CVE-2026-44960
OWASP ZAP Stored Cross-Site Scripting
Description
A stored XSS can be exploited by leveraging the usernames as an attack vector. When an admin user viewed the audit log details for affected entries, any malicious JavaScript payload embedded in the username would be executed due to missing output sanitisation. Proper escaping has been added to the audit log details output.
INFO
Published Date :
June 23, 2026, 4:14 p.m.
Last Modified :
June 23, 2026, 4:14 p.m.
Remotely Exploit :
No
Source :
hackerone
Solution
- Implement proper escaping for audit log output.
- Validate and sanitize all user-supplied input.
- Review and update sanitization routines regularly.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-44960 vulnerability anywhere in the article.