Rukovoditel <= 3.2.1 - Cross Site Scripting

A stored cross-site scripting XSS vulnerability in the Global Lists feature /index.php?module=globallists/lists of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking "Add". id:...

BIBLIOsoft BIBLIOpac 2008 - Cross-Site Scripting

BIBLIOsoft BIBLIOpac 2008 contains a cross-site scripting vulnerability via the db or action parameter to bin/wxis.exe/bibliopac/, which allows a remote attacker to inject arbitrary web script or HTML. id: CVE-2018-16139 info: name: BIBLIOsoft BIBLIOpac 2008 - Cross-Site Scripting author:...

Xinuo Openserver 5/6 - Cross-Site scripting

Xinuo formerly SCO Openserver versions 5 and 6 allows remote attackers to inject arbitrary web script or HTML tag via the parameter 'section' and is vulnerable to reflected cross-site scripting. id: CVE-2020-25495 info: name: Xinuo Openserver 5/6 - Cross-Site scripting author: 0xAkoko severity:...

CVE-2026-113387

The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts...

CVE-2026-113387

The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts...

EUVD-2026-112569

The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts...

CVE-2026-113387

The Ortto plugin for WordPress (versions prior to 1.0.25 ) is vulnerable to an authentication bypass. The plugin fails to properly authenticate configuration update requests, relying instead on a secret that is exposed in public HTML. An unauthenticated threat actor can exploit this flaw to overw...

CVE-2026-113387

The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts...

PT-2026-132179

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force SureDash suredash allows Stored XSS.This issue affects SureDash: from n/a through 1.12.3...

CVE-2026-113387: canva ortto: The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a…

The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts...

Canva ortto authorization issue vulnerability

Versions of Canva Ortto prior to 1.0.25 contain an authorization issue vulnerability. This vulnerability arises from the lack of authentication for configuration update requests; it relies solely on a key exposed in public HTML, potentially allowing unauthenticated attackers to override plugin...

PT-2026-130565

The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts...

CVE-2026-112066

The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website...

EUVD-2026-104873

The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website...

CVE-2026-112066 Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)

The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website...

CVE-2026-112066

The sgalinski Cookie Consent (sg_cookie_optin) extension is vulnerable to a Missing Authorization flaw during the JSON import of cookie consent configurations. Specifically, the import process fails to validate the backend user's permissions, allowing non-admin backend users with module access to...

CVE-2026-112066 Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)

The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website...

CVE-2026-112066

The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website...

PT-2026-118303

The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website...

TYPO3 sgalinski Cookie Consent Authorization Vulnerability

In versions of TYPO3 from 8.0.0 to 8.1.12, as well as 7.4.6, there is a vulnerability related to authorization. This vulnerability arises from not adhering to backend user permissions when importing JSON configurations for Cookie Consent. Backend users who have module access rights can import...