11191 matches found
CVE-2026-1187
The ZoomifyWP Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'filename' parameter of the 'zoomify' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
PT-2026-8071
The ZoomifyWP Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'filename' parameter of the 'zoomify' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
WordPress plugin ZoomifyWP: Cross-site scripting vulnerability
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...
CVE-2026-1187: Improper Neutralization of Input During Web Page Generation
The ZoomifyWP Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'filename' parameter of the 'zoomify' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
WordPress ZoomifyWP Free plugin <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'filename' Shortcode Attribute vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via 'filename' Shortcode Attribute vulnerability discovered by theviper17y in WordPress Plugin ZoomifyWP Free versions = 1.1...
CVE-2026-24895
FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP’s CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index for finding .php on a lowercased copy of the request path but applies that byte index to the...
OESA-2026-1382 exim security update
Exim is a message transfer agent MTA developed at the University of Cambridge for use on Unix systems connected to the Internet. It is freely available under the terms of the GNU General Public Licence. In style it is similar to Smail 3, but its facilities are more general. There is a great deal ...
CVE-2025-70314
webfsd 1.21 is vulnerable to a Buffer Overflow via a crafted request. This is due to the filename variable...
CVE-2025-70314
webfsd 1.21 is vulnerable to a Buffer Overflow via a crafted request. This is due to the filename variable...
CVE-2026-24895 FrankenPHP affected by Path Confusion via Unicode casing in CGI path splitting allows execution of arbitrary files
FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP’s CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index for finding .php on a lowercased copy of the request path but applies that byte index to the...
Incorrect Behavior Order: Validate Before Canonicalize
Overview Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize via the splitPos function. An attacker can cause unintended script execution by crafting a request path containing specific multi-byte Unicode characters, which manipulates the...
CVE-2025-70314
webfsd 1.21 is vulnerable to a Buffer Overflow via a crafted request. This is due to the filename variable...
CVE-2025-70314
webfsd 1.21 is vulnerable to a Buffer Overflow via a crafted request. This is due to the filename variable...
SUSE SLED15 / SLES15 / openSUSE 15 Security Update : gpg2 (SUSE-SU-2026:0434-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:0434-1 advisory. Security fixes: - CVE-2026-24882: Fixed stack-based buffer overflow in TPM2 PKDECRYPT for TPM-backed RSA...
CVE-2025-70314: Buffer Copy without Checking Size of Input
webfsd 1.21 is vulnerable to a Buffer Overflow via a crafted request. This is due to the filename variable...
Webfsd security vulnerabilities
Webfsd is a simple HTTP server developed by Farshid Ashouri. Version 1.21 of Webfsd contains a security vulnerability, which stems from a buffer overflow in the filename variable. This vulnerability could potentially trigger a denial-of-service attack through specially crafted requests...
CVE-2025-70314
webfsd 1.21 is vulnerable to a Buffer Overflow via a crafted request. This is due to the filename variable...
CVE-2025-70314
webfsd version 1.21 is vulnerable to a Buffer Overflow triggered by a crafted request. The root cause is linked to the handling of the filename variable during buffer copying without sufficient size checking. This vulnerability could potentially lead to a denial-of-service (DoS) attack. While spe...
