Search: xss.is

CVE-2026-96358 is a Cross-Site Scripting (XSS) vulnerability in the Drupal Webform module caused by improper neutralization of input during web page generation. It affects Webform versions from 0.0.0 up to but not including 6.2.12, and from 6.3.0 up to but not including 6.3.1. The vulnerability allows an attacker with low privileges to execute scripts in the context of the user's browser. The issue has been fixed in versions 6.2.12 and 6.3.1.

CVE-2026-96359 is a Cross-Site Scripting (XSS) vulnerability in the Drupal Webform module. It arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The vulnerability affects Webform versions from 0.0.0 up to but not including 6.2.12, and from 6.3.0 up to but not including 6.3.1. Fixed versions are 6.2.12 and 6.3.1. The CVSS score is 4.6 (medium severity).

CVE-2026-96362 is a Cross-Site Scripting (XSS) vulnerability in the Drupal Webform module. It affects Webform versions from 0.0.0 up to but not including 6.2.12, and from 6.3.0 up to but not including 6.3.1. The vulnerability involves improper neutralization of input during web page generation, which could allow an attacker to inject malicious scripts. The issue has been fixed in versions 6.2.12 and 6.3.1.

CVE-2026-96363 is a vulnerability in the Drupal Webform module where a privilege is defined with unsafe actions, leading to a stored cross-site scripting (XSS) issue. This affects Webform versions from 0.0.0 up to but not including 6.2.12, and from 6.3.0 up to but not including 6.3.1. The vulnerability has a low severity score and requires high privileges and user interaction to exploit.

CVE-2026-96367 is a vulnerability in the Drupal Webform module where a privilege is defined with unsafe actions, leading to a stored cross-site scripting (XSS) issue. It affects Webform versions from 0.0.0 up to but not including 6.2.12 and from 6.3.0 up to but not including 6.3.1. The vulnerability has a medium severity with a CVSS score of 4.6.

CVE-2026-96368 is a stored cross-site scripting (XSS) vulnerability in the Drupal Webform module. It affects Webform versions from 0.0.0 up to but not including 6.2.12, and from 6.3.0 up to but not including 6.3.1. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers with limited privileges to inject malicious scripts. This flaw has a medium severity rating with a CVSS score of 4.6. Fixed versions 6.2.12 and 6.3.1 address the issue.

CVE-2026-96371 is a vulnerability in the Drupal Webform module where a privilege is defined with unsafe actions, leading to a stored cross-site scripting (XSS) issue. This affects Webform versions from 0.0.0 up to but not including 6.2.12, and from 6.3.0 up to but not including 6.3.1. The vulnerability allows an attacker with limited privileges to perform stored XSS attacks without user interaction. The issue has been fixed in versions 6.2.12 and 6.3.1.

CVE-2026-96357 is a stored cross-site scripting (XSS) vulnerability in the Drupal Webform module. It affects Webform versions from 0.0.0 up to but not including 6.2.12, and versions from 6.3.0 up to but not including 6.3.1. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. The issue has been fixed in versions 6.2.12 and 6.3.1.

CVE-2026-96379 is a stored cross-site scripting (XSS) vulnerability in the Drupal CookieCuttr module. It affects versions from 2.0.0 up to but not including 2.0.3. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. The issue has been fixed in version 2.0.3. The CVSS score is 3.5, indicating a low severity impact.

CVE-2026-96382 is a stored cross-site scripting (XSS) vulnerability in the Drupal Diba carousel slider module. It affects versions from 0.0.0 up to but not including 3.0.2. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The issue has a medium severity with a CVSS score of 4.6. A fix is available in version 3.0.2.

The LIFF SDK provided by LY Corporation contains a cross-site scripting (XSS) vulnerability. This vulnerability could allow an attacker to inject malicious scripts into web pages viewed by other users. No specific affected versions or patch information are provided.

CVE-2025-69723 is a reflected cross-site scripting (XSS) vulnerability in localstack version 4.9.2. This flaw allows attackers to execute arbitrary JavaScript in the context of a user's browser by crafting a malicious URL. The vulnerability has a CVSS score of 6.1, indicating a medium severity level.

CVE-2025-65200 is a critical cross-site scripting (XSS) vulnerability in localstack version 4.9.2. It allows attackers to execute arbitrary code by supplying crafted content hosted on a web-accessible URL to the templateURL parameter of the _localstack/cloudformation/deploy endpoint. This content can then be executed within the context of the localstack Docker container.

CVE-2026-107588 is a high-severity cross-site scripting (XSS) vulnerability in Vaadin Charts, which uses a pinned version of the Highcharts library. The vulnerability arises from multiple vectors in the chart configuration, including Object.prototype writes via series.keys paths and XSS through credits.href, breadcrumbs.style, HTML text parsing during printing, and xlink:href attributes in exported charts. Applications are vulnerable if attacker-controlled data reaches these chart configuration options. Vaadin has released fixed versions that apply Highsoft's recommended workarounds while keeping the same Highcharts versions.

A stored cross-site scripting (XSS) vulnerability exists in Nuxt versions from 3.13.0 up to but not including 4.6.2. The issue arises because the server-island renderer improperly serializes raw useHeadSafe input without preserving its safe-input marker, allowing attacker-controlled data to be injected into the page head. This can lead to execution of malicious scripts in the context of the affected application. The vulnerability is fixed in Nuxt version 4.6.2.

The Drupal Bootstrap theme contains a cross-site scripting (XSS) vulnerability due to insufficient filtering of certain attributes. This issue specifically affects the optional tooltip and popover features. A short-term mitigation is to disable these features via the theme settings in the Drupal admin interface. A patch is available to address this vulnerability.

The Block Attributes module for Drupal allows defining custom attributes for blocks but insufficiently sanitizes these attributes, leading to a cross-site scripting (XSS) vulnerability. Exploitation requires the attacker to have the 'administer blocks' permission, which limits the attack surface. A patch is available to address this issue.

The Drupal UI Icons module includes a CKEditor 5 button and widget that embed icons in formatted text. Under uncommon conditions, the widget can display admin-controlled text with insufficient filtering, leading to a Cross-site scripting (XSS) vulnerability. Exploitation requires the attacker to have permission to edit content using a text format that enables the UI Icons CKEditor 5 button. Patches are available for affected versions.