https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 24 Oct 2026 11:54:09 +0000 https://cve.radiocsirt.org/vuln/cnvd-2026-02641 cnvd-2026-02641 https://cve.radiocsirt.org/vuln/cnvd-2026-02641 https://cve.radiocsirt.org/vuln/euvd-2026-260235 EUVD-2026-260235 https://cve.radiocsirt.org/vuln/euvd-2026-260235 https://cve.radiocsirt.org/vuln/fkie_cve-2025-63589 <p>A reflected XSS vulnerability exists in CMSimple_XH 1.8&#39;s index.php router when attacker-controlled path segments are not sanitized or encoded before being inserted into the generated HTML (navigation links, breadcrumbs, search form action, footer links). An attacker-controlled string placed in the URL path is reflected into multiple HTML elements, allowing execution of arbitrary JavaScript in victims&#39; browsers visiting a crafted URL.</p> <p>A reflected XSS vulnerability exists in CMSimple_XH 1.8&#39;s index.php router when attacker-controlled path segments are not sanitized or encoded before being inserted into the generated HTML (navigation links, breadcrumbs, search form action, footer links). An attacker-controlled string placed in the URL path is reflected into multiple HTML elements, allowing execution of arbitrary JavaScript in victims&#39; browsers visiting a crafted URL.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-63589 https://cve.radiocsirt.org/vuln/ghsa-vjvr-7hrq-r8p6 <p>A reflected XSS vulnerability exists in CMSimple_XH 1.8&#39;s index.php router when attacker-controlled path segments are not sanitized or encoded before being inserted into the generated HTML (navigation links, breadcrumbs, search form action, footer links). An attacker-controlled string placed in the URL path is reflected into multiple HTML elements, allowing execution of arbitrary JavaScript in victims&#39; browsers visiting a crafted URL.</p> <p>A reflected XSS vulnerability exists in CMSimple_XH 1.8&#39;s index.php router when attacker-controlled path segments are not sanitized or encoded before being inserted into the generated HTML (navigation links, breadcrumbs, search form action, footer links). An attacker-controlled string placed in the URL path is reflected into multiple HTML elements, allowing execution of arbitrary JavaScript in victims&#39; browsers visiting a crafted URL.</p> https://cve.radiocsirt.org/vuln/ghsa-vjvr-7hrq-r8p6