CWE-87 Improper Neutralization of Alternate XSS Syntax

Apache Answer has an Improper Neutralization of Alternate XSS Syntax vulnerability

Open WebUI allows limited stored XSS vila uploaded html file

Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`

TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes

md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)

Open WebUI has XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image

Magento LTS: Reflected XSS - Import -> Data Flow (profiles)

n8n Vulnerable to XSS via MCP OAuth client

DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload

Leaf-kit html escaping does not work on characters that are part of extended grapheme cluster

YesWiki has Persistent Blind XSS at "/?BazaR&vue=consulter"

Contao is vulnerable to cross-site scripting in templates

bagisto has Cross Site Scripting (XSS) in Create New Customer

bagisto has a Cross Site Scripting (XSS) vulnerability in TinyMCE Image Upload (SVG)

bagisto has Cross Site Scripting (XSS) issue in TinyMCE Image Upload (HTML)

Gokapi has stored XSS vulnerability in friendly name for API keys

Gokapi vulnerable to stored XSS via uploading file with malicious file name

Node-SAML SAML Authentication Bypass

Hax CMS Stored Cross-Site Scripting vulnerability

Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]

JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>

Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tags

Apache Tiles Vulnerable to XSS via EL Expression Injection

pimcore/customer-management-framework-bundle Cross-site Scripting vulnerability in Segment name

XWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit template