CWE-79

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to versio

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dokuzsoft T

facileManager is a modular suite of web apps built with the sysadmin in mind. Prior to 6.0.4 , a reflected XSS occurs wh

facileManager is a modular suite of web apps built with the sysadmin in mind. Prior to 6.0.4 , stored XSS (also known as

The grafanacubism-panel plugin allows use of cubism.js in Grafana. In 0.1.2 and earlier, the panel's zoom-link handler p

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the Markdown viewer component ren

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-a

A Stored cross-site scripting (XSS) vulnerability affects HCL Unica Marketing Operations v12.1.8 and lower.  Stored cros

Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, an authenticated attac

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to versio

PrestaShop is an open source e-commerce web application. Versions prior to 8.2.5 and 9.1.0 are vulnerable to stored Cros

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec

ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting vulnerability exists

Stored XSS in log viewer in CoolerControl/coolercontrol-ui <4.0.0 allows unauthenticated attackers to take over the serv

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, a user with

ipl/web is a set of common web components for php projects. Prior to versions 0.13.1 and 0.10.3, the vulnerability allow

phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl() that allows authenticate

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Beyaz Computer Sof

Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a stored cross-site scripting vulnerability in the embedde

Budibase is an open-source low-code platform. Prior to 3.38.2, the file upload endpoint POST /api/attachments/process do

A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7. When displaying project

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create c

An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generat

Xibo is an open source digital signage platform with a web content management system and Windows display player software

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to stored Cross-Site Scripting in the Personal File Storage

Filament is a collection of full-stack components for accelerated Laravel development. From 3.0.0 until 3.3.53, a disabl

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open

A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the

luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url parameter that allows

A stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authentic

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through t

Wekan is open source kanban built with Meteor. From 8.72 until 10.23, addBoardHTMLToZip() in client/lib/exportHTML.js re

Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable t

A vulnerability has been identified in Element maps-ng V47 (All versions < V47.12.3), Element maps-ng V48 (All versions

A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow p

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Global Inte

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Excel allows an

Qool CMS contains multiple persistent cross-site scripting vulnerabilities in several administrative scripts where POST

GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated user can store

WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vul

locize is a localization platform that connects code and i18n setup. Prior to version 4.0.21, the locize client SDK regi

Vulnerability in Wikimedia Foundation Scribunto. This issue affects Scribunto: from 1.45.0 before 1.45.2.

Supsystic Digital Publications 1.6.9 contains a path traversal vulnerability in the Folder input field that allows attac

UXSS in Focus for iOS / Klar Webkit navigation. This vulnerability was fixed in Focus for iOS 151.3.1 and Klar for iOS 1

Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Person). Supported versions

@tryghost/activitypub is Ghost’s social/federation client app. Prior to 3.1.0, the ActivityPub client in Ghost was vulne

The SlimStat Analytics WordPress plugin before 5.5.0 does not escape a visitor-controlled geolocation value before outpu