CVE-2026-100184 Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Query Parameter via Text Area Predefined Value

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'x attacker-chosen name matching the form's url. predefined value' parameter in all versions up to, and includin...

CVE-2026-89047

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

URL_CHECKER

Comprobador de Phishing de URLs Una herramienta ligera basada en web que detecta si una URL es probablemente phishing o segura usando un enfoque híbrido de Aprendizaje Automático Random Forest/SVM y análisis basado en reglas heurísticas. Construido con fines educativos y experimentación en...

CLEANSTART-2026-MW22726 Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL

Security vulnerability affects the cri-tools package. The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL...

Olyx

Olyx A modern Android application for comprehensive URL security analysis, combining multiple threat detection APIs with advanced domain spoofing detection to protect users from malicious websites. Screenshots Features Multi-API Security Analysis AbuseIPDB : Scans IP reputation for reported...

CVE-2026-101147

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...

WordPress Featured Image from URL (FIFU) plugin 6.0.0-6.0.7 - Administrator Account Creation vulnerability

Administrator Account Creation vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Featured Image from URL FIFU versions 6.0.0-6.0.7...

CVE-2026-101147 Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...

WordPress Featured Image from URL (FIFU) Premium plugin 6.8.0-8.2.7 - Administrator Account Creation vulnerability

Administrator Account Creation vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Featured Image from URL FIFU Premium versions 6.8.0-8.2.7...

EUVD-2026-90506

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...

CVE-2026-101147

The Featured Image from URL (FIFU) WordPress plugin (before 6.0.8 ) and the Featured Image from URL (FIFU) Premium plugin (before 8.2.8 ) are vulnerable to a CSRF attack . The root cause is the failure to correctly enforce the REST API nonce , which can be bypassed using a crafted URL. An attacke...

CVE-2026-101147 Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...

React2Shell

React2Shell - CVE-2025-55182 & CVE-2025-66478 Author: LAKSHMIKANTHAN K letchupkt Instagram: @letchupkt Version: 2.0.0 Obfuscated Date: 2025-12-07 🚀 Quick Start Run the Scanner python react2shell.py That's it! The scanner will: 1. Verify its integrity 2. Decompress the code 3. Execute normally All...

CLEANSTART-2026-SL87609 url

CVE-2026-25679 affects multiple packages. url. See references for individual vulnerability details...

PT-2026-103718

Name of the Vulnerable Software and Affected Versions Social Media Share Buttons & Social Sharing Icons versions prior to 3.0.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting XSS, a technique where maliciou...

Rocky Linux 8 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2024_6148)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20246148 advisory. node-tar: denial of service while parsing a tar file due to lack of folders depth validation CVE-2024-28863 nodejs: Bypass network import restriction via...

Rocky Linux 10.1 [CIQ] Security Update: delve / delve-debuginfo / delve-debugsource Multiple Vulnerabilities (crlsa-2026_8842)

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20268842 advisory. crypto/x509: Incorrect enforcement of email constraints in crypto/x509 CVE-2026-27137 net/url: Incorrect parsing of IPv6 host literals in net/url...

CentOS Linux 8.4 [TuxCare] Security Update: platform-python / platform-python-debug / platform-python-devel / etc (CENTOS8.4:CLSA-2026:1777456062)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1777456062 advisory. - The webbrowser.open API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New...

Rocky Linux 9 [CIQ] Security Update: runc / runc-debuginfo / runc-debugsource Multiple Vulnerabilities (crlsa-2026_29702)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202629702 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient...

CVE-2026-103686: Improper Neutralization of Input During Web Page Generation

A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanitizer.php of the component URL Validation. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been...