CVE-2026-34568: Improper Neutralization of Input During Web Page Generation

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when creating or editing blog posts. An attacker can inject a...

Cross-site Scripting (XSS)

Overview baserproject/basercms is a Content management system based on CakePHP. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the blog post rendering process. An attacker can execute arbitrary scripts in the context of a user's browser by injecting malicious...

SQL Injection

Overview baserproject/basercms is a Content management system based on CakePHP. Affected versions of this package are vulnerable to SQL Injection via the blog post process. An attacker can execute arbitrary SQL commands by supplying crafted input to the affected component. Remediation Upgrade...

CVE-2025-36258

creationtimestamp| type| source ---|---|--- 2026-03-27 02:00:15+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhyzidod3h2f...

CVE-2026-33914

creationtimestamp| type| source ---|---|--- 2026-03-27 01:00:13+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhyw4ztj3i2v...

CVE-2026-29099

creationtimestamp| type| source ---|---|--- 2026-03-24 16:00:15+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhswzmyxwk2v...

CVE-2026-3736

creationtimestamp| type| source ---|---|--- 2026-03-23 10:00:14+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhpsgy2ttp2h...

CVE-2026-32627

creationtimestamp| type| source ---|---|--- 2026-03-22 04:00:14+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhmnucgmlh2q...

CVE-2026-4180

creationtimestamp| type| source ---|---|--- 2026-03-20 03:20:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhhkos5gem2w...

CVE-2026-31989

creationtimestamp| type| source ---|---|--- 2026-03-20 03:00:13+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhhjl5xpci23...

CVE-2015-20120

creationtimestamp| type| source ---|---|--- 2026-03-19 17:35:45+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhgjzsgoh42e 2026-08-20 01:38:04+00:00| seen| https://bsky.app/profile/secqube.com/post/3mti4d4o5qm2z...

CVE-2026-31870

creationtimestamp| type| source ---|---|--- 2026-03-18 17:00:14+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhdxlet7hw2x 2026-03-20 11:11:34+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mhieznfew22h...

CVE-2026-22182

creationtimestamp| type| source ---|---|--- 2026-03-18 06:20:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhctssbx4f2m 2026-07-09 03:00:05+00:00| seen| https://t.me/brutsecurity/2511 2026-07-10 00:00:13+00:00| seen| https://t.me/brutsecurity/2511 2026-07-11 11:00:05+00:00|...

CVE-2026-24292

creationtimestamp| type| source ---|---|--- 2026-03-10 16:57:37+00:00| seen| https://www.thezdi.com/blog/2026/3/10/the-march-2026-security-update-review 2026-03-10 19:07:55+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0080 2026-03-11 03:00:16+00:00| seen|...

CVE-2025-66024

The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Versions prior to 9.15.7 are vulnerable to Stored Cross-Site Scripting XSS via the Blog Post Title. The vulnerability arises because the post title is injected directly into the HTML tag without proper...

CVE-2025-66024

The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Versions starting with 9.15 and prior to 9.15.7 are vulnerable to Stored Cross-Site Scripting XSS via the Blog Post Title. The vulnerability arises because the post title is injected directly into the...

CVE-2025-66024

The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Versions prior to 9.15.7 are vulnerable to Stored Cross-Site Scripting XSS via the Blog Post Title. The vulnerability arises because the post title is injected directly into the HTML tag without proper...

CVE-2025-66024 XWiki Blog Application home page vulnerable to Stored XSS via Post Title

The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Versions starting with 9.15 and prior to 9.15.7 are vulnerable to Stored Cross-Site Scripting XSS via the Blog Post Title. The vulnerability arises because the post title is injected directly into the...

CVE-2025-66024

CVE-2025-66024 affects the XWiki Blog Application UI (org.xwiki.contrib.blog:application-blog-ui) and involves a Stored XSS in the Blog Post Title. The vulnerability arises because the post title is injected directly into the HTML tag without proper escaping in versions prior to 9.15.7. An attac...

GHSA-H2XQ-H7F9-VH6C XWiki Blog Application home page vulnerable to Stored XSS via Post Title

Impact The Blog Application is vulnerable to Stored Cross-Site Scripting XSS via the Blog Post Title. The vulnerability arises because the post title is injected directly into the HTML tag without proper escaping. An attacker with permissions to create or edit blog posts can inject malicious...