CVE-2015-9357-POC

CVE-2015-9357 WordPress 表情解析器存储型跨站脚本，通过伪造 nonce 请求创建管理员用户。 通过表情符号正则表达式突破 属性上下文，将 JavaScript 注入 onerror 处理程序。无需 script 标签，可绕过受影响字段上的 wpkses 过滤。 攻击链：将载荷提交到任何会进行表情转换的字段，管理员查看后，XSS 在其会话中触发，从 user-new.php 拉取创建用户的 nonce，提交新的管理员账户，通过登录确认。 仅限实验室/教育用途。要求目标字段实际应用 WordPress 表情转换，因主题/插件而异。...

CVE-2026-39200

CVE-2026-39200 — Toko Online RotI 中的反射型跨站脚本（XSS） 概述 在 Toko Online RotI Web 应用程序的 produk 请求参数中发现了反射型跨站脚本（XSS）漏洞。该应用程序在将用户提供的输入反射到用双引号封装的 HTML 标签属性中之前，未对其进行 HTML 编码。攻击者可构造恶意 URL，当受害者访问该 URL 时，会在受害者浏览器会话的上下文中执行任意 JavaScript。 字段| 值 ---|--- CVE ID| CVE-2026-39200 漏洞类型| CWE-79 — 网页生成期间输入未正确中和（反射型 XSS）...

CVE-2026-91122

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting...

CVE-2026-91122 Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting...

EUVD-2026-86302

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting...

CVE-2026-91122 Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting...

CVE-2026-91122 Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting...

CVE-2026-91122

The Discourse open-source discussion platform contains a vulnerability in the video placeholder component prior to versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0. The root cause is an attribute breakout triggered by crafted HTML, allowing an attacker to inject a controlled event handler . An...

PT-2026-98159

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.8 Discourse versions prior to 2026.6.3 Discourse versions prior to 2026.7.2 Discourse versions prior to 2026.8.0 Description The video placeholder component allows crafted HTML to cause an attribute breakout...

CVE-2026-91122: Improper Neutralization of Input During Web Page Generation

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting...

CVE-2026-81903

Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard without validating it against the set of known container icons. The unvalidated value was later concatenated into the src attribute of an img tag by a helper that did not encode attribute...

PT-2026-91565

Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard without validating it against the set of known container icons. The unvalidated value was later concatenated into the src attribute of an img tag by a helper that did not encode attribute...

CVE-2026-89241 WWBN AVideo Reflected XSS via confirmLivePassword.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in confirmLivePassword.php that copies REQUESTURI into a form action attribute without encoding. Attackers can craft a malicious URL with a quote character to break out of t...

CVE-2026-52774

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using striptags only. Because striptags does not escape double quotes, an attacker can break out of the attribute value, inject an event handler such ...

CVE-2026-3852 Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the skypeurl shortcode attribute of the Social Media Follow module in all versions up to, and including, 4.27.6. This is due to a three-part sanitization failure: 1 the skypeurl field is not included in the $urloptions...

CVE-2026-3852: Improper Neutralization of Input During Web Page Generation

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the skypeurl shortcode attribute of the Social Media Follow module in all versions up to, and including, 4.27.6. This is due to a three-part sanitization failure: 1 the skypeurl field is not included in the $urloptions...

Bludit CMS 3.20.0 Cross Site Scripting

Bludit CMS version 3.20.0 suffers from a cross site scripting vulnerability in the search plugin. Exploit Title: Bludit CMS 3.20.0 - Reflected Cross-Site Scripting Date: 2026-08-11 Exploit Author: Ranjit Kumar Singh Vendor Homepage: https://www.bludit.com/ Software Link:...

CVE-2026-76984 Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.head.MetaDataHeaderItem generates and header tags. It escaped the attribute names it wrote, but ran the attribute values through a replacement of " with ". A backslash before a double quote mean...

CVE-2026-75019

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE WordPress plugin is vulnerable to Stored XSS via the cozyHoverEffect Block Attribute in all versions up to and including 2.2.16 . The root cause is insufficient input sanitization and output escaping : an authenticated attacker with contri...

CVE-2026-76837

Baserow before 2.3.0 is vulnerable to stored cross-site scripting via the rich-text mention feature. The display name set through PATCH /api/user/account/ is interpolated without HTML encoding into the mention element built in mention.js. A name containing a double quote breaks out of the data-la...