CVE-2026-19230

CVE-2026-19230 affects SourceCodester Photo Share Website 1.0, specifically the file /social/ajax.php?action=save_upload in the Comment Input Box component. The vulnerability is Cross-Site Scripting (XSS) caused by manipulation of the input argument content. Attackers may exploit this remotely, a...

CVE-2026-19230 SourceCodester Photo Share Website Comment Input Box ajax.php save_upload cross site scripting

A vulnerability was identified in SourceCodester Photo Share Website 1.0. This affects an unknown part of the file /social/ajax.php?action=saveupload of the component Comment Input Box. The manipulation of the argument content leads to cross site scripting. The attack may be initiated remotely. T...

PT-2026-69097

A vulnerability was identified in SourceCodester Photo Share Website 1.0. This affects an unknown part of the file /social/ajax.php?action=save upload of the component Comment Input Box. The manipulation of the argument content leads to cross site scripting. The attack may be initiated remotely...

CVE-2026-19230: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in SourceCodester Photo Share Website 1.0. This affects an unknown part of the file /social/ajax.php?action=saveupload of the component Comment Input Box. The manipulation of the argument content leads to cross site scripting. The attack may be initiated remotely. T...

CVE-2026-65504

Unauthenticated Broken Access Control in BOX NOW Delivery Croatia = 3.3.0 versions...

CVE-2026-65504

Unauthenticated Broken Access Control in BOX NOW Delivery Croatia = 3.3.0 versions...

CVE-2026-65504 WordPress BOX NOW Delivery Croatia plugin <= 3.3.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in BOX NOW Delivery Croatia = 3.3.0 versions...

EUVD-2026-53962

Unauthenticated Broken Access Control in BOX NOW Delivery Croatia = 3.3.0 versions...

CVE-2026-65504 WordPress BOX NOW Delivery Croatia plugin <= 3.3.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in BOX NOW Delivery Croatia = 3.3.0 versions...

CVE-2026-65504

CVE-2026-65504 describes an unauthenticated broken access control in the WordPress BOX NOW Delivery Croatia plugin, vulnerable in versions

CVE-2026-65504: Missing Authorization

Unauthenticated Broken Access Control in BOX NOW Delivery Croatia = 3.3.0 versions...

Malicious code in twork-data-services-invest-box-account (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce404950eecf61001f88758ef82a02523d93efe8d29c01f63521ff748b82c553 On module load, index.js requires./adapter.js which detects OS/architecture, fetches an opaque binary via https.get from string-concatenated Cloudfla...

CVE-2026-11977

The WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin for WordPress is vulnerable to generic SQL Injection via the 'wpmametaboxauthorslist' parameter in all versions up to, and including, 3.9.1 due to insufficient escaping on the user supplied parameter and lack...

EUVD-2026-53288

The WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin for WordPress is vulnerable to generic SQL Injection via the 'wpmametaboxauthorslist' parameter in all versions up to, and including, 3.9.1 due to insufficient escaping on the user supplied parameter and lack...

CVE-2026-11977: Improper Neutralization of Special Elements used in an SQL Command

The WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin for WordPress is vulnerable to generic SQL Injection via the 'wpmametaboxauthorslist' parameter in all versions up to, and including, 3.9.1 due to insufficient escaping on the user supplied parameter and lack...

PURPOSE: Poisoning Conflict Resolution in RAG Via Proxy-Fact-Grounded Updates

In Retrieval-Augmented Generation RAG, post-retrieval conflict resolution arbitrates among noisy or contradictory retrieved passages. However, the robustness of this safeguard against knowledge poisoning has not been adequately studied. Existing black-box poisoning methods all assert the target...

AI Forensics across White-, Grey-, and Black-Box Access: A Process Model and Research Agenda for Post-Incident Investigation of AI Systems

AI systems are increasingly involved in decisions and actions that may later require investigation. When an AI related incident occurs, investigators need to reconstruct what the system did, why it behaved that way, and which part of the system or supply chain contributed to the outcome. Existing...

PT-2026-67657

The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box, allowing users with the Contributor...

Behavioral Skill Reconstruction: Reconstructing Hidden Functionality from LLM Agent Skills

Closed source agent skills may encode proprietary instructions, scripts, constants, and data. Providers may offer their capabilities as services while keeping the underlying packages hidden. Prior work focuses on prompt injection attacks that directly disclose these artifacts, and existing defens...

MissClick: Exploiting Digit-Serialized Coordinates to Attack GUI Grounding Models

Recent GUI visual grounding models generate screen coordinates as sequences of digit tokens that are parsed into numerical values and mapped to executable clicks. The security implications of this coordinate generation process have been largely overlooked. We observe that each coordinate digit is...