179 matches found
CVE-2026-14995
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI Path in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...
EUVD-2026-90560
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI Path in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...
CVE-2026-14995 Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI Path in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...
CVE-2026-14995
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.1.15.1 . The root cause is insufficient input sanitization and output escaping when handling the REQUEST_URI Path . An unauthenticated attacker can inject arbitrary web sc...
CVE-2022-36663-PoC
CVE-2022-36663-PoC Internal network scanner through Gluu IAM blind ssrf Gluu IAM is vulnerable to blind SSRF which can be exploited to scan the internal network for open ports depending on response times. https://nvd.nist.gov/vuln/detail/CVE-2022-36663 To check if the target is vulnerable, add...
Keycloak-12.0.1-CVE-2020-10770
Keycloak-12.0.1-CVE-2020-10770 Keycloak 12.0.1 - 'requesturi ' Blind Server-Side Request Forgery SSRF Unauthenticated Exploit-DB-50405 Expected outcome: Port scan of localhost or internally accessible hosts. Intended only for educational and testing in corporate environments. This Exploit was...
Newsletter < 7.4.5 - Cross-Site Scripting
The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $SERVER'REQUESTURI' before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to Reflected XSS in older browsers such as...
CVE-2024-27198-TeamCity
Mitigation methods: regexp on WAF REQUESTURI Regex ^\S\?jsp=\S;\.jsp...
CVE-2026-15273
The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI in all version 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an...
CVE-2026-15273 Automatic.css 4.0.0 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI
The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI in all version 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an...
CVE-2026-15273
The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in version 4.0.0 . The root cause is insufficient input sanitization and output escaping related to the REQUEST_URI . This flaw allows unauthenticated attackers to inject arbitrary web scripts, which execute...
EUVD-2026-87526
The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI in all version 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an...
Exploit for CVE-2026-62062
abraxaslabs.tech · github.com/abraxas ·&...
WordPress Automatic.css plugin 4.0.0 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI vulnerability
Unauthenticated Stored Cross-Site Scripting via REQUESTURI vulnerability discovered by Nguyen Ngoc Duc duc193 in WordPress Plugin Automatic.css versions 4.0.0...
EUVD-2026-83822
A security vulnerability has been detected in QCMS up to 6.0.6. This issue affects the function selfTmp in the library Lib/Config/Controllers.php of the component Content Detail Page. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit...
CVE-2026-89241
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in confirmLivePassword.php that copies REQUESTURI into a form action attribute without encoding. Attackers can craft a malicious URL with a quote character to break out of t...
CVE-2026-89241
WWBN AVideo contains a reflected cross-site scripting (XSS) vulnerability in confirmLivePassword.php . The root cause is that the script copies the REQUEST_URI variable directly into a form action attribute without encoding. An attacker can craft a malicious URL containing a quote character to br...
CVE-2026-89241 WWBN AVideo Reflected XSS via confirmLivePassword.php
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in confirmLivePassword.php that copies REQUESTURI into a form action attribute without encoding. Attackers can craft a malicious URL with a quote character to break out of t...
EUVD-2026-76053
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in confirmLivePassword.php that copies REQUESTURI into a form action attribute without encoding. Attackers can craft a malicious URL with a quote character to break out of t...
CVE-2026-89241 WWBN AVideo Reflected XSS via confirmLivePassword.php
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in confirmLivePassword.php that copies REQUESTURI into a form action attribute without encoding. Attackers can craft a malicious URL with a quote character to break out of t...