The Bit integrations plugin for WordPress versions up to 2.10.6 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from insufficient input sanitization and output escaping of the 'field mapped to notification_content' parameter. An unauthenticated attacker can inject malicious scripts that execute when a user views the affected page. Exploitation requires a specific configuration involving a Bit Integrations flow and knowledge of the flow's UUID callback URL.
AcyMailing plugin for WordPress versions up to and including 11.1.0 is vulnerable to stored Cross-Site Scripting (XSS) via the customField[] parameter in the public frontusers::subscribe endpoint. The vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when users access the affected subscriber's online archive page, including administrators viewing subscriber history.
CVE-2026-67165 is a cross-site scripting (XSS) vulnerability in HCL Connections. It allows an attacker to inject and execute arbitrary script code in the browser of a user. This can lead to theft of cookie-based authentication credentials and compromise of the user's account. The vulnerability has a medium severity with a CVSS score of 5.4. No affected versions or patch information are provided.
The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing users with the Author role and above to store JavaScript that executes in the session of any user viewing the testimonials, including administrators.
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal content, or user redirection. This results in a low impact on confidentiality and integrity. There is no impact on availability.
Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenticated attacker to send malicious content to another user. If the victim interacts with the affected content, malicious scripts could be executed in the victim's browser context. This vulnerability has a low impact on the confidentiality and integrity of the data and no impact on the availability of the application.
Due to a DOM-Based Cross-Site Scripting (XSS) vulnerability, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user accesses this link, client-side code reads the attacker-controlled input and writes it into the DOM without proper sanitization, causing attacker-supplied script to execute in the victim�s browser context. This could allow the attacker to access or modify information within the victim�s browser scope, impacting confidentiality and integrity, while availability remains unaffected.
Due to a Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application. If an authenticated victim accesses a page that displays this stored content, the injected input is processed during web page generation, resulting in the execution of malicious content in the victim�s browser context. This could allow the attacker to access or modify information within the victim�s browser scope. Successful exploitation could allow the attacker to access session information, modify rendered page content and disrupt the victim's use of the application, resulting in a low impact on confidentiality, integrity and availability.
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input.
IBM Planning Analytics 2.0, and 2.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
IBM DB2 Recovery Expert for Linux, UNIX and Windows version 5.5 IF 2 contains a cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject arbitrary JavaScript into the web user interface, potentially altering its behavior and leading to credential disclosure within a trusted session. The vulnerability has a CVSS 3.1 base score of 6.1, indicating a medium severity level.
IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 contains a cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject arbitrary JavaScript into the web user interface, potentially altering functionality and leading to credential disclosure within a trusted session. The vulnerability has a CVSS 3.1 base score of 6.1, indicating a medium severity level.
IBM Db2 Recovery Expert for Linux, UNIX and Windows version 5.5 IF 2 contains a cross-site scripting (XSS) vulnerability. This flaw allows an unauthenticated attacker to inject arbitrary JavaScript code into the web user interface, potentially altering its intended functionality. Exploitation could lead to disclosure of credentials within a trusted session. The vulnerability has a CVSS v3.1 base score of 6.1, indicating a medium severity level. No specific affected versions beyond 5.5 IF 2 are stated, and no patch or remediation information is provided.
Progress MarkLogic Server versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, contain a cross-site scripting (XSS) vulnerability. This flaw allows remote attackers to execute scripts in the context of an authenticated user's browser session, potentially leading to unauthorized actions or disclosure of information accessible to that user. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).
CVE-2026-105410 is a stored Cross-site Scripting (XSS) vulnerability in Dassault Systèmes Tuleap Enterprise Edition versions 17.0-1 through 17.0-41 and 17.5-1 through 17.5-32. This flaw allows an attacker to inject and execute arbitrary script code in the browser session of users. The vulnerability is classified as high severity with a CVSS score of 8.7, indicating significant impact on confidentiality and integrity. No information about available patches or vendor advisories is provided.
CVE-2026-105409 is a stored Cross-site Scripting (XSS) vulnerability in Dassault Systèmes Tuleap Enterprise Edition versions 17.0-1 through 17.0-41 and 17.5-1 through 17.5-32. This vulnerability allows an attacker to inject and execute arbitrary script code within the browser session of a user. The vulnerability is classified as CWE-79, indicating improper neutralization of input during web page generation. It has a high severity with a CVSS score of 8.7, reflecting its potential impact on confidentiality and integrity. No information about available patches or vendor advisories is provided. No known exploits in the wild have been reported.
CVE-2026-105408 is a stored Cross-site Scripting (XSS) vulnerability in Dassault Systèmes Tuleap Enterprise Edition versions from 17.0-1 through 17.0-41 and 17.5-1 through 17.5-32. This vulnerability allows an attacker to inject and execute arbitrary script code in the browser session of a user. It has a high severity rating with a CVSS score of 8.7, indicating significant impact on confidentiality and integrity if exploited.
CVE-2026-48212 is a stored cross-site scripting (XSS) vulnerability in OTRS software that allows an administrator to inject arbitrary JavaScript into custom pages. This script is then executed in the browsers of users who access those pages. The vulnerability affects multiple versions of OTRS, including 7.0.x, 8.0.x, and yearly releases from 2023 through 2026 prior to 2026.7.x. The CVSS score is 4.8, indicating a medium severity level.
The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability (Administrator by default) to store a payload that is executed in the browser of any administrator who later opens that page. As the unfiltered_html capability is not available to administrators on multisite (or where DISALLOW_UNFILTERED_HTML is set), this leads to Stored Cross-Site Scripting.