Export limit exceeded: 381406 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (48383 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-1099 | 1 Microsoft | 4 Sharepoint Enterprise Server, Sharepoint Server, Sharepoint Server 2016 and 1 more | 2026-08-19 | 5.4 Medium |
| A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server. The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current user. The attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions on the SharePoint site on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user. The security update addresses the vulnerability by helping to ensure that SharePoint Server properly sanitizes web requests. | ||||
| CVE-2020-1055 | 1 Microsoft | 7 Windows 10, Windows 10 1809, Windows 10 1909 and 4 more | 2026-08-19 | 5.5 Medium |
| A cross-site-scripting (XSS) vulnerability exists when Active Directory Federation Services (ADFS) does not properly sanitize user inputs. An un-authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected ADFS server. The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run scripts in the security context of the current user. This security update addresses the vulnerability by ensuring that ADFS properly sanitizes user inputs. | ||||
| CVE-2020-1063 | 1 Microsoft | 1 Dynamics 365 | 2026-08-19 | 5.4 Medium |
| A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected Dynamics server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected Dynamics server. The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current authenticated user. These attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions within Dynamics Server on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user. The security update addresses the vulnerability by helping to ensure that Dynamics Server properly sanitizes web requests. | ||||
| CVE-2026-18197 | 3 Wordpress, Yannick Lefebvre, Ylefebvre | 3 Wordpress, Link Library, Link Library | 2026-08-19 | 6.1 Medium |
| Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Link Library allows Cross-Site Scripting (XSS). This issue affects Link Library: before 7.9.4. | ||||
| CVE-2026-13463 | 1 Ibm | 2 Aix, Cloud Pak System | 2026-08-19 | 7.5 High |
| IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive information due to the insertion of credentials into log files. | ||||
| CVE-2021-41372 | 1 Microsoft | 1 Power Bi Report Server | 2026-08-19 | 7.6 High |
| A Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exists when Power BI Report Server Template file (pbix) containing HTML files is uploaded to the server and HTML files are accessed directly by the victim. Combining these 2 vulnerabilities together, an attacker is able to upload malicious Power BI templates files to the server using the victim's session and run scripts in the security context of the user and perform privilege escalation in case the victim has admin privileges when the victim access one of the HTML files present in the malicious Power BI template uploaded. The security update addresses the vulnerability by helping to ensure that Power BI Report Server properly sanitize file uploads. | ||||
| CVE-2026-16627 | 1 Gitlab | 1 Gitlab | 2026-08-19 | 7.7 High |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal. | ||||
| CVE-2023-0945 | 1 Mayurik | 1 Best Pos Management System | 2026-08-19 | 3.5 Low |
| A vulnerability, which was classified as problematic, was found in SourceCodester Best POS Management System 1.0. Affected is an unknown function of the file index.php?page=add-category. The manipulation of the argument Name with the input "><img src=x onerror=prompt(document.domain);> leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-221592. | ||||
| CVE-2023-27206 | 1 Mayurik | 1 Best Pos Management System | 2026-08-19 | 6.1 Medium |
| A cross-site scripting (XSS) vulnerability in /kruxton/navbar.php of Best POS Management System 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the page parameter. | ||||
| CVE-2019-17003 | 1 Mozilla | 1 Firefox Mobile | 2026-08-19 | 6.1 Medium |
| Scanning a QR code that contained a javascript: URL would have resulted in the Javascript being executed. | ||||
| CVE-2023-5758 | 1 Mozilla | 1 Firefox Mobile | 2026-08-19 | 6.1 Medium |
| When opening a page in reader mode, the redirect URL could have caused attacker-controlled script to execute in a reflected Cross-Site Scripting (XSS) attack. This vulnerability affects Firefox for iOS < 119. | ||||
| CVE-2024-43113 | 1 Mozilla | 1 Firefox Mobile | 2026-08-19 | 6.1 Medium |
| The contextual menu for links could provide an opportunity for cross-site scripting attacks This vulnerability affects Firefox for iOS < 129. | ||||
| CVE-2020-12404 | 1 Mozilla | 1 Firefox Mobile | 2026-08-19 | 4.3 Medium |
| For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token could leak when used for downloading files. This vulnerability affects Firefox for iOS < 26. | ||||
| CVE-2024-43112 | 1 Mozilla | 1 Firefox Mobile | 2026-08-19 | 6.1 Medium |
| Long pressing on a download link could potentially provide a means for cross-site scripting This vulnerability affects Firefox for iOS < 129. | ||||
| CVE-2024-43111 | 1 Mozilla | 2 Firefox For Ios, Firefox Mobile | 2026-08-19 | 9.8 Critical |
| Long pressing on a download link could potentially allow Javascript commands to be executed within the browser This vulnerability affects Firefox for iOS < 129. | ||||
| CVE-2026-75091 | 2026-08-19 | 7.2 High | ||
| The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-75078 | 1 Sourcecodester | 1 Class And Exam Timetabling System | 2026-08-19 | 4.3 Medium |
| A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSHRM1.php. Performing a manipulation of the argument course results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. | ||||
| CVE-2026-73354 | 2026-08-19 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in SimplyRETS Real Estate IDX <= 3.2.8 versions. | ||||
| CVE-2026-73182 | 2026-08-19 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in BBQ Pro <= 3.9 versions. | ||||
| CVE-2026-66603 | 2026-08-19 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Artiss Draft List simple-draft-list allows Stored XSS. This issue affects Draft List: from n/a through 2.6.4. | ||||