478 matches found
CVE-2019-7219
CVE-2019-7219 CVE-2019-7219 Zarafa Webapp Author: verifysecurity At least Webapp version 1.6-46049 till 2.0.1.47791 are affected. hxxps://127.0.0.1/webapp/?fccc0"5f43d=1...
EUVD-2026-60592
Grav: detectXss misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS...
EUVD-2026-80191
The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting...
CVE-2026-91991
Tornado before 6.5.8 contains an incomplete fix for cookie attribute i...
CVE-2026-55692
The EmbedVideo Extension is a MediaWiki extension which adds a parser function called ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with the default $wgEmbedVideoRequireConsent configuration enabled,...
CVE-2026-91991
A flaw was found in Tornado. An attacker can bypass security validation in the setcookie function by using capitalized or legacy keyword arguments. This allows the attacker to inject arbitrary cookie attributes, such as Domain or SameSite, and modify cookie security settings. The consequence is t...
EUVD-2026-78829
The EmbedVideo Extension is a MediaWiki extension which adds a parser function called ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with the default $wgEmbedVideoRequireConsent configuration enabled,...
CVE-2026-91991
Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to setcookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or...
CVE-2026-91991
Tornado (Python web framework) versions before 6.5.8 contain an incomplete fix for cookie attribute injection in the set_cookie function. An attacker can pass capitalized or legacy keyword arguments (e.g., Domain, Path, SameSite) to embed semicolon-delimited data, bypassing validation and modifyi...
CVE-2026-91991 Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs
Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to setcookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or...
EUVD-2026-78663
Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to setcookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or...
CVE-2026-91991 Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs
Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to setcookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or...
Linux Distros Unpatched Vulnerability : CVE-2026-91991
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalize...
CVE-2026-6642
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechanism in versions up to and including 3.35. This is due to insufficient output escaping on preset field values when they are rendered in HTML attribute contexts...
CVE-2026-6642
The Media Library Assistant WordPress plugin (versions up to and including 3.35 ) is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechanism. The root cause is insufficient output escaping in the mla_generate_bulk_edit_form_fieldsets() function and the mla-bulk-...
CVE-2026-6642 Media Library Assistant <= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechanism in versions up to and including 3.35. This is due to insufficient output escaping on preset field values when they are rendered in HTML attribute contexts...
EUVD-2026-76008
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechanism in versions up to and including 3.35. This is due to insufficient output escaping on preset field values when they are rendered in HTML attribute contexts...
Linux Distros Unpatched Vulnerability : CVE-2026-88038
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name a...
CVE-2026-88038 cookies vulnerable to Set-Cookie attribute injection via unvalidated domain and path options
cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...
EUVD-2026-75398
cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...