Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:79"
1,895 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-42870 |
medium | 6.4 | 0.0035 | 2026-05-11 | WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a Stored Cross-Site | |
CVE-2026-43876 |
medium | 6.4 | 0.0019 | 2026-05-11 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/notifySu | |
CVE-2026-6646 |
medium | 6.4 | 0.0028 | 2026-05-15 | The The7 theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dt_default_button | |
CVE-2026-48167 |
medium | 6.4 | 0.0025 | 2026-06-22 | Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 un | |
CVE-2026-52781 |
medium | 6.4 | 0.0025 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the H | |
CVE-2026-5220 |
medium | 6.4 | 0.0025 | 2026-07-01 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-4804 |
medium | 6.4 | 0.0028 | 2026-07-03 | The Zakra theme for WordPress is vulnerable to Stored Cross-Site Scripting via post meta values in a | |
CVE-2026-3251 |
medium | 6.4 | 0.0025 | 2026-07-10 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-15161 |
medium | 6.4 | 0.0026 | 2026-07-17 | The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Stored Cross-Site Scripting in | |
CVE-2026-18197 |
medium | 6.4 | 0.0028 | 2026-07-29 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-15421 |
medium | 6.4 | 0.0041 | 2026-08-19 | The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable | |
CVE-2026-104727 |
medium | 6.4 | 0.0025 | 2026-10-29 | The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site | |
CVE-2026-109215 |
medium | 6.4 | 0.0033 | 2026-10-29 | The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bbp_r | |
CVE-2026-96563 |
medium | 6.4 | 0.0020 | 2026-10-10 | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Store | |
CVE-2026-118500 |
medium | 6.4 | 0.0022 | 2026-10-30 | The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to St | |
CVE-2026-118634 |
medium | 6.4 | 0.0020 | 2026-10-30 | The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'widt | |
CVE-2026-110533 |
medium | 6.4 | — | 2026-10-30 | The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | |
CVE-2026-102918 |
medium | 6.4 | — | 2026-10-30 | The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all version | |
CVE-2026-115869 |
medium | 6.4 | — | 2026-10-30 | The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'varia | |
CVE-2026-119113 |
medium | 6.4 | — | 2026-10-30 | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPre | |
CVE-2026-119176 |
medium | 6.4 | — | 2026-10-30 | The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting | |
CVE-2026-9239 |
medium | 6.4 | — | 2026-10-30 | The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Al | |
CVE-2026-6179 |
medium | 6.3 | 0.0017 | 2026-04-13 | Stored Cross Site Scripting in NightWolf Penetration Testing Platform allows attack trigger and run | |
CVE-2026-9806 |
medium | 6.3 | 0.0026 | 2026-05-28 | A stored cross-site scripting (XSS) vulnerability exists in the notification panel of CTI Transmute | |
CVE-2026-39451 |
medium | 6.3 | 0.0018 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in WP Google Review Slider <= 18.0 versions. | |
CVE-2026-21768 |
medium | 6.3 | 0.0016 | 2026-06-19 | The compose-rich-editor library (v1.0.0-rc14) used in HCL Verse for Android's rich text email compos | |
CVE-2026-10585 |
medium | 6.3 | 0.0032 | 2026-06-30 | A stored cross-site scripting vulnerability was identified in GitHub Enterprise Server that allowed | |
CVE-2026-49978 |
medium | 6.3 | 0.0040 | 2026-07-14 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DO | |
CVE-2026-14856 |
medium | 6.3 | 0.0039 | 2026-07-27 | A stored Cross-Site Scripting (XSS) vulnerability in the file upload functionality of the Media Mana | |
CVE-2026-66921 |
medium | 6.3 | 0.0044 | 2026-07-28 | Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled nodeName v | |
CVE-2026-66779 |
medium | 6.3 | 0.0035 | 2026-08-11 | Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP, an authe | |
CVE-2026-115513 |
medium | 6.3 | 0.0030 | 2026-10-22 | OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privil | |
CVE-2026-61673 |
medium | 6.3 | 0.0033 | 2026-10-29 | WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored DOM cross-site scriptin | |
CVE-2026-112353 |
medium | 6.2 | 0.0024 | 2026-10-27 | GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulner | |
CVE-2026-44737 |
medium | 6.2 | 0.0032 | 2026-05-11 | grav-plugin-admin is the admin plugin for Grav is an HTML user interface that provides a convenient | |
CVE-2026-55466 |
medium | 6.2 | 0.0044 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG c | |
CVE-2026-55481 |
medium | 6.2 | 0.0032 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, default.blade.php renders header_ | |
CVE-2026-28315 |
medium | 6.2 | 0.0052 | 2026-07-21 | SolarWinds Serv-U was found to be affected by a stored cross-site scripting vulnerability that could | |
CVE-2026-18481 |
medium | 6.2 | 0.0051 | 2026-07-31 | Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might a | |
CVE-2023-0606 |
medium | 6.1 | 0.0064 | 2023-02-01 | Cross-site Scripting (XSS) - Reflected in GitHub repository ampache/ampache prior to 5.5.7. | |
CVE-2023-24521 |
medium | 6.1 | 0.0039 | 2023-02-14 | Due to insufficient input sanitization, SAP NetWeaver AS ABAP (BSP Framework) - versions 700, 701, 7 | |
CVE-2023-30741 |
medium | 6.1 | 0.0039 | 2023-05-09 | Due to insufficient input validation, SAP BusinessObjects Business Intelligence Platform - versions | |
CVE-2023-30742 |
medium | 6.1 | 0.0044 | 2023-05-09 | SAP CRM (WebClient UI) - versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, | |
CVE-2023-32070 |
medium | 6.1 | 0.0065 | 2023-05-10 | 1 PoC | XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check f |
CVE-2025-60934 |
medium | 6.1 | 0.0019 | 2025-10-21 | Multiple stored cross-site scripting (XSS) vulnerabilities in the index.php component of HR Performa | |
CVE-2025-61457 |
medium | 6.1 | 0.0032 | 2025-10-21 | code16 Sharp v9.6.6 is vulnerable to Cross Site Scripting (XSS) src/Form/Fields/SharpFormUploadField | |
CVE-2025-63448 |
medium | 6.1 | 0.0030 | 2025-11-03 | Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /edit_product.php?id=1. | |
CVE-2025-63418 |
medium | 6.1 | 0.0023 | 2025-11-05 | A DOM-based Cross-Site Scripting (XSS) vulnerability in the SelfBest platform 2023.3 allows attacker | |
CVE-2024-44635 |
medium | 6.1 | 0.0024 | 2025-11-14 | PHPGurukul Student Record System 3.20 is vulnerable to Cross Site Scripting (XSS) via adminname and | |
CVE-2024-44647 |
medium | 6.1 | 0.0024 | 2025-11-17 | PHPGurukul Small CRM 3.0 is vulnerable to Cross Site Scripting (XSS) via the aremark parameter in ma |