Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 51,970

Export CSV
CVE-2021-36950

Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability

Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability

CVSS 3.1 · 5.4 Medium EPSS 1.0% KEV · Not listed
Vendors
Microsoft
Products
Dynamics 365
CVE-2026-72594

lobehub lobe-chat - Stored Cross-Site Scripting via Unrestricted SVG Avatar Upload

A stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Lobehub
Products
Lobe Chat
CVE-2026-72576

Bludit - Stored Cross-Site Scripting via Malicious SVG Logo Upload

A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Bludit
Products
Bludit
CVE-2026-48093

Code Embed - Contributor Stored Cross-Site Scripting via Remote URL Embed

The Code Embed WordPress plugin prior to version 2.6.1 is vulnerable to stored Cross-Site Scripting (XSS) through the external URL embed feature in post content. The vulnerable code scans rendered content for URL embed tokens, fetches the remote URL, and inserts the remote response body into the page without output sanitization or an `unfiltered_html` capability check. This allows a Contributor attacker to submit a pending post containing an inert-looking URL token that executes attacker-controlled JavaScript when an Administrator or Editor previews or reviews the post. This is distinct from CVE-2026-2512, which affected custom field meta values up to version 2.5.1. This vector affects version 2.6 and uses the documented external URL embed feature in post content. This particular issue is patched in version 2.6.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Davidartiss Wordpress
Products
Code Embed Wordpress
CVE-2026-71285

Uptime Kuma Stored XSS via Matomo Analytics Site ID on Public Status Pages

Uptime Kuma's Matomo analytics integration (server/analytics/matomo-analytics.js) injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a <script> block rendered on every public status page. A siteId value such as , once saved by an editor/admin, executes arbitrary JavaScript for every unauthenticated visitor of the public /status/<slug> page, enabling session-cookie theft and full page takeover.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Louislam
Products
Uptime-kuma
CVE-2026-71274

OpenBK7231T Stored XSS via Unsanitized MQTT-Set Channel Labels

OpenBK7231T's CHANNEL_SetLabel (src/cmnds/cmd_channels.c) stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNEL_GetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/http_fns.c with no HTML encoding.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Openshwprojects
Products
Openbk7231t App
CVE-2026-71249

299Ko - Unauthenticated Reflected XSS in Public Contact Form

299Ko's public contact form (plugin/contact/controllers/ContactController.php, home) sets raw POST field values (name, firstname, email, message) into the page template with no sanitization. The template engine's variable output function (common/Template.php, _show_var) echoes values with no htmlspecialchars call, and the sink template (contact.tpl) outputs these values unescaped into an HTML attribute and a textarea.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
299ko
Products
299ko
CVE-2026-71238

DjangoCRM - Hardcoded Django SECRET_KEY Enables Session and CSRF Token Forgery

DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid session cookies (including for the superadmin account), forge CSRF tokens, and forge password reset tokens, achieving full account takeover.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Djangocrm
Products
Django-crm
CVE-2026-71236

Grocy - Stored XSS via HTMLPurifier Output Double-Decode

Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing &amp;lt;, &amp;gt;, and &amp;amp; back to <, >, and & immediately after purification.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Grocy
Products
Grocy
CVE-2026-71233

InvoiceNinja - Stored XSS via Invoice/Quote Terms Field

InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive {!! ->terms !!} (resources/views/portal/ninja2020/invoices/includes/terms.blade.php) with no HTML sanitization.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Invoiceninja
Products
Invoice Ninja
CVE-2026-55746

Cotonti stored XSS via PFS folder title

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to stored Cross-Site Scripting in the Personal File Storage (PFS) module. A folder title (pff_title) is imported with the 'TXT' filter, which does not strip or encode HTML (the tag check in cot_import is disabled), so an authenticated user can store HTML/JavaScript in a folder title.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Cotonti
Products
Cotonti
CVE-2026-31845

Rukovoditel CRM Reflected XSS via zd_echo Parameter in Zadarma Telephony API Endpoint

A reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 and earlier in the Zadarma telephony API endpoint (/api/tel/zadarma.php). The application directly reflects user-supplied input from the 'zd_echo' GET parameter into the HTTP response without proper sanitization, output encoding, or content-type restrictions.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Rukovoditel
Products
Rukovoditel
CVE-2026-71275

OpenBK7231T - Reflected XSS via OTA host Parameter

OpenBK7231T's http_fn_ota_exec() (src/httpserver/http_fns.c) reflects the `host` query parameter directly into an HTML response via hprintf255(request, "<h3>OTA requested for %s!</h3>", tmpA) with no HTML encoding, allowing a crafted URL such as /ota_exec?host=<script>alert(1)</script> to execute JavaScript in an authenticated admin's browser when they click a malicious link.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Openshwprojects
Products
Openbk7231t App
CVE-2026-71502

Unauthenticated Stored Vue Template Injection Leads to Cross-Site Scripting in CTI-Transmute

CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data. An unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue expression using the application's configured [[ ... ]] delimiters. User profile names may provide an additional injection vector. Although Jinja HTML escaping is applied, the resulting value is subsequently included in a DOM region compiled by Vue. Vue interprets the attacker-controlled value as a template expression rather than ordinary text. By accessing the JavaScript Function constructor from within the expression, an attacker can execute arbitrary JavaScript in the security context of the CTI-Transmute origin. The application's nonce-based Content Security Policy does not prevent exploitation because the Vue runtime compiler requires the unsafe-eval policy exception. The malicious payload is stored by the application and executed whenever another user opens an affected page, such as the public conversion detail page. The victim may be a normal user or an administrator. Successful exploitation could allow the attacker to: * Access data available to the victim through the application. * Extract API keys, tokens, or other sensitive information exposed to the page. * Perform authenticated actions using the victim's session. * Modify conversions or other application data. * Escalate the impact by targeting an administrator. A demonstrated payload can use [].constructor.constructor(...) to obtain the JavaScript Function constructor and execute arbitrary code. The regression tests also show that a short first-stage payload could retrieve an uncapped conversion description and evaluate a larger second-stage payload. The patch addresses the vulnerability by registering a global Jinja finalize hook that inserts a zero-width Unicode word joiner inside every Vue delimiter found in server-rendered values. This prevents Vue from recognizing the values as template expressions while preserving their visible representation.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Misp
Products
Cti-transmute