By weakness (CWE)

CWE-79: related vulnerabilities

CVEs classified under CWE-79. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

728 published vulnerabilities · page 8 of 8

• CVE-2026-12129LOW 3.5

  CodeAstro Human Resource Management System version 1.0 contains a cross-site scripting (XSS) vulnerability in its Dashboard Interface. An attacker with login credentials can inject malicious scripts through the todo_data parameter in the /dashboard/add_tod endpoint. When another authenticated user views the affected page, the injected script executes in their browser, potentially allowing credential theft, session hijacking, or unauthorized actions performed on their behalf. The vulnerability requires user interaction—specifically, a victim must visit a page containing the malicious payload—and can only be exploited by someone with valid system access.

• CVE-2026-12130LOW 3.5

  CVE-2026-12130 is a reflected cross-site scripting (XSS) vulnerability in CodeAstro Human Resource Management System version 1.0. An authenticated user can inject malicious scripts through the 'protitle' parameter on the Projects Management Page, which are then executed in the browsers of other users who view the injected content. The vulnerability requires user interaction (a victim must click a crafted link) and does not grant an attacker elevated privileges or direct data access, which limits its severity. However, it can be used to steal session cookies, redirect users, or perform actions on behalf of authenticated users within the HR system.

• CVE-2026-13504LOW 3.5

  A cross-site scripting (XSS) vulnerability exists in code-projects Project Management System version 1.0 affecting the Mail Compose Page (/mail.php). An authenticated user can inject malicious scripts that execute in another user's browser when they interact with crafted email content. While the vulnerability requires login credentials and user interaction to exploit, public disclosure means attackers have access to exploitation methods.

• CVE-2026-13558LOW 3.5

  CodeAstro Complaint Management System version 1.0 contains a cross-site scripting (XSS) vulnerability in its Report Handler component. An authenticated user can inject malicious script by manipulating the 'Report Title' field when adding a new report, which then executes in the browsers of other users viewing that report. Exploitation requires valid login credentials and user interaction (clicking a link or visiting a report page), but public exploit code is now available.

• CVE-2026-13570LOW 3.5

  SourceCodester Inventory Management System version 1.0 contains a cross-site scripting (XSS) vulnerability in its user registration endpoint. An authenticated attacker can inject malicious code through the full_name parameter in the /api/users_handler.php file, which gets reflected in the application without proper sanitization. This allows the attacker to execute JavaScript in the browsers of other users who view the affected data, potentially stealing session tokens or performing actions on their behalf.

• CVE-2026-14752LOW 3.5

  CVE-2026-14752 is a cross-site scripting (XSS) vulnerability in mjperpinosa stumasy, an open-source project using rolling releases. An authenticated attacker can manipulate the 'reference' argument in the add_definition function (found in application/PHP/objects/notes/add_into_dictionary.php) to inject malicious scripts. The vulnerability requires user interaction and authenticated access, limiting its immediate impact. Exploit code has been publicly disclosed, though the vendor has not yet responded to the early disclosure notification.

• CVE-2026-14791LOW 3.5

  A cross-site scripting (XSS) vulnerability exists in Crater Invoice versions up to 6.0.6, specifically in how the application handles invoice notes. An authenticated user can inject malicious script code through the notes field, which gets executed in the browsers of other users who view that invoice. The vulnerability requires user interaction (clicking or viewing a crafted invoice) to trigger, but poses a real risk in multi-user invoicing environments where attackers may have legitimate access.

• CVE-2026-15311LOW 3.5

  NousResearch hermes-agent contains a cross-site scripting (XSS) vulnerability in its Matrix Adapter component. When the MatrixAdapter processes Markdown-formatted messages and converts them to HTML, it fails to properly sanitize user-controlled input. An authenticated attacker can inject malicious scripts that execute in the context of another user's browser session, potentially stealing session tokens or performing actions on their behalf. The vulnerability requires the attacker to have valid credentials and user interaction (such as clicking a link), which limits its immediate threat scope. A fix is under review but not yet officially released.

• CVE-2026-61492LOW 3.5

  JetBrains YouTrack versions before 2026.2.17394 contain a stored cross-site scripting (XSS) vulnerability in article titles within digest emails. An authenticated attacker can inject malicious scripts into article titles that execute when other users view the digest email, potentially allowing credential theft, session hijacking, or malware distribution. The vulnerability requires user interaction (opening the email) and is confined to the email digest feature rather than the main application interface.

• CVE-2026-8981LOW 3.5

  The Custom Block Builder WordPress plugin before version 4.3.0 fails to properly validate user permissions when handling block template code in certain scenarios. This allows site administrators—particularly on WordPress multisite networks or single-site installations with `DISALLOW_UNFILTERED_HTML` enabled—to inject malicious JavaScript into block templates. When visitors load pages containing these blocks, the injected code executes in their browsers, potentially compromising user sessions or stealing sensitive information.

• CVE-2026-9060LOW 3.5

  The Store Locator WordPress plugin before version 1.6.6 contains a stored cross-site scripting (XSS) vulnerability in its admin settings. An administrator or similarly privileged user can inject malicious JavaScript into one of the plugin's settings, which is then executed when other high-privileged users (such as network super admins on multisite installations) visit the admin page. This bypasses WordPress's standard HTML filtering protections that normally prevent such attacks.

• CVE-2026-9061LOW 3.5

  The Store Locator WordPress plugin versions prior to 1.6.9 contain a stored cross-site scripting (XSS) vulnerability in how it handles store logo metadata. An administrator or other high-privileged user can inject malicious scripts through the store logo field that will execute when viewed on the plugin's admin page. This remains exploitable even in environments where HTML filtering is normally disabled, such as WordPress multisite networks. The vulnerability requires administrator-level access to exploit, limiting its scope but still representing a control bypass concern in restricted environments.

• CVE-2026-48940LOW 3.4

  A K2 component vulnerability in Joomla allows authenticated users with Author-level permissions to inject unescaped JavaScript code into articles. When a user with "create item" rights submits an article and embeds malicious script tags in the `embedVideo` field, K2 stores and displays that code without sanitization, causing it to execute in visitors' browsers. This is a stored cross-site scripting (XSS) vulnerability that requires an attacker to already have article creation privileges—a relatively high bar that limits exposure in most Joomla deployments.

• CVE-2026-49381LOW 3.4

  CVE-2026-49381 is a stored cross-site scripting (XSS) vulnerability in JetBrains TeamCity's SAML login page that existed prior to version 2026.1. An attacker with high privileges could inject malicious scripts into the login interface, which would then execute in the browsers of users who interact with that page. The vulnerability requires user interaction to trigger and has limited scope, affecting only the confidentiality of information visible to the victim during their session.

• CVE-2026-58371LOW 3.1

  SeaweedFS versions before 4.30 have a reflected cross-site scripting (XSS) vulnerability in their JSON response handling. An attacker can craft a malicious web page that, when visited by a user with network access to a SeaweedFS cluster, silently extracts sensitive information like cluster topology, server locations, and file listings. The vulnerability exists because SeaweedFS echoes back user-supplied callback parameters in responses labeled as JavaScript, without proper validation or security headers to prevent browsers from executing the reflected content.

• CVE-2026-54326LOW 2.5

  Pi is a lightweight terminal-based code editor that lets developers export their work sessions as static HTML files for documentation or sharing. Between versions 0.74.0 and 0.78.0, the application failed to properly validate link and image URLs in these exports, allowing potentially harmful URLs to slip through. An attacker could craft a malicious Markdown file that, when exported to HTML, would contain dangerous links—such as those beginning with 'javascript:' or other browser-executable schemes. The flaw exploited a bypass technique: sneaking C0 control characters (invisible, non-printing characters) into the URL scheme to fool the security filter. Browsers automatically clean up these hidden characters before acting on URLs, meaning the malicious intent survives. This is a low-severity issue because it requires local access to the Pi application and user interaction to trigger. It was patched in version 0.78.1.

• CVE-2026-10112LOW 2.4

  CVE-2026-10112 is a stored or reflected cross-site scripting (XSS) vulnerability in the Dashboard Page component of STUDENT-MANAGEMENT-SYSTEM version 1.0. An attacker with high privileges can inject malicious scripts through the Name parameter, which are then executed in the browsers of users who view the affected page. The vulnerability requires user interaction and has a low CVSS score of 2.4, but exploitation has already been disclosed publicly.

• CVE-2026-10514LOW 2.4

  A cross-site scripting (XSS) vulnerability exists in CordysCRM versions up to 1.6.2. The flaw is located in a request parameter handling component and allows attackers with administrative privileges to inject malicious scripts that execute in users' browsers. While public exploit code is available, the attack requires both high-level credentials and user interaction (such as clicking a malicious link), significantly limiting real-world risk. Upgrading to version 1.7.0 resolves the issue.

• CVE-2026-10529LOW 2.4

  A cross-site scripting (XSS) vulnerability has been discovered in westboy CicadasCMS affecting the Task Scheduling Management Module. The flaw exists in the ScheduleJobController component and can be triggered by an authenticated user with elevated privileges through a specially crafted request. While the vulnerability requires administrative or high-privilege access to exploit, the presence of user interaction (rendering) combined with public availability of exploit details elevates attention. The CMS uses a rolling release model, making definitive version tracking difficult, though the affected commit hash has been identified.

• CVE-2026-11338LOW 2.4

  A reflected cross-site scripting (XSS) vulnerability exists in SourceCodester Ship Ferry Ticket Reservation System version 1.0. An authenticated administrative user with high privileges can inject malicious JavaScript into the Username parameter on the user management page, which executes in the browsers of other users who view the manipulated content. The vulnerability requires user interaction and administrative access to trigger, limiting its immediate exposure but potentially enabling unauthorized account manipulation or credential theft within administrative workflows.

• CVE-2026-11434LOW 2.4

  FluentCMS version 0.0.5 contains a cross-site scripting (XSS) vulnerability in its Blocks Plugin, specifically within the /admin/blocks file. An authenticated administrator with high privileges can inject malicious scripts that execute in the browsers of other users viewing the affected page. The vulnerability requires user interaction (such as clicking a link) to trigger. Public exploit code is available, though the low CVSS score reflects the requirement for high-privilege authentication and user interaction to succeed.

• CVE-2026-11468LOW 2.4

  A cross-site scripting (XSS) vulnerability exists in SourceCodester Hospitals Patient Records Management System version 1.0. An authenticated administrator with high privileges can inject malicious scripts through the room_types page by manipulating the room parameter. When another user visits the affected page, the injected script executes in their browser, potentially allowing session hijacking, credential theft, or malware distribution. The vulnerability requires both administrative access to initiate the attack and user interaction (clicking a link or visiting a crafted URL) for the payload to execute. While the CVSS score is low, the healthcare context and potential for patient data exposure warrant careful attention.

• CVE-2026-11491LOW 2.4

  CodeAstro Human Resource Management System version 1.0 contains a stored cross-site scripting (XSS) vulnerability in its Notice Board Management feature. An attacker with high privileges can inject malicious JavaScript into the Notice Title field, which is then executed in the browsers of other users viewing that notice. The vulnerability requires user interaction (a victim must view the affected notice) and has already been disclosed publicly with exploit code available.

• CVE-2026-12202LOW 2.4

  A stored or reflected cross-site scripting (XSS) vulnerability exists in Intelliants Subrion CMS versions up to 4.0.3. The flaw resides in the Blocks Endpoint component, where improper handling of CSS class name parameters allows an attacker to inject malicious scripts. Because the vulnerability requires administrative privileges to exploit and user interaction is needed for the attack to succeed, the overall risk is low. However, the public disclosure of this issue means threat actors now have detailed information about how to craft attacks.

• CVE-2026-14655LOW 2.4

  A cross-site scripting (XSS) vulnerability exists in code-projects Assessment Management version 1.0, specifically in the admin/view-users.php file. An authenticated administrator with elevated privileges can inject malicious code through the User parameter, which executes in the browsers of other users viewing the affected page. This allows an attacker to steal session tokens, redirect users, or perform actions on their behalf. Exploitation requires both high-level access and user interaction, limiting real-world attack surface.

• CVE-2026-15321LOW 2.4

  MyEMS versions up to 6.4.0 contain a stored cross-site scripting (XSS) vulnerability in the Admin Backend API. The issue exists in the svg.py file's on_post function, where user-supplied data in the 'new_values' parameter is not properly sanitized before being stored or rendered. An authenticated administrator with high privileges can inject malicious scripts that will execute in the browsers of other users who interact with the affected feature. The vulnerability has a public exploit, though the low CVSS score reflects the requirement for administrative credentials and user interaction to trigger the attack.

• CVE-2026-44956NONE 0.0

  CVE-2026-44956 is a stored cross-site scripting (XSS) vulnerability that allows low-privileged users to inject malicious code through their Full Name field. The injected payload persists in system-generated emails, which are stored in the userlog table. When an administrator views the email content via the userlog-details.php page, the unescaped JavaScript executes in their browser, potentially compromising admin accounts or enabling unauthorized actions. The vulnerability has been patched by adding proper output sanitization to the userlog details display.

• CVE-2026-44960NONE 0.0

  A stored cross-site scripting (XSS) vulnerability exists in the audit log viewer that allows an attacker to inject malicious JavaScript through usernames. When an administrator views audit log details, any embedded script payload in a username would execute in their browser due to insufficient output sanitization. The vendor has patched this by adding proper output escaping to the audit log display.