Improper Neutralization of Script in Attributes in a Web Page

Every one of the 35 is a mark on the map. Named now: 1 to 26, most at risk first.

1. org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerabilityCVE-2023-37908xwiki · CVSS 9.1 · 1.1% likely

   Xwiki

2. Stored Cross-Site Scripting (XSS) on login page in GLPICVE-2022-39262glpi-project · CVSS 5.2 · 0.8% likely

   GLPI

3. PAN-OS: Improper Neutralization of Input in the Management Web InterfaceCVE-2025-4615Palo Alto Networks · CVSS 5.4 · 0.8% likely

   Palo Alto Networks

4. Improper Neutralization of Script in Attributes in XWiki (X)HTML renderersCVE-2023-32070xwiki · CVSS 9.1 · 0.7% likely

   Xwiki

5. MyBB: Contact page reflected XSSCVE-2026-45118mybb · CVSS 9.3 · 0.5% likely

   MyBB

6. HTML Cleaner allows crafted scripts in special contexts like svg or math to pass throughCVE-2024-52595fedora-python · CVSS 7.7 · 0.5% likely
7. Philips Clinical Collaboration Platform Improper Neutralization of Script in Attributes in a Web PageCVE-2020-14525Philips · CVSS 3.5 · 0.5% likely

   Philips

8. copyparty renders unsanitized filenames as HTML when user uploads empty filesCVE-2025-271459001 · CVSS 3.6 · 0.5% likely

   9001

9. Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop appCVE-2026-45733TriliumNext · CVSS 8.3 · 0.4% likely

   TriliumNext

10. Kirby: Self cross-site scripting (self-XSS) in the writer fieldCVE-2026-49276getkirby · CVSS 7.4 · 0.4% likely

    Getkirby

11. PAN-OS: Improper Neutralization of Input in the Management Web InterfaceCVE-2025-0125Palo Alto Networks · CVSS 6.9 · 0.4% likely

    Palo Alto Networks

12. PAN-OS: Improper Neutralization of Input in the Management Web InterfaceCVE-2025-0137Palo Alto Networks · CVSS 4.8 · 0.4% likely

    Palo Alto Networks

13. DOM XSS in Developer mode dashboard via redirect GET parameterCVE-2023-30958Palantir · CVSS 4.7 · 0.4% likely

    Palantir

14. File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC rendererCVE-2026-91127flyfish-dev · CVSS 8.2 · 0.4% likely
15. Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islandsCVE-2026-59727withastro · CVSS 2.1 · 0.4% likely

    Withastro

16. Potential cross-site scripting via URLField values in the adminCVE-2026-15920djangoproject · CVSS 6.1 · 0.4% likely

    Djangoproject

17. Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSSCVE-2026-62324xdan · CVSS 5.4 · 0.3% likely

    Xdan

18. Volkov Labs Business Links plugin vulnerable to privilege escalation attackCVE-2025-58746VolkovLabs · CVSS 9.1 · 0.3% likely
19. Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URLCVE-2026-53722nuxt · CVSS 5.1 · 0.3% likely

    Nuxt

20. OCO-Server: Stored XSS through agent hostnames in command buttonsCVE-2026-61791schorschii · CVSS 7.4 · 0.3% likely
21. An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme. This vulnerability affec…CVE-2024-26283Mozilla · CVSS 7.8 · 0.3% likely

    Mozilla

22. OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakoutCVE-2026-58391opnsense · CVSS 5.4 · 0.3% likely

    Opnsense

23. @tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSSCVE-2026-108260tinacms · CVSS 7.6 · 0.3% likely

    Tinacms

24. A stored cross-site scripting (XSS) vulnerability in Simple Machines Forum v2.1.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into th…CVE-2025-67163Simplemachines · CVSS 6.1 · 0.3% likely

    SimpleMachines

25. GFI KerioConnect < 10.0.9p2 XSS via Link Auto-FormatterCVE-2026-112356GFI USA, LLC · CVSS 6.1 · 0.3% likely
26. Saleor lacks proper HTML sanitization in rich text fieldsCVE-2026-22849saleor · CVSS 7.2 · 0.2% likely

    Saleor

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.