Adobe Experience Manager 6.5 contains a stored Cross-Site Scripting (XSS) vulnerability that allows a low-privileged attacker to inject malicious scripts into form fields. When a victim views the affected page, the injected JavaScript may execute in their browser. This vulnerability affects versions from 0 up to and including 6.5.25. The issue has a medium severity rating with a CVSS score of 5.4.
Adobe Experience Manager 6.5 LTS is affected by a stored Cross-Site Scripting (XSS) vulnerability that allows low-privileged attackers to inject malicious scripts into vulnerable form fields. When a victim visits a page containing such a field, the malicious JavaScript may execute in their browser. This vulnerability has a medium severity rating with a CVSS score of 5.4. The scope of the vulnerability is changed, indicating impact beyond the initially vulnerable component.
Adobe Experience Manager 6.5 LTS is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability allows an attacker to manipulate the DOM environment to execute malicious JavaScript in the victim's browser context. Exploitation requires user interaction, specifically the victim visiting a crafted webpage. The vulnerability impacts confidentiality and integrity but not availability. The CVSS score is 5.4, indicating a medium severity level.
Adobe Experience Manager 6.5 LTS contains a stored Cross-Site Scripting (XSS) vulnerability that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. When a victim accesses the affected page, the malicious JavaScript may execute in their browser. This vulnerability affects versions up to and including 6.5.25. The vulnerability has a medium severity rating with a CVSS score of 5.4.
Adobe Experience Manager 6.5 LTS contains a stored Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious scripts into vulnerable form fields. When a victim accesses a page with such a field, the malicious script may execute in their browser, potentially leading to elevated access or control over the victim's account or session. This vulnerability has a critical severity rating with a CVSS score of 9.3.
Adobe Experience Manager 6.5 LTS contains a stored Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious scripts into vulnerable form fields. When a victim accesses a page with the injected script, the malicious JavaScript executes in their browser, potentially enabling attackers to gain elevated access or control over the victim's account or session. This vulnerability has a critical severity rating with a CVSS score of 9.3.
Adobe Experience Manager 6.5 LTS is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). This vulnerability allows an attacker to manipulate the DOM environment to execute malicious JavaScript in the victim's browser context. Exploitation requires user interaction, specifically the victim visiting a crafted webpage. The vulnerability impacts confidentiality and integrity but does not affect availability. The scope of the vulnerability is changed, indicating that the impact crosses security boundaries.
Vitess contains a reflected cross-site scripting (XSS) vulnerability in the twopczHandler of the vttablet component. The vulnerability arises because the Action and dtid form values are reflected into the HTML response without proper HTML escaping. This flaw allows an attacker to craft URLs that execute JavaScript in the operator's browser with same-origin access to sensitive debug endpoints. The issue affects all released versions up to the current latest releases and was fixed only on the main development branch as of June 2026. No official CVE or advisory existed at the time of reporting.
VNote versions prior to 4.3.0 contain a stored cross-site scripting (XSS) vulnerability due to unsafe insertion of YAML frontmatter metadata into the DOM before sanitization. This allows execution of attacker-supplied JavaScript when opening a malicious Markdown note. The vulnerability enables local note files to be read and exfiltrated to remote servers without user interaction. The issue is fixed in version 4.3.0.
CVE-2026-96230 is a high-severity cross-site scripting (XSS) vulnerability in Microsoft Visual Studio 2022 affecting specific versions prior to 17.14.42, 18.10.4, and 10.0.13. The flaw arises from improper input neutralization during web page generation in ASP.NET Core, allowing unauthorized attackers to execute code remotely. Official patches have been released to address this issue.
CVE-2026-70279 is a critical cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2016 Cumulative Update 23. It involves improper neutralization of input during web page generation, allowing an unauthorized attacker to perform spoofing attacks over a network. The vulnerability affects multiple versions prior to specific fixed releases. An official fix is available from Microsoft.
CVE-2026-97783 is a high-severity cross-site scripting (XSS) vulnerability in Microsoft SharePoint Enterprise Server 2016. It involves improper neutralization of input during web page generation, allowing an unauthorized attacker to perform spoofing attacks over a network. The vulnerability affects multiple versions prior to specific fixed releases. An official fix is available from Microsoft.
CVE-2026-88208 is a cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server Subscription Edition. It allows an authorized attacker to perform spoofing attacks by exploiting improper input neutralization during web page generation. The vulnerability affects versions from 16.0.0 up to but not including 16.0.20326.20190. A patch is available and has been officially released by Microsoft.
CVE-2026-88209 is a cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server Subscription Edition. It allows an authorized attacker to perform spoofing attacks by exploiting improper input neutralization during web page generation. The vulnerability affects versions from 16.0.0 up to but not including 16.0.20326.20190. A patch is available in version 16.0.20326.20190.
CVE-2026-88204 is a high-severity cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server Subscription Edition. It allows an authorized attacker to perform spoofing attacks over a network by exploiting improper input neutralization during web page generation. The vulnerability affects versions from 16.0.0 up to but not including 16.0.20326.20190. An official fix is available in version 16.0.20326.20190.
CVE-2026-102864 is a cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server Subscription Edition. It involves improper neutralization of input during web page generation, allowing an authorized attacker to perform spoofing over a network. The vulnerability affects versions from 16.0.0 up to but not including 16.0.20326.20190. A fix is available in version 16.0.20326.20190. The CVSS 3.1 base score is 4.6, indicating medium severity.
CVE-2026-102859 is a cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server Subscription Edition. It involves improper neutralization of input during web page generation, allowing an authorized attacker to perform spoofing attacks over a network. The vulnerability affects versions 16.0.0 up to but not including 16.0.20326.20190. A patch is available in version 16.0.20326.20190.
Misskey versions from 12.0.0 up to but not including 2026.7.0 contain a cross-site scripting (XSS) vulnerability in their RSS components. The issue arises because feed item links are displayed without verifying their URL schemes, allowing attackers controlling feed content to inject unsafe links that execute scripts when clicked in an RSS widget. This vulnerability is fixed in version 2026.7.0.
Adobe Commerce contains a stored Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious scripts into vulnerable form fields. When a victim visits a page with the injected script, the malicious JavaScript executes in their browser, potentially leading to elevated access or control over the victim's account or session. This vulnerability has a critical severity rating with a CVSS score of 9.3.
Adobe Commerce contains a stored Cross-Site Scripting (XSS) vulnerability that allows a high-privileged attacker to inject malicious scripts into vulnerable form fields. When a victim accesses the affected page, the malicious JavaScript executes in their browser, potentially allowing the attacker to gain elevated access or control over the victim's account or session. This vulnerability changes the security scope and has a high severity rating.