116703 matches found
CVE-2026-83545
The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed...
WordPress Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button plugin <= 3.5.9 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by uhcna - vietnam in WordPress Plugin Chaty versions = 3.5.9...
EUVD-2026-75967
The AI Builder WordPress plugin before 2.7.8 does not sanitise custom JavaScript saved against a post before echoing it inside a script tag on the front end, allowing users with contributor level access and above to store arbitrary JavaScript that will execute in the browser of anyone who views t...
CVE-2026-83545 CoolClock < 4.3.8 - Contributor+ Stored XSS via Custom Skin JSON
The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed...
CVE-2026-83545 CoolClock < 4.3.8 - Contributor+ Stored XSS via Custom Skin JSON
The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed...
EUVD-2026-75956
The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed...
BIT-TOMCAT-2026-50229 Apache Tomcat: XSS in number guess example
Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0 through 11.0.22, from 10.1.0 through 10.1.55, from 9.0.0 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0...
EUVD-2026-75930
The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Chat Message in all versions up to, and including, = 20260811 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...
PT-2026-89784
The AI Builder WordPress plugin before 2.7.8 does not sanitise custom JavaScript saved against a post before echoing it inside a script tag on the front end, allowing users with contributor level access and above to store arbitrary JavaScript that will execute in the browser of anyone who views t...
CVE-2026-90443: Improper Neutralization of Input During Web Page Generation
A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does not require authentication to reach. This allows an unauthenticated network attacker to craft a link that, when visited by a user, executes arbitrary script in...
PT-2026-89781
The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed...
PT-2026-90511
Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding. This issue does not require...
PT-2026-89859
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names are not encoded before being concatenated into public watch-page HTML. A video owner can inject malicious scripts via the bookmark name...
CVE-2026-83545: Improper Neutralization of Input During Web Page Generation
The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed...
OMG_KILLER
OMGKILLER Автоатакующий скрипт на базе эксплойтов CVE-2024-37890 и OOM 2026 Пока лайтовый вариант щас расширим проксями и прочим дерьмом что бы атаковать с одной тачки как огромная ботферма...
CVE-2024-31666
Vulnerability Overview A vulnerability exists in Flusity-CMS v.2.33 that allows a remote attacker to execute arbitrary code via a crafted script in the editaddonpost.php component. Affected Versions Flusity-CMS v.2.33 Vulnerability Details An attacker can exploit this vulnerability by sending a...
MAL-2026-16125 Malicious code in lucy-python-script-2030 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2195ea343abdb1205451fc7c778bdd1580cf985461949081852e9e82363ac389 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...
Malicious code in lucy-python-script-2030 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2195ea343abdb1205451fc7c778bdd1580cf985461949081852e9e82363ac389 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...
