Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:79"
1,884 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2024-34321 |
medium | 6.1 | 0.0019 | 2026-10-13 | ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) | |
CVE-2024-34326 |
medium | 6.1 | 0.0019 | 2026-10-13 | ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) | |
CVE-2026-113659 |
medium | 6.1 | 0.0034 | 2026-10-20 | ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticat | |
CVE-2024-5139 |
medium | 6.1 | 0.0023 | 2026-10-21 | The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for th | |
CVE-2026-114718 |
medium | 6.1 | 0.0024 | 2026-10-22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnera | |
CVE-2025-69723 |
medium | 6.1 | 0.0023 | 2026-10-22 | A reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers to execut | |
CVE-2026-93638 |
medium | 6.1 | 0.0030 | 2026-10-23 | A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) | |
CVE-2026-105323 |
medium | 6.1 | 0.0018 | 2026-10-27 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-92098 |
medium | 6.1 | 0.0022 | 2026-10-28 | The Webheadcoder Multi-Step Forms for Contact Form 7 plugin for WordPress is vulnerable to Reflected | |
CVE-2026-101935 |
medium | 6.1 | 0.0025 | 2026-10-28 | The Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search plugin for WordPress is vulnerabl | |
CVE-2026-118652 |
medium | 6.1 | 0.0024 | 2026-10-28 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatena | |
CVE-2026-11854 |
medium | 6.1 | 0.0021 | 2026-10-28 | The authentication endpoint generates an error message that includes reflected data directly from th | |
CVE-2026-61573 |
medium | 6.1 | 0.0025 | 2026-10-28 | AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request v | |
CVE-2026-58643 |
medium | 6.1 | 0.0041 | 2026-07-16 | Improper neutralization of input during web page generation ('cross-site scripting') in Windows Admi | |
CVE-2021-25828 |
medium | 6.1 | 0.0053 | 2023-06-28 | Emby Server versions < 4.6.0.50 is vulnerable to Cross Site Scripting (XSS) vulnerability via a craf | |
CVE-2023-36386 |
medium | 6.1 | 0.0044 | 2023-07-11 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX | |
CVE-2023-23548 |
medium | 6.1 | 0.0041 | 2023-08-01 | Reflected XSS in business intelligence in Checkmk <2.2.0p8, <2.1.0p32, <2.0.0p38, <=1.6.0p30. | |
CVE-2025-6430 |
medium | 6.1 | 0.0027 | 2025-06-24 | When a file download is specified via the `Content-Disposition` header, that directive would be igno | |
CVE-2025-63499 |
medium | 6.1 | 0.0030 | 2025-12-04 | Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter. | |
CVE-2025-67443 |
medium | 6.1 | 0.0019 | 2025-12-22 | Schlix CMS before v2.2.9-5 is vulnerable to Cross Site Scripting (XSS). Due to lack of javascript sa | |
CVE-2026-0618 |
medium | 6.1 | 0.0018 | 2026-01-07 | Cross-site Scripting vulnerability in Devolutions PowerShell Universal.This issue affects Powershell | |
CVE-2026-0670 |
medium | 6.1 | 0.0019 | 2026-01-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab | |
CVE-2026-0671 |
medium | 6.1 | 0.0024 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab | |
CVE-2026-33883 |
medium | 6.1 | 0.0015 | 2026-03-27 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and | |
CVE-2026-20085 |
medium | 6.1 | 0.0019 | 2026-04-01 | A vulnerability in the web-based management interface of Cisco IMC could allow an unauthenticated, r | |
CVE-2026-33978 |
medium | 6.1 | 0.0029 | 2026-04-01 | Notesnook is a note-taking app focused on user privacy & ease of use. Prior to version 3.3.17, a sto | |
CVE-2026-33403 |
medium | 6.1 | 0.0019 | 2026-04-06 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tra | |
CVE-2026-33404 |
medium | 6.1 | 0.0014 | 2026-04-06 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tra | |
CVE-2026-33406 |
medium | 6.1 | 0.0025 | 2026-04-06 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tra | |
CVE-2026-39335 |
medium | 6.1 | 0.0025 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.1, there is Stored XSS in group r | |
CVE-2026-39336 |
medium | 6.1 | 0.0021 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting | |
CVE-2026-5301 |
medium | 6.1 | 0.0028 | 2026-04-08 | Stored XSS in log viewer in CoolerControl/coolercontrol-ui <4.0.0 allows unauthenticated attackers t | |
CVE-2026-40112 |
medium | 6.1 | 0.0022 | 2026-04-09 | PraisonAI is a multi-agent teams system. Prior to 4.5.128, the Flask API endpoint in src/praisonai/a | |
CVE-2026-1116 |
medium | 6.1 | 0.0026 | 2026-04-12 | A Cross-site Scripting (XSS) vulnerability was identified in the `from_dict` method of the `AppLollm | |
CVE-2026-0512 |
medium | 6.1 | 0.0023 | 2026-04-14 | Due to a Cross-Site Scripting (XSS) vulnerability in the SAP Supplier Relationship Management (SICF | |
CVE-2026-21331 |
medium | 6.1 | 0.0028 | 2026-04-14 | Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (X | |
CVE-2026-32196 |
medium | 6.1 | 0.0029 | 2026-04-14 | Improper neutralization of input during web page generation ('cross-site scripting') in Windows Admi | |
CVE-2026-20059 |
medium | 6.1 | 0.0019 | 2026-04-15 | A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unaut | |
CVE-2026-40186 |
medium | 6.1 | 0.0025 | 2026-04-15 | ApostropheCMS is an open-source Node.js content management system. A regression introduced in commit | |
CVE-2026-33436 |
medium | 6.1 | 0.0017 | 2026-04-17 | Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. I | |
CVE-2026-40302 |
medium | 6.1 | 0.0021 | 2026-04-17 | zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the | |
CVE-2026-31013 |
medium | 6.1 | 0.0019 | 2026-04-21 | Dovestones Softwares ADPhonebook <4.0.1.1 has a reflected cross-site scripting (XSS) vulnerability i | |
CVE-2026-41067 |
medium | 6.1 | 0.0019 | 2026-04-24 | Astro is a web framework. Prior to 6.1.6, the defineScriptVars function in Astro's server-side rende | |
CVE-2025-56535 |
medium | 6.1 | 0.0019 | 2026-04-29 | A cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbit | |
CVE-2025-56536 |
medium | 6.1 | 0.0019 | 2026-04-29 | A stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execut | |
CVE-2026-42366 |
medium | 6.1 | 0.0021 | 2026-05-04 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the Web Interface / ssi.cgi f | |
CVE-2026-7371 |
medium | 6.1 | 0.0021 | 2026-05-04 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the Web Interface / ssi.cgi f | |
CVE-2026-42509 |
medium | 6.1 | 0.0036 | 2026-05-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-39823 |
medium | 6.1 | 0.0031 | 2026-05-07 | CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag | |
CVE-2026-32207 |
medium | 6.1 | 0.0058 | 2026-05-07 | Improper neutralization of input during web page generation ('cross-site scripting') in Azure Machin |