CVE-2026-97652 WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Query-Parameter Key in all versions up to, and including, 14.16.14 due to insufficient input sanitization and output escaping. This makes i...

EUVD-2026-91337

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Query-Parameter Key in all versions up to, and including, 14.16.14 due to insufficient input sanitization and output escaping. This makes i...

CVE-2026-59669

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “name” parameter is affected – endpoint “/es/attachmenttypes/update/203336”...

EUVD-2026-91330

Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94635

A vulnerability exists in the Apache Thrift Lua bindings (versions before 0.25.0 ) caused by the improper handling of length parameter inconsistencies . Specifically, the TBinaryProtocol:readMessageBegin function may bypass checkStringSize on the pre-versioned name, allowing a remote attacker to ...

CVE-2026-59669

The Repasat application is vulnerable to a Cross-Site Scripting (XSS) flaw (CWE-79). The issue exists in the "name" parameter of the endpoint “/es/attachmenttypes/update/203336” . Successful exploitation could allow an attacker to trick a user into executing arbitrary code within their browser. N...

CVE-2026-59669 Multiple vulnerabilities in the Repasat application

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “name” parameter is affected – endpoint “/es/attachmenttypes/update/203336”...

EUVD-2026-91319

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “name” parameter is affected – endpoint “/es/attachmenttypes/update/203336”...

CVE-2026-100107

The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2019-17671

＃CVE-2019-17671 ＃url + /？static = 1＆order = asc...

CVE-2022-35499

In Trimble TM4WEB =22.2.0 the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended to the URL. Step 1 : The following example URL will trigger the vulnerability and execute the javascript alert function displaying the number...

CVE-2018-16763

CVE-2018-16763 Analyzer CVE-2018-16763 Analyzer is a small Python project for analyzing CVE-2018-16763 against FUEL CMS targets. It focuses on checking whether a target appears vulnerable and on displaying command output in a cleaner, more readable way when the application response is noisy. This...

EUVD-2026-91252

The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2026-100107 Kubio AI Page Builder <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass)

The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2026-100107

The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.9.2 . The root cause is insufficient input sanitization and output escaping associated with the 'comment' parameter , specifically involving an SVG Comment Conte...

EUVD-2026-91251

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'datatype' parameter in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

CVE-2026-103426 Relevanssi Premium <= 2.31.4 - Unauthenticated Stored Cross-Site Scripting via '_rt' Parameter

The Relevanssi Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rt' parameter in all versions up to, and including, 2.31.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-103426 Relevanssi Premium <= 2.31.4 - Unauthenticated Stored Cross-Site Scripting via '_rt' Parameter

The Relevanssi Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rt' parameter in all versions up to, and including, 2.31.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-96566

The Newsletter – Send awesome emails from WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 9.4.0 . The root cause is insufficient input sanitization and output escaping within the 'np1' Custom Field Parameter . Unauthenticated attackers can i...

Apache-OFBiz-Directory-Traversal-exploit

Apache-OFBiz-Directory-Traversal-exploit A vulnerability classified as critical, has been found in Apache OFBiz up to 18.12.12. Affected by this issue is an unknown functionality. The manipulation with an unknown input leads to a path traversal vulnerability. The product uses external input to...