PandaWiki versions 3.65.0 through 3.87.5 have a stored cross-site scripting (XSS) vulnerability. Unauthenticated attackers can upload HTML files disguised with image extensions via the /share/v1/common/file/upload endpoint. By tricking administrators into visiting a crafted URL, attackers can bypass nginx's attachment header to serve the HTML inline, enabling theft of the panda_wiki_token JWT and potential session takeover.
A stored cross-site scripting (XSS) vulnerability exists in the Mega Menu Badge Text feature of the Helix Ultimate Joomla extension versions prior to 2.2.11. This vulnerability allows an attacker with low privileges to inject malicious scripts that can be executed in the context of other users. The flaw is identified as CVE-2026-105602 and has a high severity rating with a CVSS score of 8.6.
A stored cross-site scripting (XSS) vulnerability exists in the Media Picker component of the Helix Ultimate Joomla extension versions prior to 2.2.11. This vulnerability allows an attacker with low privileges to inject malicious scripts that are stored and later executed in the context of users interacting with the affected component.
A reflected cross-site scripting (XSS) vulnerability exists in the Joomla Extension php-web-design.com StageIt versions 1.0 through 5.7.5 and 6.0 through 6.3.5. This vulnerability allows an attacker to inject malicious scripts that are reflected off the web server, potentially leading to limited confidentiality and integrity impacts. The issue is identified as CVE-2026-105601 with a medium severity rating and a CVSS 4.0 base score of 5.3.
Dell OpenManage Enterprise versions prior to 4.8.0 have a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This vulnerability could be exploited remotely by an unauthenticated attacker with high attack complexity and requiring user interaction. Successful exploitation may lead to information tampering.
wrensec-commons contains a reflected cross-site scripting (XSS) vulnerability in the CREST framework's HTTP binding. The HttpUtils.prepareResponse() method used the _mimeType request parameter to set the Content-Type response header without proper sanitization. By sending a GET request with _mimeType=text/html, an attacker could cause the browser to interpret a CREST JSON response as HTML, enabling execution of arbitrary JavaScript in the victim's browser. The vulnerability is exploitable by tricking a user into visiting a crafted URL targeting any deployed CREST endpoint. The issue is fixed in versions 22.6.2 and 23.0.0.
LaraDashboard versions before 1.4.9 have a stored cross-site scripting (XSS) vulnerability. Authenticated users with post.create or post.edit permissions can inject malicious scripts via unsanitized LaraBuilder design_json block content. This allows script or event-handler markup to execute in administrator or Superadmin sessions when viewing the builder, preview, or page. The vulnerability is fixed in version 1.4.9.
GoFound versions up to 1.4.1 contain a stored cross-site scripting (XSS) vulnerability. Unauthenticated attackers can inject malicious scripts by submitting document text to the /api/index endpoint. The injected HTML is returned unescaped by searcher/engine.go and rendered with v-html in dashboard.vue, leading to script execution in an administrator's browser when a search matches the malicious document.
CVE-2024-7075 is a cross-site scripting (XSS) vulnerability in the user search function of a management console. The function does not properly encode user input before rendering it in the browser, allowing attackers to inject malicious scripts. Exploitation can lead to browser redirection, UI manipulation, or information disclosure from the browser. The vulnerability does not allow session hijacking due to the httpOnly flag on session cookies.
A security update for Red Hat Hardened Images RPMs includes fixes for multiple vulnerabilities in the grafana12.4 package, including CVE-2026-115754. This particular CVE involves a flaw in the serialize-javascript library that can lead to cross-site scripting (XSS) attacks by allowing crafted function source text containing unescaped script closing tags. Exploitation requires the attacker to manipulate serialized JavaScript functions, which is uncommon in typical Red Hat environments, limiting the impact. The update addresses these issues by providing patched RPMs for affected architectures.
A cross-site scripting (XSS) vulnerability exists in the mathurvishal CloudClassroom-PHP-Project within an unknown function in the file manageassessment2.php. The flaw involves manipulation of the arguments ExamName, Q1, Q2, Q3, Q4, and Q5, allowing remote attackers to execute script code. The vendor has not responded to disclosure requests, and no specific affected versions or patches are provided due to the product's rolling release model. Exploit code has been published publicly.
A cross-site scripting (XSS) vulnerability exists in the mathurvishal CloudClassroom-PHP-Project within the updatedetailsfromfaculty.php file. The flaw is triggered by manipulation of the fname argument and can be exploited remotely. The vendor has not provided a response or patch, and no specific affected versions are identified due to the project's rolling release model. Public exploit code is available. The vulnerability has a medium severity rating with a CVSS score of 4.3.
CVE-2026-111089 is a cross-site scripting (XSS) vulnerability in Apache Wicket versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0. The issue arises because texts from resource bundles are inserted into JavaScript string literals and HTML attribute values without proper escaping, allowing injection of malicious script if the text contains quotes or is controlled by an attacker. The default Content-Security-Policy in Wicket 9.x and 10.x does not prevent exploitation of the JavaScript injection vectors. Fixed versions are 8.20.0, 9.25.0, and 10.12.0.
CVE-2026-95863 is a cross-site scripting (XSS) vulnerability in Apache Wicket versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0. The flaw arises because Apache Wicket improperly escapes component markup IDs and input names when embedding them into JavaScript string literals, allowing injection of malicious script code if these IDs contain special characters such as quotes or backslashes. The vulnerability is fixed in versions 8.20.0, 9.25.0, and 10.12.0 by validating and rejecting unsafe characters in IDs at entry rather than escaping them in multiple places.
CVE-2026-84231 is a cross-site scripting (XSS) vulnerability in Apache Wicket versions 8.0.0 through 8.19.0. It arises from improper neutralization of input when generating JavaScript click handlers for ExternalLink components bound to non-anchor markup tags. The URL model value is concatenated into JavaScript without proper escaping, allowing an attacker to inject script code that executes in the user's browser when the element is activated. The issue is fixed in Apache Wicket 8.20.0.
CVE-2026-83539 is a cross-site scripting (XSS) vulnerability in Apache Wicket's SmartLinkLabel and SmartLinkMultiLineLabel components. These components convert URLs found in text into clickable links without restricting URL schemes, allowing potentially malicious script execution when a user activates such a link. The vulnerability affects Apache Wicket versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0. Default Content-Security-Policy (CSP) in versions 9.x and 10.x mitigates this risk by restricting script execution, but applications that weaken or disable CSP are fully vulnerable. Version 8.x lacks CSP support and is fully affected. Fixed versions are 8.20.0, 9.25.0, and 10.12.0.
CVE-2026-82956 is a cross-site scripting (XSS) vulnerability in Apache Wicket affecting versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0. The flaw arises from improper neutralization of client-supplied input (windowName) used in JavaScript without escaping, specifically in the AjaxNewWindowNotifyingBehavior component. Applications that do not use this behavior are not affected. The issue is fixed in Apache Wicket versions 8.20.0, 9.25.0, and 10.12.0.