SolarWinds Observability Self-Hosted contains a stored Cross-Site Scripting (XSS) vulnerability (CWE-79) that allows authenticated attackers to inject malicious scripts. These scripts execute in the browsers of other authenticated users who visit the affected pages, potentially leading to information disclosure or session manipulation. The vulnerability has a CVSS score of 4.6, indicating medium severity. No specific affected versions or patches have been disclosed yet.
A reflected cross-site scripting (XSS) vulnerability exists in the VPL (Virtual Programming Lab) plugin for Moodle versions prior to 5.0.0. The flaw allows remote attackers to inject malicious scripts via unencoded filename1 and filename2 parameters in the similarity/diff.php script. Exploitation requires a user with mod/vpl:similarity capability to open a crafted link, which then executes the injected JavaScript in their session context.
### Summary
The color field accepts any string that *begins* with a valid `rgb()` / `hsl()` color, because `TinyColor.isValid` does not anchor its match at the end of the string. An authenticated user with edit rights can store arbitrary HTML after a valid color prefix. When the stored value is rendered , the payload executes, resulting in stored XSS.
### Details
Server-side validation of the color field relies on TinyColor:
```js
const { TinyColor } = require('@ctrl/tinycolor');
if (!new TinyColor(value).isValid) throw self.apos.error('invalid');
```
TinyColor's `rgb`/`hsl` matchers are not anchored at the end of the string, while hex matchers are. Tested with @ctrl/tinycolor
| Input | `isValid` |
|---|---|
| `rgb(1,2,3)<img src=x onerror=alert(1)>` | `true` |
| `rgb(1,2,3)</textarea><script>alert(1)</script>` | `true` |
| `hsl(0,100%,50%);--x:1}</style><script>alert(1)</script>` | `true` |
| `#ff0000<img src=x onerror=alert(1)>` | `false` |
The value is saved to MongoDB unchanged (not normalized to hex8).
### Relation to GHSA-97v6-998m-fp4g
GHSA-97v6 addressed CSS custom property injection escaping a `<style>` context. The root cause (validation that accepts trailing content after a valid color) still exists in <= 4.32.2, so [FILL IN: either "the style-tag sink remains exploitable via `</style>`" OR "a separate HTML sink at X is exploitable"]. Fixing the validation (requiring the full string to be a color, or storing only TinyColor's normalized output) would close both.
### Impact
Any user with edit permission can plant persistent JavaScript that runs in the browser of visitors and administrators viewing the affected page, enabling session hijacking and actions as an admin.
### Suggested fix
Reject values unless the entire string is a valid color, e.g. normalize on save:
```js
const c = new TinyColor(value);
if (!c.isValid) throw self.apos.error('invalid');
value = c.toHex8String(); // store only normalized output
```
CVE-2026-111843 is a stored cross-site scripting (XSS) vulnerability in CozyThemes Rootblox versions prior to 1.0.8. It arises from improper neutralization of input during web page generation, allowing attackers with limited privileges to inject malicious scripts that can impact confidentiality, integrity, and availability. The issue is fixed in version 1.0.8.
CVE-2026-112840 is a stored cross-site scripting (XSS) vulnerability in Brainstorm Force's SureCart plugin, affecting versions prior to 4.9.6. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers with low privileges to execute malicious scripts. The vulnerability is rated medium severity with a CVSS score of 6.5. A fix is available in version 4.9.6.
CVE-2026-112945 is a cross-site scripting (XSS) vulnerability in the Vite frontend tooling framework affecting versions prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3. The flaw arises when applications using custom middleware pass an unchanged browser request URL to server.transformIndexHtml, allowing attacker-controlled module execution via crafted development-server pages. This can expose sensitive data or permit critical actions in the affected application. The issue has been fixed in the specified versions.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Stored XSS.This issue affects Seriously Simple Podcasting: from n/a through 3.17.0.
Cypht webmail versions 2.0.0 through 2.12.2 have a DOM-based cross-site scripting (XSS) vulnerability. This flaw allows remote attackers to execute arbitrary JavaScript by sending specially crafted emails containing malicious alt text or URL values in external image tags when the ALLOW_EXTERNAL_IMAGE_SOURCES setting is enabled. Exploitation occurs when the victim opens the email, triggering script execution in their authenticated session. This can lead to unauthorized mailbox reading, email sending, or settings modification.
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ticimax Informatics Technologies Inc. Ticimax E-Commerce Platform allows Reflected XSS.
This issue affects Ticimax E-Commerce Platform: through 2026-09-02.
Chatwoot versions prior to 4.14.0 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows account administrators to inject malicious JavaScript by crafting video-embed links in Help Center articles. The vulnerability arises from improper neutralization of input in the iframe src attribute, enabling script execution for public visitors and potential theft of cw_conversation widget tokens. The issue is fixed in version 4.14.0.
CVE-2026-111844 is a stored cross-site scripting (XSS) vulnerability in Brizy version 2.8.23. It arises from improper neutralization of input during web page generation, allowing an attacker with limited privileges to inject malicious scripts that can be executed in the context of other users. This vulnerability has a medium severity rating with a CVSS score of 6.5.
CVE-2026-11959 is a stored Cross-Site Scripting (XSS) vulnerability in FacturaScripts version 2025.61. It arises from insufficient validation or sanitization of user input in the 'city' and 'province' fields of the 'ListAlmacen' endpoint. Exploitation could allow attackers to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to privilege escalation from normal user to administrator, session hijacking, and compromise of system confidentiality.
fast-uri versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2 contain a vulnerability in the serialize(), normalize(), or resolve() functions when used with the non-default suffix reference option. This flaw allows the generation of a relative reference containing an unescaped colon in the first path segment, violating RFC 3986 and potentially causing the string to be interpreted as an absolute URI with a scheme. This can lead to cross-site scripting (XSS) vectors if the result is treated as a URI. The issue is fixed in versions 2.4.8, 3.1.9, and 4.2.3.
fast-uri versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2 improperly percent-decode the URI scheme component using a legacy function, allowing dangerous schemes to be interpreted as executable URLs. This behavior can lead to stored or reflected cross-site scripting (XSS) vulnerabilities by turning inert strings into executable javascript, data, or vbscript URLs. The issue is fixed in versions 2.4.8, 3.1.9, and 4.2.3 and later.
A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting (XSS) flaw allows an attacker to execute arbitrary JavaScript in the origin of an affected LIFF application's endpoint when a user opens a specially crafted URL in an external browser, potentially leading to disclosure of JavaScript-accessible authentication tokens or application data, or unauthorized actions using the user's session.
CVE-2026-112249 is a cross-site scripting (XSS) vulnerability in grandnode grandnode2 versions 2.0 through 2.3.0. The flaw exists in the Html.Raw function within the Product Description Handler component, allowing remote attackers to inject malicious scripts. This issue is resolved by upgrading to versions 2.4.0-beta or 2.4.0.
IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1 contain a stored cross-site scripting (XSS) vulnerability. The web application does not properly sanitize or HTML-encode user-supplied input before storing and rendering it. An authenticated attacker can exploit this by submitting malicious JavaScript payloads that are saved and later executed when other users view the affected pages. This vulnerability can lead to the execution of arbitrary scripts in the context of the victim's browser session.
IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1 contain a vulnerability classified as CWE-80, involving improper neutralization of script-related HTML tags. This allows a remotely authenticated attacker to inject malicious HTML code that executes in the victim's browser within the context of the hosting site. The vulnerability has a CVSS 3.1 score of 5.4, indicating medium severity.
IBM Concert versions 1.0 through 3.0.0 are affected by a cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject arbitrary JavaScript into the web interface, potentially altering functionality and leading to credential disclosure within trusted sessions. The vulnerability has a medium severity rating with a CVSS score of 6.1.