CVE-2026-16272: Use of Less Trusted Source

Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Exploitation of Trusted Identifiers. This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3...

PT-2026-88898

Name of the Vulnerable Software and Affected Versions PayTR Virtual Pos iFrame API WHMCS Module versions 9.0.0 through 9.0.2 Description The PayTR Virtual Pos iFrame API WHMCS Module contains a flaw involving the use of a less trusted source, which allows for the exploitation of trusted...

PT-2026-89172

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.8.11 through 0.11.0 Description An issue exists where the in-app port preview renders content in an iframe sandbox that simultaneously grants allow-scripts and allow-same-origin. Because the terminal proxy serves this...

CVE-2026-87995: Improper Neutralization of Input During Web Page Generation

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 until 0.11.1, src/lib/components/chat/FileNav/PortPreview.svelte rendered terminal port content in an iframe sandbox containing both allow-scripts and allow-same-origin. Because the terminal proxy...

EUVD-2026-72853

Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API v9x WHMCS Module allows Black Box Reverse Engineering. This issue affects PayTR Virtual Pos iFrame API v9x WHMCS Module: from v9.0.0 before v9.0.3...

CVE-2026-16037 Callback Authentication Bypass via Timing Attack in PayTR's PayTR Virtual Pos iFrame API WHMCS Module

Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Black Box Reverse Engineering. This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3...

CVE-2026-16037 Callback Authentication Bypass via Timing Attack in PayTR's PayTR Virtual Pos iFrame API WHMCS Module

Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Black Box Reverse Engineering. This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3...

EUVD-2026-72852

Improper validation of specified quantity in input vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API v9x WHMCS Module allows Input Data Manipulation. This issue affects PayTR Virtual Pos iFrame API v9x WHMCS Module: from v9.0.0 before v9.0.3...

CVE-2026-16025 Improper Payment Validation in PayTR's PayTR Virtual Pos iFrame API WHMCS Module

Improper validation of specified quantity in input vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Input Data Manipulation. This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3...

CVE-2026-16037: Observable Timing Discrepancy

Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Black Box Reverse Engineering. This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3...

CVE-2026-16025: Improper Validation of Specified Quantity in Input

Improper validation of specified quantity in input vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Input Data Manipulation. This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3...

PT-2026-87109

Name of the Vulnerable Software and Affected Versions PayTR Virtual Pos iFrame API WHMCS Module versions 9.0.0 through 9.0.2 Description An observable timing discrepancy exists in the PayTR Virtual Pos iFrame API WHMCS Module. This flaw allows for Black Box Reverse Engineering, a technique used t...

PT-2026-87108

Name of the Vulnerable Software and Affected Versions PayTR Virtual Pos iFrame API WHMCS Module versions 9.0.0 through 9.0.2 Description Improper validation of the specified quantity in the input allows for input data manipulation within the PayTR Virtual Pos iFrame API WHMCS Module...

BrowserBox v18.8.0

BrowserBox — Remote Browser Isolation A full remote browser. Clientless access. Native performance. Self-host on Windows, macOS or Linux, or create cloud browser sessions through the API. Start a 7-Day Paid Evaluation · Buy a Commercial License · Talk to Sales Website · Live Demo · Documentation ...

Malicious code in iframe-to-video (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9ddc607fb5b68fa9cd9a186110b72bea322a0a74ad96f6e8ba53105ed89e2388 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15986 Malicious code in iframe-to-video (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9ddc607fb5b68fa9cd9a186110b72bea322a0a74ad96f6e8ba53105ed89e2388 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview iframe-to-video is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-75134

SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scripting vulnerability that allows authenticated contributors to inject malicious JavaScript by exploiting an overly permissive KSES allowlist that explicitly permits the onload event handler on iframe elements. Attacker...

EUVD-2026-70263

SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scripting vulnerability that allows authenticated contributors to inject malicious JavaScript by exploiting an overly permissive KSES allowlist that explicitly permits the onload event handler on iframe elements. Attacker...

CVE-2026-75134 SEOWriting WordPress Plugin 1.12.5 Stored XSS via iframe onload

SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scripting vulnerability that allows authenticated contributors to inject malicious JavaScript by exploiting an overly permissive KSES allowlist that explicitly permits the onload event handler on iframe elements. Attacker...