CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Cross-site Scripting (XSS) in serialize-javascript

TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

Vitess vttablet /twopcz reflected XSS

unstructured: Stored XSS via unescaped HTML generation

OmniFaces: Forged combined-resource IDs and related output/push boundaries

Microsoft Security Advisory CVE-2026-96230 - ASP.NET Core Remote Code Execution Vulnerability

Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS

Contao: Cross-site scripting in the comments bundle

Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Components

Indico: Cross-Site-Scripting in minutes editor

enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision

JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob

Ghost: Stored XSS via Embed Card Previews

Ghost : Stored XSS via SVG Files in Content Imports

Ghost: Stored XSS via SVG Uploads Bypassing Sanitization

Payload: Bypassed sanitization of user uploaded SVGs

Ghost: Stored XSS via oEmbed Photo Responses

Ghost: Stored XSS via Bookmark Card Images

Ghost: Stored XSS via File Uploads on Local Storage

Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable

Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained

Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()

Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer

DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes