile component, specifically in the handling of the first_name and last_name parameters. This vulnerability allows remote attackers to inject malicious scripts. The vulnerability has been publicly disclosed, but the vendor has not responded or provided a fix. The CVSS score is low, indicating limited impact.

A stored cross-site scripting (XSS) vulnerability exists in bPlugins Typing Text – Give your texts many typing effects, affecting versions up to 2.2.0. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to execute malicious scripts in the context of the affected application.

A reflected cross-site scripting (XSS) vulnerability exists in Esri Portal for ArcGIS versions 12.1 and earlier. This flaw allows a remote, unauthenticated attacker to craft a malicious link that, when clicked by a victim, could execute arbitrary JavaScript in the victim's browser. A patch is available for supported ArcGIS Server versions including 11.5. Versions in mature or retired status are not eligible for patches. Users with unlisted versions are advised to upgrade and apply the patch.

A stored cross-site scripting (XSS) vulnerability exists in the bPlugins Button Block plugin up to version 1.2.7. This vulnerability allows improper neutralization of input during web page generation, which can lead to execution of malicious scripts in the context of the affected web application.

A reflected cross-site scripting (XSS) vulnerability exists in Esri Portal for ArcGIS versions 12.1 and earlier. This vulnerability allows a remote, unauthenticated attacker to craft a malicious link that, when clicked by a victim, could execute arbitrary JavaScript in the victim's browser. A patch is available for supported ArcGIS Server versions including 12.1, 12.0, 11.5, 11.3, and 11.1. Versions in mature or retired status are not eligible for patches, and users of those versions are advised to upgrade to a supported version and apply the patch.

A stored cross-site scripting (XSS) vulnerability exists in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery versions up to 1.3.7. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers with low privileges to execute malicious scripts in the context of other users. The vulnerability has a medium severity rating with a CVSS score of 6.5.