Adobe Commerce contains a stored Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious scripts into vulnerable form fields. When a victim visits a page with the injected script, the malicious JavaScript executes in their browser, potentially leading to elevated access or control over the victim's account or session. This vulnerability has a critical severity rating with a CVSS score of 9.3.
Adobe Commerce contains a stored Cross-Site Scripting (XSS) vulnerability that allows a high-privileged attacker to inject malicious scripts into vulnerable form fields. When a victim accesses the affected page, the malicious JavaScript executes in their browser, potentially allowing the attacker to gain elevated access or control over the victim's account or session. This vulnerability changes the security scope and has a high severity rating.
Adobe Commerce contains a stored Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious scripts into form fields. When a victim accesses the affected page, the malicious script may execute in their browser, potentially leading to elevated access or control over the victim's account or session. This vulnerability has a critical severity rating with a CVSS score of 9.3.
Adobe Commerce contains a stored Cross-Site Scripting (XSS) vulnerability that allows low-privileged attackers to inject malicious scripts into form fields. When victims visit the affected pages, the injected scripts may execute in their browsers, potentially leading to elevated access or control over their accounts or sessions. This vulnerability has a high severity score of 8.7 and affects version 0 of Adobe Commerce. No patch or remediation information is currently provided.
Shopware version 6.7 contains a stored cross-site scripting (XSS) vulnerability due to the upload of attacker-controlled HTML files served without effective security headers. This allows an attacker to execute JavaScript in the context of an administrator's session, potentially stealing authentication tokens. With these tokens, attackers can access the Shopware Administration API and, if the compromised administrator has extension-management privileges, install malicious plugins to execute arbitrary PHP code on the server.
CVE-2026-104250 is a stored cross-site scripting (XSS) vulnerability in the unstructured library prior to version 0.24.1. When unstructured parses untrusted HTML documents and outputs them as HTML, it fails to escape malicious markup such as event handlers (e.g., onerror, onmouseover) and javascript: URLs. This allows embedded scripts to execute automatically in a viewer's browser when the output is rendered. The vulnerability affects the to_html() function and related HTML output paths. Exploitation can occur without user interaction, leading to information disclosure and potential privileged actions in ingestion pipelines where untrusted documents are reviewed in a web UI.
CVE-2026-55562 is a critical cross-site scripting (XSS) vulnerability in jhuckaby Cronicle versions prior to 0.9.119. The flaw exists in the administrator Activity Log where attacker-controlled user full names are inserted into HTML without proper encoding. This allows an authenticated non-administrator or an anonymous attacker (if free_accounts is enabled) to inject malicious scripts that execute in an administrator's session, potentially leading to administrator takeover and command execution. The issue is fixed in version 0.9.119.
CVE-2026-102989 is a critical cross-site scripting (XSS) vulnerability in TanStack router affecting multiple related packages. An unauthenticated attacker can craft a malicious URL that causes the application to return attacker-controlled HTML and execute JavaScript in the context of the victim's browser. This allows access to same-origin data and the ability to make requests with the victim's authority. The issue arises from improper handling of server-function input and response validation. Patched versions are available and upgrading is recommended. Temporary mitigations include edge or WAF rules and restrictive Content Security Policies, but these are not complete fixes.
Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in comment_html. A project member can store a crafted link in a comment, and attacker-controlled script executes in the browser context of another user who selects the link. This issue is fixed in version 1.4.0.
MCP Context Forge provides an MCP Admin UI for managing gateway resources. From 0.2.0 until 0.3.1, the Global Prompts feature stores a prompt template without sufficient output encoding before the MCP Admin UI renders it. An authenticated attacker can save markup containing script-capable event handlers, and the code executes when another user views the saved prompt. The stored cross-site scripting can alter the interface, present phishing content, observe keystrokes available to the page, and act with the viewer's browser session. This issue is fixed in version 0.3.1.
CVE-2026-102342 is a stored cross-site scripting (XSS) vulnerability in the rust-ammonia library, which is used to sanitize untrusted HTML. Versions prior to 3.3.3, 4.0.3, and 4.1.4 allow SVG animate or set elements with an attributeName targeting href and a javascript scheme value to persist. This enables attackers to embed script-bearing links that execute attacker-controlled scripts in the application's origin when clicked. The issue is fixed in versions 3.3.3, 4.0.3, and 4.1.4.
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or escape data received from the backend before rendering it in the user interface. Because the front end is integrated with Node.js, this vulnerability allows for the execution of arbitrary JavaScript, which can be leveraged to achieve remote code execution (RCE) on the victim's machine
Siemens SIMATIC Drive Controller CPU 1504D TF devices have a cross-site scripting (XSS) vulnerability due to improper sanitization of calculated signal data in imported files. An attacker can craft a malicious file that, when imported by an authorized user with 'Read diagnostics' rights, executes attacker-controlled JavaScript in the user's browser. This could allow the attacker to perform PLC operations within the user's authorization scope. The vulnerability has a CVSS score of 6.1 (medium severity).
Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on the Trace page.
This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Attacker-controlled JavaScript could be executed in the user’s browser session when the resulting error message is displayed.
Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the Trace page.
This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Attacker-controlled JavaScript could be executed in the user’s browser session when the user subsequently interacts with an affected selection menu.
CVE-2026-63354 is a critical cross-site scripting (XSS) vulnerability in Siemens SIMATIC Drive Controller CPU 1504D TF. The issue arises because the device does not properly validate or sanitize visual marker data in imported CSV trace files before displaying it on the Trace page. An attacker could trick an authorized user with the “Read diagnostics” permission into importing a maliciously crafted trace file. This could lead to execution of attacker-controlled JavaScript in the user's browser session, potentially allowing unauthorized PLC operations within the user's authorization scope.
Siemens SIMATIC Drive Controller CPU 1504D TF devices have a cross-site scripting (XSS) vulnerability due to improper sanitization of comment fields in imported trace files. An attacker can craft a malicious trace file that, when imported by an authorized user with 'Read diagnostics' rights, executes attacker-controlled JavaScript in the user's browser. This can lead to unauthorized PLC operations within the user's authorization scope. The vulnerability has a critical severity with a CVSS score of 9.6.
Siemens SIMATIC Drive Controller CPU 1504D TF devices improperly sanitize calculated signal data from imported CSV trace files before rendering on the Trace page. This vulnerability allows an attacker to craft a malicious trace file that, when imported by an authorized user with 'Read diagnostics' rights, can execute attacker-controlled JavaScript in the user's browser session. The script could perform PLC operations within the user's authorization scope. The CVSS score is 6.1, indicating a medium severity vulnerability.
Affected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before rendering them on the Trace page.
This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.
CVE-2026-96535 is a medium severity cross-site scripting (XSS) vulnerability in the YouMind web application, specifically in the avatar update endpoint. The issue arises when users set their profile picture via an arbitrary URL pointing to an SVG image containing embedded JavaScript. Due to insufficient sanitization and validation of SVG content, the malicious script executes in the context of the CDN domain serving the image. This vulnerability has a CVSS 4.0 base score of 5.1 and requires user interaction with low privileges to exploit. No patch or official remediation has been provided yet.