GHSA-C7HR-448W-65PX MeshCentral has unsanitized data fields

Description A rogue or compromised MeshAgent can inject arbitrary HTML/JavaScript via the osdesc OS description field in its coreinfo message. The server stores this value with zero HTML sanitization meshagent.js:1903 only checks typeof == 'string'. When an admin views the device details panel, t...

PT-2026-77299

Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content from Text::wordwrap without HTML escaping, and...

BIT-GHOST-2026-70596 Ghost: Cross-Site Scripting in Feature Image Captions

Ghost is a Node.js content management system. From 4.9.0 until 6.54.1, an input validation issue allowed any staff user to create a post with content in featureimagecaption that could be used to hijack another staff user's Ghost Admin session, resulting in privilege escalation. This issue is fixe...

CVE-2026-15009

The Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'soundFile' parameter in all versions up to, and including, 5.4.12 due to insufficient input sanitization and output escaping. Th...

EUVD-2026-59865

The Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'soundFile' parameter in all versions up to, and including, 5.4.12 due to insufficient input sanitization and output escaping. Th...

CVE-2026-15009

The Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'soundFile' parameter in all versions up to, and including, 5.4.12 due to insufficient input sanitization and output escaping. Th...

CVE-2026-15009 Advanced File Manager <= 5.4.12 - Reflected Cross-Site Scripting via postMessage 'soundFile' Parameter

The Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'soundFile' parameter in all versions up to, and including, 5.4.12 due to insufficient input sanitization and output escaping. Th...

PT-2026-73088

Name of the Vulnerable Software and Affected Versions Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution versions prior to 5.4.13 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows...

PT-2026-71965

The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including...

PT-2026-71732

Name of the Vulnerable Software and Affected Versions phpList versions prior to 3.7.0-RC5 Description Cross-Site Request Forgery CSRF occurs because the application fails to enforce token validation on the bounce rule deletion endpoints 'bouncerules.php' and 'bouncerule.php'. The deletion process...

CVE-2026-73329

CamaleonCMS contains a stored cross-site scripting vulnerability that allows authenticated low-privileged users to execute arbitrary JavaScript in an administrator's browser by injecting unsanitized HTML payloads into the post title parameter during draft creation. Attackers can submit a maliciou...

CVE-2026-73329 CamaleonCMS Stored XSS via Draft Post Title Creation Endpoint

CamaleonCMS contains a stored cross-site scripting vulnerability that allows authenticated low-privileged users to execute arbitrary JavaScript in an administrator's browser by injecting unsanitized HTML payloads into the post title parameter during draft creation. Attackers can submit a maliciou...

CVE-2026-73329 CamaleonCMS Stored XSS via Draft Post Title Creation Endpoint

CamaleonCMS contains a stored cross-site scripting vulnerability that allows authenticated low-privileged users to execute arbitrary JavaScript in an administrator's browser by injecting unsanitized HTML payloads into the post title parameter during draft creation. Attackers can submit a maliciou...

CVE-2026-73329

CamaleonCMS contains a stored cross-site scripting vulnerability that allows authenticated low-privileged users to execute arbitrary JavaScript in an administrator's browser by injecting unsanitized HTML payloads into the post title parameter during draft creation. Attackers can submit a maliciou...

EUVD-2026-57428

CamaleonCMS contains a stored cross-site scripting vulnerability that allows authenticated low-privileged users to execute arbitrary JavaScript in an administrator's browser by injecting unsanitized HTML payloads into the post title parameter during draft creation. Attackers can submit a maliciou...

CVE-2026-73329

CVE-2026-73329 affects CamaleonCMS. It is a stored XSS vulnerability where authenticated low-privilege users can inject unsanitized HTML into the draft post title via the drafts creation endpoint. The payload is persisted to the database and later rendered as raw HTML in the admin drafts listing,...

CVE-2026-73329 CamaleonCMS Stored XSS via Draft Post Title Creation Endpoint

CamaleonCMS contains a stored cross-site scripting vulnerability that allows authenticated low-privileged users to execute arbitrary JavaScript in an administrator's browser by injecting unsanitized HTML payloads into the post title parameter during draft creation. Attackers can submit a maliciou...

CVE-2026-47228

Admidio is an open-source user management solution. modules/registration.php mode sendlogin regenerates a random password for useruuidassigned, stores its bcrypt hash in admusers.usrpassword, and emails the cleartext to that user. Every other state-changing mode in the same file assignmember,...

CVE-2026-47232 Admidio PKCS#12 private key export action lacks CSRF protection

Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive mode=export action in modules/sso/keys.php exports a PKCS12 bundle containing the configured private key and certificate, but the CSRF validation line is commented out. A forged cross-site POST from an...

CVE-2026-70560

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...