CVE-2026-11887

The CVE concerns the Salon Booking System WordPress plugin prior to 10.30.20. Affected component: an AJAX action without proper authorization checks, enabling any authenticated user (e.g., a subscriber) to modify the plugin’s settings and bypass manual approval of new bookings. Root cause: insuff...

CVE-2025-11887

creationtimestamp| type| source ---|---|--- 2025-10-24 09:28:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m3wkqa6xls2e...

CVE-2025-11887 Supervisor <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update

The Supervisor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX functions in all versions up to, and including, 1.3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update...

CVE-2024-11887

The Geo Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'geotargetlygeocontent' shortcode in all versions up to, and including, 6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11887 Geo Content <= 6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Geo Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'geotargetlygeocontent' shortcode in all versions up to, and including, 6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

@0x6368656174/wp-builder (>=1.0.8, <=1.2.1), @beezyinc/dr-svg-sprites-bz (>=0.9.33, <=1.0.4) +145 more potentially affected by CVE-2020-11887 via svg2png (>=4.0.0, <=4.1.1)

svg2png NPM version =4.0.0, =1.0.8, =0.9.33, =0.9.33, =0.0.1, =0.0.1-alpha.44, =0.0.1-alpha.117, =0.0.4, =1.0.0, =2.1.0, =0.0.2, =0.0.10, =2.0.0, =0.0.0-semantically-released, =1.0.7, =1.0.8 and more Source cves: CVE-2020-11887 Source advisory: OSV:GHSA-MPP5-2X55-49XW...

CVE-2018-11887

This CVE entry is rejected/not used; it does not represent an active vulnerability entry.

CVE-2018-11887

...

CVE-2020-11887

svg2png 4.1.1 allows XSS with resultant SSRF via JavaScript inside an SVG document...

CVE-2020-11887

svg2png 4.1.1 contains a vulnerability that allows cross-site scripting (XSS) with resultant SSRF via JavaScript inside an SVG document. The issue is documented across multiple sources (NVD, Red Hat, Veracode, OSV, GHSA, CNVD, etc.). Affected component is the SVG rendering/processing in svg2png; ...

CVE-2019-11887

creationtimestamp| type| source ---|---|--- 2019-05-17 17:50:27+00:00| seen| https://t.me/cvemitreorg/60...

CVE-2019-11887

SimplyBook.me through 2019-05-11 does not properly restrict File Upload which could allow remote code execution...

CVE-2019-11887

CVE-2019-11887 affects SimplyBook.me up to 2019-05-11 and stems from insufficient restrictions on file uploads, enabling remote code execution. The entry is supported by NVD entries (CVE-2019-11887) and related records; CVSS v2 base score 7.5 (HIGH) and CVSS v3 base score 9.8 (CRITICAL) reflect n...

Information Leakage

microsoft.chakracore is vulnerable to information leakage. This happens because the finalName parameter in the ConstructName function of JavascriptObject.cpp can contain null characters in between, leaving part of it uninitialized. This CVE ID is unique from CVE-2017-11887 and CVE-2017-11906.This...

Information disclosure

ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016, and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 201...

Information disclosure

Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to obtain information to further compromise the user's system, due to h...

CVE-2017-11887

CVE-2017-11906 is described across multiple sources as an information disclosure vulnerability in Microsoft Internet Explorer caused by improper handling of memory objects in the scripting engine. Affected software includes Internet Explorer on Windows platforms listed in the CVE description (Win...

KB4053579: Windows 10 Version 1607 and Windows Server 2016 December 2017 Security Update

The remote Windows host is missing security update 4053579. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a wa...

Security Updates for Internet Explorer (December 2017)

The Internet Explorer installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could corru...

Windows 8.1 and Windows Server 2012 R2 December 2017 Security Updates

The remote Windows host is missing security update 4054522 or cumulative update 4054519. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft browsers. An attacke...