923 matches found
CVE-2026-15785
The Joinchat – Enhanced "click to chat" plugin for WordPress (versions up to and including 6.3.1 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping specifically involving the {HREF} Dynamic Variable via a Query Parameter...
CVE-2025-15711
The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its module settings before outputting them in an href attribute, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capabili...
CVE-2025-15711 Live Composer < 2.1.24 - Admin+ Stored XSS via Social
The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its module settings before outputting them in an href attribute, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capabili...
CVE-2025-15711
The Live Composer WordPress plugin (versions prior to 2.1.24 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain module settings before they are rendered within an href attribute. This vulnerability allows high-privilege use...
EUVD-2025-211306
The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its module settings before outputting them in an href attribute, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capabili...
Mailcow < 2026-03b - Href Link Injection
mailcow 2026-03b reflects raw REQUESTURI into JavaScript and href links on the login page, allowing attackers to inject parameters that break JS logic and enable phishing. id: CVE-2026-40878 info: name: Mailcow 2026-03b - Href Link Injection author: ritikchaddha severity: low description: | mailc...
VulnCheck KEV: CVE-2026-119155
The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'hreflocale' parameter in all versions up to, and including, 3.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...
CVE-2026-124494
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean sanitizer's normalizeURL function decodes named entities like to an empty string. Attackers can inject href values such as javascript that pass the isSafeURL check but are decoded by browsers,...
CVE-2022-44666
Microsoft Windows Contacts VCF/Contact/LDAP syslink control href attribute escape vulnerability CVE-2022-44666 0day. This is the story about another forgotten 0day fully disclosed more than 4 years ago by John Page aka hyp3rlinxR.1. To understand the report, you have to consider i'm stupid :- And...
CVE-2026-119155
The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'hreflocale' parameter in all versions up to, and including, 3.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...
CVE-2026-119155 wpForo Forum <= 3.2.2 - Unauthenticated SQL Injection via 'href[locale]' Parameter
The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'hreflocale' parameter in all versions up to, and including, 3.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...
CVE-2026-119155
The wpForo Forum plugin for WordPress (versions up to and including 3.2.2 ) is vulnerable to a time-based SQL Injection . The root cause is insufficient escaping and a lack of sufficient preparation on the 'href[locale]' parameter in existing SQL queries. This flaw allows unauthenticated attacker...
EUVD-2026-119033
The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'hreflocale' parameter in all versions up to, and including, 3.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...
CVE-2026-119155 wpForo Forum <= 3.2.2 - Unauthenticated SQL Injection via 'href[locale]' Parameter
The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'hreflocale' parameter in all versions up to, and including, 3.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...
CVE-2022-46364
CVE-2022-46364 — Apache CXF MTOM/XOP SSRF File Read Proof-of-Concept exploit for CVE-2022-46364 — an Apache CXF server-side request forgery SSRF vulnerability in MTOM/XOP request processing. Vulnerability Summary CVE-2022-46364 affects Apache CXF versions before 3.4.10 and 3.5.5. When MTOM Messag...
PT-2026-139233
Name of the Vulnerable Software and Affected Versions wpForo Forum versions prior to 3.2.3 Description An unauthenticated time-based SQL Injection exists due to insufficient escaping of user-supplied input and lack of proper preparation of the SQL query. This allows attackers to append additional...
CVE-2026-119155: tomdever wpForo Forum: The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'href[locale]' parameter in all…
The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'hreflocale' parameter in all versions up to, and including, 3.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...
CVE-2022-46364-Poc
CVE-2022-46364 Exploit Apache CXF SSRF via MTOM XOP:Include | CVSS 9.8 CRITICAL Vulnerability Apache CXF -s -d -t, --target - Vulnerable CXF SOAP endpoint required -s, --ssrf-url - Internal URL to exfiltrate required -d, --domain - Target domain default: localhost --plain-soap - Use plain SOAP...
CVE-2025-58179-Check
CVE-2025-58179-Check CVE-2025-58179-Check is a simple Python script to verify SSRF Server-Side Request Forgery / Content Spoofing vulnerability on the /image endpoint in the Astro framework. This vulnerability is tracked as GHSA-qpr4-c339-7vq8 and CVE-2025-58179. Vulnerability Background This...
CVE-2024-25293
MJML Local Code Execution PoC A Proof-Of-Concept for CVE-2024-25293 vulnerability. mjml-app v3.0.4 & 3.1.0-beta was discovered to contain a remote code execution RCE In this repository there is an example vulnerable application and proof-of-concept POC exploit of it. As a PoC there is a python fi...