Search: xss.is

CVE-2024-5139 is a cross-site scripting (XSS) vulnerability in the Authentication Endpoint of WSO2 Enterprise Integrator. The endpoint improperly encodes user input, allowing attackers to inject malicious JavaScript. Exploitation can lead to browser redirection, UI manipulation, or theft of sensitive browser information. Session hijacking is prevented by the httpOnly flag on session cookies. Multiple versions prior to specific fixed releases are affected.

Trudesk versions up to 1.2.11 have an unrestricted file upload vulnerability allowing authenticated users to upload HTML or SVG files to the public webroot. This can enable stored cross-site scripting (XSS) attacks and unauthorized replacement of instance branding by uploading script-bearing files disguised as images.

e107 CMS versions from 2.2.0 up to but not including 2.3.13 contain a reflected cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject malicious HTML and JavaScript by manipulating the author GET parameter in search.php. The vulnerability arises because the author parameter is parsed and concatenated unescaped into an HTML input tag, enabling script injection. The issue is fixed in version 2.3.13.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in geekontheroad Live Summary for Gravity Forms live-summary-for-gravity-forms allows Reflected XSS.This issue affects Live Summary for Gravity Forms: from n/a through 1.2.10.

CVE-2026-110899 is a stored cross-site scripting (XSS) vulnerability in the Ninja Forms plugin by Kevin Stover. It affects all versions from initial releases up to and including 3.15.5. The vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. A fix is available in version 3.15.6.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.12.

SvelteKit versions before 3.0.0 have a cross-site scripting (XSS) vulnerability in prerendered pages. This occurs because a cache-control header value set via setHeaders is inserted without proper escaping into a <meta http-equiv="cache-control"> tag. An attacker able to influence this untrusted value at prerender time can inject HTML or JavaScript that executes when users visit the page. The vulnerability is fixed in version 3.0.0.

IBM Carbon Charts versions 0.4.0 through 1.27.19 contain a cross-site scripting (XSS) vulnerability in the MeterChart component. The vulnerability arises because the Title.truncateTitle() function unsafely inserts a substring of user-supplied label text into the DOM using innerHTML without proper sanitization. This flaw allows a remote attacker to execute arbitrary JavaScript in the context of the victim's browser session.

A cross-site scripting (XSS) vulnerability exists in the ReadingMode feature of Google Chrome prior to version 156.0.8078.47. This flaw allows a remote attacker to spoof user interface elements by crafting a malicious HTML page. The vulnerability has been assigned a high severity due to its potential impact on confidentiality, integrity, and availability. A fix is available in Chrome version 156.0.8078.47.

Cachet versions 2.4.1 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability in the incident creation form. This flaw allows an authenticated attacker to inject malicious HTML or JavaScript, which executes in the browsers of users viewing the status page. Exploitation could lead to session token theft and account takeover. The issue has been patched in later commits in the cachethq/core repository.

CVE-2026-111088 is a stored Cross-Site Scripting (XSS) vulnerability in the Stormshield Network Security product, specifically affecting the VPN log monitoring screen. The flaw allows an attacker with low privileges to inject malicious scripts that can be executed in the context of other users viewing the logs. The vulnerability affects multiple versions of the product from 4.3.0 through 5.1.3. The CVSS 3.1 base score is 6.5, indicating a medium severity impact primarily on confidentiality. No public exploits or patches are currently documented.

CVE-2026-113810 is a stored Cross-Site Scripting (XSS) vulnerability in the Stormshield Network Security enrollment portal. An attacker can inject malicious scripts via the captive portal when requesting certificate creation for a user. The stored XSS payload is triggered only during validation by an administrator.

CVE-2026-113808 is a stored Cross-Site Scripting (XSS) vulnerability in the Stormshield Network Security (SNS) enrollment portal. An attacker can inject malicious scripts via the captive portal during user creation requests. The stored XSS payload is triggered only when an administrator validates the input. This vulnerability affects multiple versions of the product and has a high severity rating with a CVSS score of 7.1.

ApostropheCMS versions prior to 4.33.0 are affected by a cross-site scripting (XSS) vulnerability due to unsafe handling of meta refresh elements in the sanitize-html library before version 2.18.0. This flaw allows unsafe script or redirect destinations to be retained in the refresh content value under a non-default configuration. The issue is fixed in sanitize-html 2.18.0 and ApostropheCMS 4.33.0.

ApostropheCMS versions prior to 4.33.0 contain a cross-site scripting (XSS) vulnerability in the admin bundle. An unauthenticated attacker can craft a link with a specially constructed query string that exploits the apos.http.parseQuery function's handling of prototype-related keys. When an authenticated admin user loads a page with this crafted link, malicious script can execute in their session. This vulnerability is fixed in version 4.33.0.

ApostropheCMS versions prior to 4.33.0 and sanitize-html versions from 2.17.7 up to but not including 2.18.0 contain a cross-site scripting (XSS) vulnerability. This occurs due to a bypass in the SMIL URL protection when namespace-prefixed SVG animation elements and certain URL-targeting attributes are allowed, enabling unsafe URI rewriting and script execution upon user interaction. The default sanitizer configuration is not universally affected. The issue is fixed in sanitize-html 2.18.0 and ApostropheCMS 4.33.0.

ApostropheCMS versions prior to 4.33.0 are affected by a cross-site scripting (XSS) vulnerability due to improper sanitization of noscript tag content in the sanitize-html library before version 2.18.0. This flaw allows content intended to be inert to survive sanitization and render in scripting-enabled browsers, potentially enabling XSS attacks. The issue is fixed in sanitize-html 2.18.0 and ApostropheCMS 4.33.0.