Threats Tagged 'cwe-80'

CVE-2026-108925 is a medium severity cross-site scripting (XSS) vulnerability in the Cohesity NetBackup Administration Console web interface. It involves improper neutralization of script-related HTML tags, allowing an attacker to inject malicious scripts. This affects versions prior to 11.2 of the web interface. The vulnerability has a CVSS 3.1 score of 6.1, indicating a network attack vector with low complexity, no privileges required, but requiring user interaction. The impact includes limited confidentiality and integrity loss without availability impact. No known exploits are reported in the wild. No explicit patch or remediation information is provided in the available data.

In Progress® Kendo UI for Vue (@progress/kendo-vue-charts) starting with version 2.5.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a string value bound to the chart can supply HTML containing event handlers that execute JavaScript in a user's browser when the user hovers over the affected data point. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application.

CVE-2026-106138 is a medium severity vulnerability in Progress Software's KendoReact library affecting versions from 1.1.0 up to but not including 16.2.0. The issue is an improper neutralization of script-related HTML tags (CWE-80) in the default Chart tooltip, which renders formatted point values as raw HTML without encoding. This allows an attacker with low privileges who can influence chart-bound string values to inject HTML with event handlers that execute JavaScript when a user hovers over the affected data point. Exploitation can compromise confidentiality and integrity of accessible data.

CVE-2026-89290 is a stored cross-site scripting (XSS) vulnerability in the eimzamip product by İzometri IT Services Domestic and Foreign Trade Co. Ltd. It arises from improper neutralization of script-related HTML tags. The vulnerability affects versions from 1.6.4 up to but not including 1.6.7. The CVSS score is low (3.5), indicating limited impact primarily on confidentiality. There is no information about an available patch or vendor advisory. No known exploits are reported in the wild.

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearch extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki MediaSearch extension: 1.46, 1.45, and 1.43.

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki CommonsMetadata extension: 1.46, 1.45, and 1.43.

A low-severity Cross-Site Scripting (XSS) vulnerability exists in the MediaWiki Wikbase extension versions 1.43, 1.45, and 1.46. This vulnerability is due to improper neutralization of script-related HTML tags, classified as CWE-80. It allows an attacker to inject script code into web pages, potentially impacting users with high privileges who interact with the affected extension. The vulnerability has a low CVSS score of 0.3 and no known exploits in the wild.

A low-severity Cross-Site Scripting (XSS) vulnerability exists in the MediaWiki Wikistories extension versions 1.43, 1.45, and 1.46. The issue is due to improper neutralization of script-related HTML tags, which can allow script injection in web pages. This vulnerability is identified as CWE-80. No known exploits are reported in the wild, and no official patch or remediation details are provided in the available data.

A reflected cross-site scripting (XSS) vulnerability exists in the MediaWiki ReadingLists extension versions 1.45 and 1.46. This vulnerability is due to improper neutralization of script-related HTML tags, which can allow an attacker to inject malicious scripts into web pages. The issue has a low severity rating and a CVSS 4.0 score of 1.1. No official patch or remediation guidance has been provided yet.

A stored cross-site scripting (XSS) vulnerability exists in the MediaWiki Page_Forms extension maintained by The Wikimedia Foundation. The flaw is due to improper neutralization of script-related HTML tags, allowing malicious scripts to be stored and executed in the context of affected web pages. This vulnerability affects specific versions 1.43, 1.45, and 1.46 of the extension. The CVSS 4.0 base score is low, indicating limited impact and exploitability. No known exploits are reported in the wild. No patch or remediation details are provided in the available data.