CVE-2026-112863 is a reflected cross-site scripting (XSS) vulnerability in Hogash KALLYAS versions up to and including 4.25.0. The flaw arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. This vulnerability has a high severity rating with a CVSS score of 7.1.
i18next-http-backend version 4.0.2 contains an incomplete fix in the interpolateUrl() function that allows attackers to manipulate translation request URLs by supplying a namespace value starting with a slash. This can lead to loading attacker-hosted translations, enabling UI content injection and cross-site scripting (XSS). The vulnerability is fixed in version 4.0.3.
CVE-2026-55422 is a cross-site scripting (XSS) vulnerability in the conda-forge.github.io website, which is part of the conda-forge GitHub organization. The issue arises because two React components render externally sourced strings directly as HTML using dangerouslySetInnerHTML without sanitization. These strings include raw output from build logs and other process outputs embedded in JSON files generated by the conda-forge autotick bot. At the time of disclosure, no patches are publicly available.
CVE-2026-56840 is a high-severity cross-site scripting (XSS) vulnerability in MervinPraison's PraisonAI multi-agent teams system. Versions from 4.5.2 up to but not including 4.6.59 are affected. The vulnerability occurs because the HTTPApproval component renders attacker-controlled tool approval arguments directly into the approval dashboard HTML without proper sanitization. This allows an attacker to inject JavaScript that executes in the context of the dashboard when a human reviews the approval request. The injected script can automatically approve the tool request by sending a POST request to the approval endpoint. The issue has been fixed in version 4.6.59.
CGM CLININET contains a reflected Cross-Site Scripting (XSS) vulnerability due to improper neutralization of user-supplied input. An unauthenticated remote attacker can craft a malicious URL that executes JavaScript or HTML in a victim's browser, potentially allowing session cookie theft and unauthorized actions within the application. The vulnerability affects versions up to 2025.MS3. The product is a cloud service, and a patch is available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects VikRentCar: from n/a through 1.4.8.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Stored XSS.This issue affects VikRentCar: from n/a through 1.4.8.
CVE-2026-4952 is a cross-site scripting (XSS) vulnerability in the VertiGIS Ltd. WebOrderSystem (AuftragsManager) version 7.0.8.6 and earlier. Authenticated users can inject JavaScript code into a business reference field via the ASMobile web interface. While initially this self-XSS affects only the user entering the data, the malicious script is stored and later executed when a highly privileged user views the order in the OrderAdministration portal. No patch information is provided by the vendor.
CVE-2026-4951 is a cross-site scripting (XSS) vulnerability in VertiGIS Ltd.'s WebOrderSystem (KundenManager) version 7.0.8.6 and earlier. The vulnerability arises from improper handling of the "searchValue" URL parameter in the CustomerAdministration portal, allowing JavaScript code injection. An unauthenticated attacker can craft a malicious URL that executes script code in the browser of a privileged user who opens the link. Since administrative users can change other users' passwords without requiring the old password, exploitation could lead to account takeover or user lockout.
CVE-2026-4950 is a cross-site scripting (XSS) vulnerability in VertiGIS Ltd.'s WebOrderSystem (KundenManager) portal. Privileged users can inject JavaScript code into user properties such as the "secondName" parameter. This malicious code is stored and executed in the browsers of other privileged users who view the affected user entries or user group overviews. The vulnerability affects version 7.0.8.6 and earlier versions up to 0. No information on patches or fixed versions has been provided by the vendor.
A stored cross-site scripting (XSS) vulnerability exists in the User Profile Builder WordPress plugin versions before 4.0.5. The flaw arises because one shortcode attribute is not properly sanitized or escaped before being output in a redirect message. This allows users with contributor-level roles to inject malicious scripts that execute in the context of higher-privileged users who submit the affected form.
CVE-2026-109936 is a stored Cross-Site Scripting (XSS) vulnerability in the Otter Blocks WordPress plugin versions before 3.2.8. The flaw arises because the plugin does not properly limit a pattern used to rewrite dynamic-content tokens, allowing the pattern to consume the closing quote of an HTML attribute and inject unescaped data as new attributes. This enables unauthenticated attackers to inject malicious scripts that execute in the browsers of any visitors viewing the affected pages, including administrators.
CVE-2026-109933 is a cross-site scripting (XSS) vulnerability in the Otter Blocks WordPress plugin before version 3.2.8. It occurs because the plugin does not properly sanitize and escape user-supplied block styling values before embedding them into inline stylesheets. This flaw allows users with contributor-level access or higher to inject arbitrary scripts that execute when any visitor, including administrators, views the affected post. The vulnerability is fixed in version 3.2.8.
CVE-2026-59188 is a cross-site scripting (XSS) vulnerability in Part-DB-server versions prior to 2.12.3. The server incorrectly sanitizes SVG files based on the file extension rather than the actual content type, allowing authenticated attackers to upload malicious SVG files disguised with non-SVG extensions. When users view these attachments inline, the embedded JavaScript executes in the context of the Part-DB origin. This vulnerability has been fixed in version 2.12.3.
CVE-2026-55600 is a stored cross-site scripting (XSS) vulnerability in Part-DB-server versions prior to 2.12.2. The issue arises because Part-DB renders BOM validation messages using Twig's |raw filter, allowing user-controlled Part names containing HTML markup to be injected. Although JavaScript execution is blocked by the Content Security Policy, arbitrary HTML elements such as links, forms, images, and CSS can still be injected into trusted pages. This vulnerability has been fixed in version 2.12.2.
CVE-2026-54615 is a stored cross-site scripting (XSS) vulnerability in Part-DB-server versions prior to 2.12.1. The flaw arises from a missing HTML escaping step in the CollectionElementDeleted branch of LogEntryExtraFormatter, allowing user-controlled names of deleted collection sub-elements to be injected as raw HTML in activity log and element history tables. This enables a low-privileged user to inject malicious scripts that execute in the browsers of higher-privileged users viewing the logs. The vulnerability is mitigated by Content Security Policy (CSP) restrictions that block inline JavaScript under normal conditions. The issue has been fixed in version 2.12.1.
CVE-2026-115536 is a cross-site scripting (XSS) vulnerability in the gedelumbung HospitalManagement software affecting the simpan function in application/modules/admin/controllers/routing_pages.php. The vulnerability allows remote attackers to inject malicious scripts via the content argument. The product uses a rolling release system, so specific affected or fixed versions are not disclosed. Public exploit code is available. The vendor has been informed but has not yet responded or issued a fix.