GitLab Community and Enterprise Editions version 8.4 up to 10.4 are vulnerable to XSS because a lack of input validation in the merge request component leads to cross site scripting (specifically, filenames in changes tabs of merge requests). This is fixed in 10.6.3, 10.5.7, and 10.4.7.

The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier may allow an attacker to delete files in the system via specific request parameters.

ncmpc through 0.29 is prone to a NULL pointer dereference flaw. If a user uses the chat screen and another client sends a long chat message, a crash and denial of service could occur.

proberv.php in Yahei-PHP Proberv 0.4.7 has XSS via the funName parameter.

iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the “Site Description” field.

iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the “Site title” field.