CWE-79

z-song laravel-admin 1.7.3 has XSS via the Slug or Name on the Roles screen, because of mishandling on the “Operation log” screen.

LavaLite through 5.7 has XSS via a crafted account name that is mishandled on the Manage Clients screen.

S-CMS v1.5 has XSS in tpl.php via the member/member_login.php from parameter.

cPanel before 82.0.15 allows self XSS in the SSL Certificate Upload interface (SEC-521).

cPanel before 82.0.15 allows self XSS in LiveAPI example scripts (SEC-524).

cPanel before 82.0.15 allows self XSS in the SSL Key Delete interface (SEC-526).