17429 matches found
DeepAI.org CSRF
RISK EVALUATION The DeepAI.org endpoint https://api.deepai.org/changeuseremail accepts POST requests without any CSRF protection. If a logged-in user is tricked into visiting a malicious HTML page, an attacker can change the user's email address to their own and take over the account via...
CVE-2026-8474
A vulnerability was discovered on Stormshield Network Security 4.3.0 to 4.3.41, 4.8.0 to 4.8.15, 5.0.0 to 5.0.5 It is possible to execute a reflected XSS attack on the login API available on Stormshield SNS appliance by executing a script on the victim's machine. The risks include the theft of...
CVE-2026-48208
An improper neutralization of active SVG content in OTRS or OTRS Community Edition ticket article rendering allows attackers to inject specially crafted SVG payloads via email content, leading to browser-side resource exhaustion and denial of service when affected tickets are opened by an agent o...
CVE-2026-47694
WWBN AVideo (affecting 29.0 and earlier) is vulnerable to a stored XSS via category_description in the Gallery view. The vulnerability arises because category descriptions submitted by users are rendered as raw HTML, allowing JavaScript execution when any user views the affected Gallery/category ...
CVE-2026-10010
An inappropriate implementation in the Input component of Google Chrome on Android (prior to version 148.0.7778.216) allows a remote attacker to bypass site isolation using a crafted HTML page. This vulnerability is exploitable by an attacker who has already compromised the renderer process. Whil...
Cross-site Scripting (XSS)
Overview tinymce is a web-based JavaScript HTML WYSIWYG editor control. Affected versions of this package are vulnerable to Cross-site Scripting XSS via improper handling of SVG namespace scope by the sanitizer. An attacker can execute arbitrary JavaScript by crafting a payload with nested SVG...
Web-Based-Honeypot-for-Intrusion-Detection
Web-Based-Honeypot-for-Intrusion-Detection A Web-Based Honeypo...
[SECURITY] Fedora 44 Update: nginx-mod-modsecurity-1.0.4-11.fc44
The ModSecurity-nginx connector is the connection point between nginx and libmodsecurity ModSecurity v3. Said another way, this project provides a communication channel between nginx and libmodsecurity. This connector is required to use LibModSecurity with nginx. The ModSecurity-nginx connector...
Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
...
Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
...
CVE-2026-8143 Booking Calendar – Event Calendar <= 2.1.6 - Unauthenticated Stored Cross-Site Scripting via Multiple Parameters
The HBook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hbcountryiso', 'hbusastateiso', and 'hbcanadaprovinceiso' parameters in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-8887
The Listen Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'listen' shortcode in versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user supplied attributes src, start, end in the listenEmbedJS function,...
CVE-2026-48999
Attackers carefully craft malicious scripts, such as JavaScript, and inject them into target systems; when other users access pages containing such malicious content, the scripts are automatically loaded and executed in the victim's browser.Attackers can thereby steal user cookies, hijack session...
The vulnerability of the software for implementing the hypertext environment MediaWiki, related to the lack of measures taken to protect the structure of web pages, allows a violator to execute arbitrary code.
The vulnerability of the software for implementing the hypertext environment MediaWiki is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability may allow a malicious actor, operating remotely, to execute arbitrary code...
EUVD-2026-31882
Lack of output escaping leads to a XSS vector in the multilingual associations component...
The vulnerability of the Go programming language, related to the lack of measures taken to protect web page structures, allows attackers to execute arbitrary code.
The vulnerability of the Go programming language is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
sql-injection
sql-injection python tool that...
CVE-2018-25350 userSpice 4.3.24 Username Enumeration via existingUsernameCheck.php
userSpice 4.3.24 contains a username enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by sending POST requests to the existingUsernameCheck.php endpoint. Attackers can submit usernames and analyze response text for the 'taken' string to identify existing...