Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the rendering of unescaped filenames from the filesystem in the backend sync page. An attacker can execute arbitrary JavaScript in the browser of backend users by placing specially crafted files with malicio...

WordPress Name Directory plugin <= 1.34.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by hhhai in WordPress Plugin Name Directory versions = 1.34.0...

CVE-2026-91797

Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments being able to be written to directories outside the expected secure area when the PDF is opened...

EUVD-2026-85125

Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments being able to be written to directories outside the expected secure area when the PDF is opened...

CVE-2026-91797

Foxit PDF Editor/Reader is vulnerable to a directory traversal flaw because it fails to validate the directory traversal path in the attachment file name. This vulnerability allows malicious attachments to be written to directories outside the expected secure area when a PDF is opened. No specifi...

CVE-2026-91797 Foxit PDF Editor/Reader Portfolio Directory Traversal Remote Code Execution Vulnerability

Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments being able to be written to directories outside the expected secure area when the PDF is opened...

CVE-2026-91797 Foxit PDF Editor/Reader Portfolio Directory Traversal Remote Code Execution Vulnerability

Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments being able to be written to directories outside the expected secure area when the PDF is opened...

CVE-2026-91801 Foxit PDF Editor/Reader RichMedia Annotation Directory Traversal Remote Code Execution Vulnerability

A path traversal vulnerability exists in Foxit PDF Editor/Reader's handling of embedded PDF resources. Insufficient validation of resource file paths may allow files to be written outside their intended locations, potentially enabling arbitrary code execution...

CVE-2026-91801 Foxit PDF Editor/Reader RichMedia Annotation Directory Traversal Remote Code Execution Vulnerability

A path traversal vulnerability exists in Foxit PDF Editor/Reader's handling of embedded PDF resources. Insufficient validation of resource file paths may allow files to be written outside their intended locations, potentially enabling arbitrary code execution...

CVE-2026-63445

A flaw was found in Perses, an open-source dashboard and visualization project. An authenticated attacker can exploit a vulnerability in list endpoints that use the file-system database. By manipulating the project query parameter with directory traversal characters, an attacker can read arbitrar...

Lack of vulnerability management in Check Point Security Management and Log Servers

Check Point has identified a vulnerability in Security Management and Log Servers. This vulnerability involves a pre-authentication directory-traversal vulnerability within the Check Point Management Web Service, which allows unauthorized attackers to execute scripts from any source. This...

CVE-2026-84098

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it, allowing authenticated attackers with Subscriber-level access and above to delete arbitrary listings, including ones belonging...

CVE-2026-84150

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites, allowing any authenticated user with...

CVE-2026-84026

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not restrict access to a REST endpoint that returns user records, allowing unauthenticated attackers to read registered users' private contact details...

CVE-2026-84046

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side, allowing users with the subscriber role and above to make the server issue requests to internal addresses...

CVE-2026-84027

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not check user capabilities when creating orders through its REST API, allowing users with the subscriber role and above to create paid order and payment records with arbitrary amounts and...

CVE-2026-77766

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not scope one of its REST collection endpoints to the requesting user, allowing users with a subscriber-level account to read every customer's order and payment records. Versions 8.8.1 to...

CVE-2026-84150 Directorist < 8.9.5 - Subscriber+ Cross-User Favorites Read and Write via REST Favorites Endpoint

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites, allowing any authenticated user with...

CVE-2026-84150

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin is vulnerable in versions before 8.9.5 . The application fails to verify if the target user of a REST route matches the authenticated caller when accessing or modifying saved favorites. This allows any auth...

CVE-2026-84027 Directorist 8.9.1 - 8.9.4 - Subscriber+ Paid Order and Payment Record Forgery via REST Orders Endpoint

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not check user capabilities when creating orders through its REST API, allowing users with the subscriber role and above to create paid order and payment records with arbitrary amounts and...