Export limit exceeded: 21746 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 51989 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 51,989

Export CSV
CVE-2026-105188

code-projects Human Resource Management System Live Event History liveEventHistory.php cross site scripting

A vulnerability was found in code-projects Human Resource Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /views/admin/liveEventHistory.php of the component Live Event History. The manipulation of the argument eventSubject results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Code-projects
Products
Human Resource Management Human Resource Management System
CVE-2026-42634

WordPress Video Background Block – Use video as background in the section. plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Bplugins Wordpress-extensions
Products
Video Background Block – Use Video As Background In The Section. Video Background Block Use Video As Background In The Section
CVE-2026-104395

WordPress picu plugin <= 3.10.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Picu Wordpress-extensions
Products
Picu Picu
CVE-2026-104807

Mitel MiVoice Office 400 stored Cross-Site Scripting

DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content into the web application. The specific flaw exists within the web portal listening on TCP port 443, under Configuration → Domains, specifically in the “Description” field. The application fails to properly validate or sanitize user-supplied input before storing and subsequently rendering the field. By injecting malicious JavaScript into the Description field, an attacker can modify the content and behavior of the affected page when it is viewed by other users. This could allow an attacker to alter the page's appearance, display attacker-controlled content, or construct convincing phishing scenarios within the application's trusted web context.

CVSS 4.0 · 1.9 Low EPSS < 1% KEV · Not listed
Vendors
Mitel
Products
Mivoice Office 400
CVE-2026-104808

Mitel MiVoice Office 400 stored Cross-Site Scripting

DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content, resulting in a denial-of-service condition within the web application. The specific flaw exists within the web portal listening on TCP port 443, under Configuration → Users → Users List. The vulnerability occurs in the “Microsoft Exchange mailbox” field, which fails to properly validate or sanitize user-supplied input before storing and rendering it. By injecting malicious JavaScript into this field, an attacker can cause the payload to execute whenever the affected user properties are accessed. This can prevent access to the affected user properties and result in a denial-of-service condition within the application's user-management functionality.

CVSS 4.0 · 1.9 Low EPSS < 1% KEV · Not listed
Vendors
Mitel
Products
Mivoice Office 400
CVE-2026-105649

Ghost: Stored XSS via SVG Uploads Bypassing Sanitization

Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored without sanitization. This allowed any staff user, including Contributors, to host scripts on the site's domain, possibly resulting in compromise of other staff users' admin sessions. This issue is fixed in version 6.65.0.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Ghost
Products
Ghost
CVE-2026-105650

Ghost: Stored XSS via oEmbed Photo Responses

Ghost is a Node.js content management system. From 2.1.0 until 6.64.0, embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post content. These scripts could run in the Ghost editor, on the published site, and in newsletter emails, possibly resulting in compromise of a staff user's admin session. This issue is fixed in version 6.64.0.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Ghost
Products
Ghost
CVE-2026-105679

Ghost: Stored XSS via File Uploads on Local Storage

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user were served with a content type derived from their file extension. This could be used to host scripts on the site's domain, possibly resulting in compromise of other staff users' admin sessions. This issue is fixed in version 6.64.0.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Ghost
Products
Ghost
CVE-2026-105784

Joplin whiteboard card rendering allows CSS injection into application chrome

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in packages/app-desktop/gui/NoteEditor/NoteBody/WhiteboardEditor/nodes/TextNode.tsx and packages/app-desktop/gui/NoteEditor/NoteBody/WhiteboardEditor/nodes/FileNode.tsx to render card content with the full Markdown renderer. The components insert the resulting HTML into the main application document through dangerouslySetInnerHTML. A malicious note can inject style elements and remote CSS imports that modify trusted application chrome, signal when the note is opened, and potentially disclose exposed attribute values. Content Security Policy blocks inline script execution, so the supported impact is CSS injection and UI redressing rather than code execution. This issue is fixed in version 3.7.13.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Laurent 22
Products
Joplin
CVE-2026-79311

python-webpy: webpy: Missing autoescape in render_jinja leads to Cross-Site Scripting (XSS)

webpy web.py 0.76 is vulnerable to Cross Site Scripting (XSS) via render_jinja.__init__().

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Webpy
Products
Webpy
CVE-2026-105950

getformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scripting

A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the file formwork/src/Sanitizer/DomSanitizer.php of the component URI Sanitizer. Such manipulation of the argument formaction leads to cross site scripting. The attack may be launched remotely. Upgrading to version 2.3.13 is recommended to address this issue. The name of the patch is 729701e59c5886685c5a1d477bdc3035e41f18b1. Upgrading the affected component is advised.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Getformwork
Products
Formwork
CVE-2026-105124

W (wcms) through 3.18.0 Unauthenticated Stored XSS via Login Username and Comments

W (vincent-peugnet/wcms) through 3.18.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the login user field and visitor comment website field. Attackers can submit failed logins rendered unescaped in the adminlog.php log viewer, or comment URLs echoed into href attributes in editrightbar.php, executing script with administrator or editor privileges.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vincent-peugnet Wcms
Products
Wcms Wcms