CVE-2026-1564 is an HTML Injection vulnerability affecting Pegasystems Pega Infinity versions 8.1.0 through 25.1.1. It involves improper neutralization of script-related HTML tags in a user interface component. Exploitation requires a high privileged user with a developer role. The vulnerability has a medium severity with a CVSS score of 5.1. No official patch or remediation guidance is currently provided by the vendor.
CVE-2026-40105 is a reflected cross-site scripting (XSS) vulnerability in the XWiki Platform affecting versions from 10.4-rc-1 up to but not including 16.10.16, versions 17.0.0-rc-1 up to 17.4.8, and versions 17.5.0-rc-1 up to 17.
MaxKB versions 2.7.1 and below contain a stored cross-site scripting (XSS) vulnerability in the Application prologue field. Authenticated users can inject arbitrary HTML and JavaScript by using <html_rander> tags, which the backend does not sanitize before storing. The frontend renders this content unsafely, enabling persistent XSS that affects any visitor opening the chatbot interface. Exploitation may lead to session hijacking, unauthorized actions, and data exposure. This vulnerability is fixed in version 2.8.0.
ChurchCRM is an open-source church management system. Prior to 7.1.0, an XSS vulnerability allows attacker-supplied input sent via a the EName and EDesc parameters in EditEventAttendees.php to be rendered in a page without proper output encoding, enabling arbitrary JavaScript execution in victims' browsers. This vulnerability is fixed in 7.1.0.
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in WikiWorks Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.
A reflected Cross-Site Scripting (XSS) vulnerability exists in ChurchCRM versions prior to 7.1.0 on the login page. The vulnerability arises because the username parameter from the URL is not sanitized or encoded before being displayed in the login input field. This allows attackers to inject malicious JavaScript that executes in the victim's browser, potentially leading to theft of session cookies or manipulation of the login page display. The issue is fixed in version 7.1.0.
Papra versions prior to 26.4.0 contain a vulnerability where user display names are directly interpolated into transactional email HTML templates without proper escaping or sanitization. This allows an attacker to inject HTML tags into verification and password reset emails sent from the legitimate domain, enabling phishing attacks that appear as official Papra notifications. The vulnerability is classified as a basic cross-site scripting (XSS) issue and has a medium severity rating with a CVSS score of 4.3. It is fixed in version 26.4.0.
IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ive' shortcode in all versions up to, and including, 1.2.5.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Filament is a collection of full-stack components for accelerated Laravel development. Versions 4.0.0 through 4.8.4 and 5.0.0 through 5.3.4 have two Filament Table summarizers (Range, Values) that render raw database values without escaping HTML. If there is a lack of validation for the data in the columns that use these summarizers, an attacker could plant malicious HTML / JavaScript and achieve stored XSS that executes for users who view the table with those summarizers. This issue has been patched in versions 4.8.5 and 5.3.5.
Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. Versions 1.4.1 and below contain a stored XSS vulnerability in the Jellyseerr user selector. Jellyseerr allows any account holder to execute arbitrary JavaScript in the Anchorr admin's browser session. The injected script calls the authenticated /api/config endpoint - which returns the full application configuration in plaintext. This allows the attacker to forge a valid Anchorr session token and gain full admin access to the dashboard with no knowledge of the admin password. The same response also exposes the API keys and tokens for every integrated service, resulting in simultaneous account takeover of the Jellyfin media server (via JELLYFIN_API_KEY), the Jellyseerr request manager (via JELLYSEERR_API_KEY), and the Discord bot (via DISCORD_TOKEN). This issue has been fixed in version 1.4.2.
CVE-2026-32753 is a high-severity cross-site scripting (XSS) vulnerability in FreeScout versions prior to 1.8.209. It arises from improper sanitization of SVG files masquerading as PNG images, allowing authenticated users to upload malicious SVG content that executes JavaScript when rendered inline. The vulnerability exploits the application's file extension and content-type checks, which incorrectly permit SVG payloads with a . png extension and image/svg+xml content type to bypass security controls. When another user or administrator views the malicious attachment, the embedded script executes with their privileges, enabling actions on their behalf without their consent. This flaw affects the confidentiality and integrity of user sessions and data. The issue has been fixed in version 1.8.
LeafKit is a templating language with Swift-inspired syntax. Prior to version 1.14.2, HTML escaping doesn't work correctly when a template prints a collection (Array / Dictionary) via `#(value)`. This can result in XSS, allowing potentially untrusted input to be rendered unescaped. Version 1.14.2 fixes the issue.
Chamilo is a learning management system. Prior to version 1.11.34, a stored XSS vulnerability exists in Chamilo LMS that allows a staff account to execute arbitrary JavaScript in the browser of higher-privileged admin users. The issue arises because feedback input in the exercise history page is not properly encoded before rendering, allowing malicious scripts to persist in the database and execute on view. This issue has been patched in version 1.11.34.
Chamilo is a learning management system. Prior to version 1.11.30, the open parameter of help.php fails to properly sanitize user input. This allows an attacker to inject arbitrary HTML, such as underlined text, via a crafted URL. This issue has been patched in version 1.11.30.
Chamilo is a learning management system. Prior to version 1.11.30, there is a reflected cross-site scripting (XSS) vulnerability due to insufficient sanitization of the page parameter in the session/add_users_to_session.php endpoint. This issue has been patched in version 1.11.30.
n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to create or modify workflows could inject arbitrary scripts into pages rendered by the n8n application using different techniques on various nodes (Form Trigger node, Chat Trigger node, Send & Wait node, Webhook Node, and Chat Node). Scripts injected by a malicious workflow execute in the browser of any user who visits the affected page, enabling session hijacking and account takeover. The issues have been fixed in n8n versions 2.10.1 and 1.123.21. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations. Limit workflow creation and editing permissions to fully trusted users only, and/or disable the Webhook node by adding `n8n-nodes-base.webhook` to the `NODES_EXCLUDE` environment variable. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, a reflected HTML injection vulnerability exists in the Projects module where the `filter` URL parameter is rendered into the DOM without output encoding when the user clicks "Filter." While `<script>` and `<iframe>` are blocked, `<svg>`, `<a>`, and formatting tags (`<h1>`, `<b>`, `<u>`) render without restriction — enabling SVG-based phishing buttons, external redirect links, and content spoofing within the trusted application origin. Version 2.0.0 fixes this issue.