Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:79"
1,848 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-73159 |
medium | 5.1 | 0.0040 | 2026-08-11 | Affected versions of cti-transmute allow a tag's icon value to be stored and later interpolated into | |
CVE-2026-73161 |
medium | 5.1 | 0.0040 | 2026-08-11 | Affected versions of cti-transmute improperly handle conversion-table values passed through the sear | |
CVE-2026-72747 |
medium | 5.1 | 0.0035 | 2026-08-11 | AVideo fails to sanitize the phone field during user registration, allowing unauthenticated attacker | |
CVE-2026-19434 |
medium | 5.1 | 0.0047 | 2026-08-11 | Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated | |
CVE-2026-72787 |
medium | 5.1 | 0.0026 | 2026-08-12 | Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control | |
CVE-2026-19716 |
medium | 5.1 | 0.0047 | 2026-08-13 | Stored Cross-site Scripting (CWE-79) in the user management component in maalfer Pentestify before 1 | |
CVE-2026-73648 |
medium | 5.1 | 0.0055 | 2026-08-13 | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 | |
CVE-2026-74908 |
medium | 5.1 | 0.0026 | 2026-08-18 | Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only | |
CVE-2026-75107 |
medium | 5.1 | 0.0024 | 2026-08-18 | Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append | |
CVE-2026-75831 |
medium | 5.1 | 0.0035 | 2026-08-18 | Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media | |
CVE-2026-75834 |
medium | 5.1 | 0.0026 | 2026-08-18 | Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss() | |
CVE-2026-75838 |
medium | 5.1 | 0.0039 | 2026-08-18 | DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where | |
CVE-2026-73336 |
medium | 5.1 | 0.0027 | 2026-08-18 | Joomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2 - Impr | |
CVE-2026-41921 |
medium | 5.1 | 0.0030 | 2026-08-18 | Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in | |
CVE-2026-18371 |
medium | 5.1 | 0.0040 | 2026-08-19 | HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to | |
CVE-2026-64970 |
medium | 5.1 | 0.0046 | 2026-08-20 | ATutor is vulnerable to Stored Cross Site Scripting in registration functionality. An attacker can | |
CVE-2026-73537 |
medium | 5.1 | 0.0029 | 2026-08-21 | Cross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited | |
CVE-2026-8630 |
medium | 5.1 | 0.0026 | 2026-08-23 | justhtml before 1.12.0 (versions <= 1.11.0) contains a mutation cross-site scripting (mXSS) vulnerab | |
CVE-2026-63147 |
medium | 5.1 | 0.0021 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that all | |
CVE-2026-63148 |
medium | 5.1 | 0.0018 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that all | |
CVE-2026-63156 |
medium | 5.1 | 0.0030 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a reflected cross-site scripting vulnerability that | |
CVE-2026-63157 |
medium | 5.1 | 0.0022 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that all | |
CVE-2026-63168 |
medium | 5.1 | 0.0028 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that all | |
CVE-2026-63171 |
medium | 5.1 | 0.0022 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that all | |
CVE-2026-113683 |
medium | 5.1 | 0.0036 | 2026-10-20 | VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross-site scripting vuln | |
CVE-2012-20003 |
medium | 5.1 | 0.0027 | 2026-10-20 | Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerabil | |
CVE-2012-20004 |
medium | 5.1 | 0.0027 | 2026-10-20 | K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability tha | |
CVE-2014-125131 |
medium | 5.1 | 0.0026 | 2026-10-20 | DedeCMS 5.6 and 5.7 contains a reflected cross-site scripting vulnerability that allows unauthentica | |
CVE-2016-20102 |
medium | 5.1 | 0.0026 | 2026-10-20 | JavaMelody before 1.60.0 contains a reflected cross-site scripting vulnerability that allows unauthe | |
CVE-2026-114407 |
medium | 5.1 | 0.0028 | 2026-10-21 | e107 CMS before 2.3.13 contains a reflected cross-site scripting vulnerability that allows unauthent | |
CVE-2017-20288 |
medium | 5.1 | 0.0026 | 2026-10-22 | QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unaut | |
CVE-2017-20290 |
medium | 5.1 | 0.0027 | 2026-10-22 | Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability th | |
CVE-2023-54413 |
medium | 5.1 | 0.0021 | 2026-10-22 | WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vu | |
CVE-2026-115507 |
medium | 5.1 | 0.0020 | 2026-10-22 | Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in | |
CVE-2026-112333 |
medium | 5.1 | 0.0014 | 2026-10-23 | GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights s | |
CVE-2026-116139 |
medium | 5.1 | 0.0023 | 2026-10-25 | WWBN AVideo 26.0 through 29.3.0 contains a stored cross-site scripting vulnerability that allows aut | |
CVE-2026-116169 |
medium | 5.1 | 0.0021 | 2026-10-25 | SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerability that allows use | |
CVE-2026-116202 |
medium | 5.1 | 0.0014 | 2026-10-25 | YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability that allows low-privilege | |
CVE-2026-103377 |
medium | 5.1 | 0.0041 | 2026-10-26 | A reflected Cross-Site Scripting (XSS) vulnerability has been identified in the web application of t | |
CVE-2026-4316 |
medium | 5.1 | 0.0042 | 2026-10-26 | Reflected Cross-Site Scripting (XSS) in Gym Management Software IsMyGym by Zuinq Studio affecting th | |
CVE-2026-116212 |
medium | 5.1 | 0.0017 | 2026-10-26 | Webasyst Framework through 4.4.0 contains a stored cross-site scripting vulnerability in the Photos | |
CVE-2026-116385 |
medium | 5.1 | 0.0024 | 2026-10-26 | A security vulnerability has been detected in Bdtask Garage 24 Garage Management Software 1.0. This | |
CVE-2026-113689 |
medium | 5.1 | — | 2026-10-29 | Stored cross-site scripting in the SmartIT work-notes feature of BMC IT Service Management Suite ver | |
CVE-2026-113691 |
medium | 5.1 | — | 2026-10-29 | Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Su | |
CVE-2026-119054 |
medium | 5.1 | — | 2026-10-29 | Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerabil | |
CVE-2026-56354 |
medium | 5.1 | 0.0024 | 2026-07-10 | n8n before 1.123.24, 2.10.4, and 2.12.0 (across its 1.x and 2.x branches) contains cross-site script | |
CVE-2026-56356 |
medium | 5.1 | 0.0025 | 2026-06-30 | n8n contains a stored cross-site scripting vulnerability in the Chat Trigger node's Custom CSS field | |
CVE-2026-56358 |
medium | 5.1 | 0.0024 | 2026-06-24 | n8n before 1.123.25 (1.x) and before 2.11.2 (2.x), with the fix also included in 2.12.0, contains a | |
CVE-2016-20084 |
medium | 5.1 | 0.0024 | 2026-06-15 | WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulnerabilities | |
CVE-2025-34253 |
medium | 5.1 | 0.0054 | 2025-10-16 | D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain a stored cross-site scripting (XSS) vuln |