1061 matches found
-CVE-2021-26904
CVE-2021-26904 LMA ISIDA Retriever 5.2 permet une injection SQL Description suggérée : "ISIDA RETRIEVER v5.2" Injection SQL Fonctionnalité vulnérable : La plateforme ISIDA RETRIEVER est vulnérable à l'injection SQL URL et paramètre vulnérables : website.com/index.php?title=Injection URL et...
CVE-2025-56807
CVE-2025-56807 Descrizione Una vulnerabilità di Stored Cross Site Scripting XSS è stata scoperta in FairSketch RISE Ultimate Project Manager & CRM v3.9.4 nella funzionalità File Manager. La vulnerabilità risiede nel parametro title inviato durante la creazione di nuove cartelle. A causa di una...
CVE-2024-44542
CVE-2024-44542 Descrizione: è stato scoperto che todesk v1.1 contiene una vulnerabilità di SQL injection tramite il parametro title in /todesk.com/news.html. Tipo di vulnerabilità: SQL Injection Produttore: todesk Versione prodotto affetta: todesk - v1.1 Componente affetto: todesk.com, news.html...
CVE-2026-38469
A Stored XSS vulnerability in the custom bonus title feature of GazellePW (GazellePosterWall) (commit 86c4bedf) allows remote authenticated users to inject arbitrary JavaScript via the title parameter in /bonus.php and /user.php?action=staff_tool. The vulnerable sinks are located in users.class.p...
CVE-2026-15653
The CVE concerns the WordPress plugin Visualizer – Tables & Charts Manager with Built-in AI Generator. All versions up to 4.0.5 are vulnerable to Stored Cross‑Site Scripting via the backend-title parameter due to insufficient input sanitization and output escaping. Exploitation requires at least ...
EUVD-2026-48510
The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'backend-title' parameter in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible fo...
CVE-2026-9635
The WP Shortcode by MyThemeShop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter of the tab shortcode in versions up to, and including, 1.4.17. This is due to insufficient input sanitization and output escaping in the mtstabs function, which outputs the...
Plone 5.2.3 XSS
The version of Plone installed on the remote host is 5.2.3. It is, therefore, affected by a stored cross-site scripting XSS vulnerability within the site-controlpanel due to improper validation of user-supplied input before returning it to users. An authenticated, remote attacker can exploit this...
CVE-2026-12536
The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Module Title’ parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-12536
The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Module Title’ parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-11328
The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title parameter in all versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-25557 Evoluted PHP Directory Listing Script 4.0.5 Reflected XSS via dir parameter
Evoluted PHP Directory Listing Script through 4.0.5 contains a reflected cross-site scripting vulnerability in index.php where the dir parameter value is reflected without HTML encoding inside the HTML title element and inside anchor href attributes in the breadcrumb navigation. Attackers can...
CodeAstro Human Resource Management System 跨站脚本漏洞
The CodeAstro Human Resource Management System is a human resource management system developed by CodeAstro Corporation. Version 1.0 of the CodeAstro Human Resource Management System has a cross-site scripting vulnerability. This vulnerability stems from incorrect handling of the Notice Title...
PT-2026-47189
Name of the Vulnerable Software and Affected Versions NousResearch hermes-agent versions prior to 0.12.1 Description An authorization bypass exists in the resume endpoint. The issue occurs within the resolve session by title function located in the hermes state.py file. A remote attacker can...
CVE-2026-5028
The Eight Day Week Print Workflow plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'title' parameter in the pp-get-articles AJAX action in all versions up to, and including, 1.2.6. This is due to insufficient escaping on the user supplied parameter and lack of sufficie...
Cross-site Scripting (XSS)
Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Cross-site Scripting XSS via the pagetitle parameter in the WebSocket connection URL, which is broadcast to all connected clients without proper validation or...
CVE-2019-25744 WordPress Popup Builder 3.49 Persistent Cross-Site Scripting
WordPress Popup Builder 3.49 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by breaking out of option tags in the posttitle parameter. Attackers can submit crafted POST requests to the post.php endpoint with script payloads...
CVE-2019-25744
The CVE-2019-25744 entry concerns WordPress Popup Builder 3.49, which is vulnerable to a persistent cross-site scripting (XSS) flaw. The affected component is the post_title parameter, where an attacker can break out of option tags and craft POST requests to the post.php endpoint with a script pa...
CVE-2019-25744
WordPress Popup Builder 3.49 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by breaking out of option tags in the posttitle parameter. Attackers can submit crafted POST requests to the post.php endpoint with script payloads...
WordPress plugin Popup Builder 跨站脚本漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...