CWE-79

Pyhtml2pdf version 0.0.6 allows an external attacker to remotely obtain arbitrary local files. This is possible because

electron-pdf version 20.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible beca

In WS_FTP Server versions before 8.8.5, reflected cross-site scripting issues have been identified on various user suppl

Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe. This issue leads to a client-side RC

Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. This issue leads

The SolarWinds Platform was susceptible to a XSS vulnerability that affects the maps section of the user interface. This

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python

Nautobot is a Network Source of Truth and Network Automation Platform. A Nautobot user with admin privileges can modify

Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targ

An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://devtoo

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerab

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerab

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerab

In Jitsi Meet before 2.0.9779, the functionality to share an image using giphy was implemented in an insecure way, resul

An issue was discovered in Luvion Grand Elite 3 Connect through 2020-02-25. Clients can authenticate themselves to the d

VaeMendis - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerab

Mastodon 4.1.x before 4.1.17 and 4.2.x before 4.2.9 allows a bypass of rate limiting via a crafted HTTP request header.

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Two interconne

Incorrect access control in eSoft Planner 3.24.08271-USA allow attackers to view all transactions performed by the compa

LLama Factory enables fine-tuning of large language models. A critical remote OS command injection vulnerability has bee

An issue was discovered in TCPDF before 6.8.0. setSVGStyles does not sanitize the SVG font-family attribute.

An issue was discovered in TCPDF before 6.8.0. The Error function lacks an htmlspecialchars call for the error message.

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Tiki Wiki CMS – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Boa web server – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Tecnick TCExam – Multiple CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CMS Made Simple version 2.2.14, does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting

Vulnerability in CMS Made Simple 2.2.14, which does not sufficiently encode user-controlled input, resulting in a Cross-

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress

danielmiessler fabric through 1.3.0 allows installer/client/gui/static/js/index.js XSS because of innerHTML mishandling,

The UX Flat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all

Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the

SourceCodester Laboratory Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via "First Name" parameter i

pgAdmin <= 8.5 is affected by XSS vulnerability in /settings/store API response json payload. This vulnerability allows

The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Link To' field of mu

The SKT Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Age Gate

An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04. A sp

Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, resulting in a reflected cross-site scr

Cross-site scripting vulnerability exists in Sharp Corporation and Toshiba Tech Corporation multiple MFPs (multifunction

Avo is a framework to create admin panels for Ruby on Rails apps. A stored cross-site scripting (XSS) vulnerability was

Stored XSS Vulnerability in M-Files Web versions before 23.8 allows attacker to execute script on users browser via stor

News functionality in Schoolbox application before version 23.1.3 is vulnerable to stored cross-site scripting allowing

Class functionality in Schoolbox application before version 23.1.3 is vulnerable to stored cross-site scripting allowi

Calendar functionality in Schoolbox application before version 23.1.3 is vulnerable to stored cross-site scripting all

Archer Platform 6.x before 6.14 P2 HF2 (6.14.0.2.2) contains a stored cross-site scripting (XSS) vulnerability. A remote

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KaineLabs Youzify

Cross Site Scripting vulnerability in MacCMS v.10 v.2024.1000.3000 allows a remote attacker to execute arbitrary code vi

Cross Site Scripting vulnerability in jizhicms v.2.5.4 allows a remote attacker to obtain sensitive information via a cr

Typora v1.0.0 through v1.7 version (below) Markdown editor has a cross-site scripting (XSS) vulnerability, which allows