Export limit exceeded: 51970 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (51970 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-92379 | 1 Synology | 1 Diskstation Manager | 2026-11-14 | 5.4 Medium |
| An improper neutralization of input during web page generation vulnerability in the Notification API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files. | ||||
| CVE-2026-127092 | 1 Build-admin | 1 Buildadmin | 2026-11-14 | 6.1 Medium |
| BuildAdmin 1.0.1 through 2.3.9 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to store javascript: URLs in the admin operation log via the X-Rewrite-URL header. When an administrator clicks the log entry's url open button, the script runs in the backend origin and steals the adminInfo token from localStorage, enabling account takeover. | ||||
| CVE-2026-126493 | 2 Open-emr, Openemr | 2 Openemr, Openemr | 2026-11-14 | 5.4 Medium |
| OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows low-privileged patient portal users to inject JavaScript via the tableArgs field of the onsiteportalactivity API. Attackers can store a payload with spaces that breaks out of an unquoted data-delete-id attribute, executing script when providers click the delete button on the audit review page. | ||||
| CVE-2026-126484 | 2 Open-emr, Openemr | 2 Openemr, Openemr | 2026-11-14 | 5.4 Medium |
| OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in printed_fee_sheet.php that allows authenticated portal patients to inject script by setting unescaped appointment comments (pc_hometext). Attackers can submit HTML payloads via the form_comments field in add_edit_event_user.php that execute when staff open the patient's fee sheet, acting within the staff session. | ||||
| CVE-2026-126477 | 2 Open-emr, Openemr | 2 Openemr, Openemr | 2026-11-14 | 4.8 Medium |
| OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in the Eye Exam (eye_mag) module that allows administrators to inject JavaScript through unencoded Eye_defaults list option titles. Attackers can store a crafted title via edit_list.php that breaks out of a jQuery string in eye_base.php, executing script in any authenticated user's session when they click Defaults. | ||||
| CVE-2026-126475 | 2 Open-emr, Openemr | 2 Openemr, Openemr | 2026-11-14 | 6.1 Medium |
| OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to execute JavaScript by injecting payloads into the searchEleNo POST parameter of the application/index/search endpoint. Attackers can break out of unencoded HTML attributes in auto-suggest.phtml to inject event handlers that fire on DOM insertion, stealing non-HttpOnly session cookies and patient data. | ||||
| CVE-2026-127084 | 1 Teableio | 1 Teable | 2026-11-14 | 7.3 High |
| Teable before 2026-10-12T12-45-53Z.3331 contains a stored cross-site scripting vulnerability that allows authenticated users to upload SVG or HTML attachments with an attacker-chosen content type. Attackers can send the same-origin /api/attachments/read URL, served inline with an empty Content-Security-Policy, to run script with the victim's session and perform API actions. | ||||
| CVE-2026-126946 | 1 Diced | 1 Zipline | 2026-11-14 | 5.4 Medium |
| Zipline from 4.3.0 before 4.5.0 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject HTML through unescaped embed settings in SSR meta tags. Attackers can set malicious embedTitle, embedDescription, embedSiteName, or embedColor values via PATCH /api/user to execute JavaScript in browsers of visitors opening their file view pages. | ||||
| CVE-2026-126945 | 1 Diced | 1 Zipline | 2026-11-14 | 8.7 High |
| Zipline before 4.5.1 contains a stored cross-site scripting vulnerability in the HighlightCode component that renders unescaped file content before highlight.js finishes loading. Authenticated attackers can upload text files containing HTML/JavaScript payloads that execute in viewers' browsers, enabling API calls such as account changes on the victim's behalf. | ||||
| CVE-2026-81557 | 1 Synology | 1 Diskstation Manager | 2026-11-14 | 5.4 Medium |
| An improper neutralization of input during web page generation vulnerability in the DSMNotify in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files. | ||||
| CVE-2026-126476 | 2 Open-emr, Openemr | 2 Openemr, Openemr | 2026-11-14 | 6.1 Medium |
| OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the Application module's auto-suggest endpoint, which echoes the searchMode POST parameter unencoded into a single-quoted onClick attribute. Attackers can induce an authenticated user to submit a single-quote payload to application/index/search, executing arbitrary JavaScript in that user's session to steal session cookies or disclose patient data. | ||||
| CVE-2026-126474 | 2 Open-emr, Openemr | 2 Openemr, Openemr | 2026-11-14 | 6.1 Medium |
| OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the ACL module that allows attackers to execute JavaScript in authenticated sessions via the module_id parameter. Attackers can deliver crafted acl/index or acl/acl links that inject unencoded input into inline script blocks, stealing non-HttpOnly session cookies and modifying ACL configuration. | ||||
| CVE-2026-125809 | 2 Mycred, Wordpress-extensions | 2 Mycred, Mycred | 2026-11-14 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred myCred mycred allows Stored XSS.This issue affects myCred: from n/a through 4.0.2. | ||||
| CVE-2026-125854 | 2 Unbounce, Wordpress-extensions | 2 Unbounce Landing Pages, Unbounce Landing Pages | 2026-11-14 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unbounce Unbounce Landing Pages unbounce allows Stored XSS.This issue affects Unbounce Landing Pages: from n/a through 1.1.6. | ||||
| CVE-2026-125856 | 2 Sarah Giles, Wordpress-extensions | 2 Dynamic User Directory, Dynamic User Directory | 2026-11-14 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Reflected XSS.This issue affects Dynamic User Directory: from n/a through 2.4. | ||||
| CVE-2026-126462 | 2 Open-emr, Openemr | 2 Openemr, Openemr | 2026-11-14 | 5.4 Medium |
| OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Eye Exam edit permission to inject scripts via the Next Visit Orders PLAN[] field. Attackers can store a payload closing the textarea in view.php, executing JavaScript when another user opens the Eye Exam editor to steal session identifiers or clinical data. | ||||
| CVE-2026-126456 | 2 Open-emr, Openemr | 2 Openemr, Openemr | 2026-11-14 | 5.4 Medium |
| OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in the Fee Sheet notecodes field, which is escaped with the wrong context. Attackers with clinician access can inject a payload that breaks out of the single-quoted value attribute and executes in higher-privileged users' browsers. | ||||
| CVE-2026-126451 | 2 Open-emr, Openemr | 2 Openemr, Openemr | 2026-11-13 | 7.3 High |
| OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows portal patients to run JavaScript in staff sessions by injecting javascript: URLs into document template_data. Attackers can submit an encounterForm value rendered unsanitized into an iframe src by DocumentTemplateRender, letting the script read PHI and CSRF tokens and call staff or admin endpoints. | ||||
| CVE-2026-63166 | 2 Agora-project, Omnispace | 2 Agora-project, Agora Project | 2026-11-13 | 6.1 Medium |
| Omnispace Agora Project through 26.10.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious HTML markup by controlling imported directory data or an uploaded CSV file, as values are rendered into table cell text and value attributes after only Txt::utf8Encode() with no HTML escaping in VuePersonsImportExport.php. Attackers can craft a CSV cell containing an attribute-breakout payload that is rendered verbatim and executed in the browser of the administrator performing the import, leading to arbitrary script execution in the administrative context. | ||||
| CVE-2026-125452 | 2 Denishua, Wordpress-extensions | 2 Wpjam Basic, Wpjam Basic | 2026-11-13 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Denishua WPJAM Basic wpjam-basic allows Reflected XSS.This issue affects WPJAM Basic: from n/a through 7.1.2. | ||||