BestWebSoft's Twitter < 2.55 - Cross-Site Scripting

The twitter-plugin plugin before 2.55 for WordPress has XSS. id: CVE-2017-18505 info: name: BestWebSoft's Twitter 2.55 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The twitter-plugin plugin before 2.55 for WordPress has XSS. impact: | Authenticated attackers can...

CVE-2022-46638

CVE-2022-46638 Its about vulnerability of AppLock Ver.5.6.2, a popular android app trusted by more than 100 million users in over 150 countries. PoC Unlock the application protected by AppLock just by tap the back button multiple times. 1. Open the application was locked by AppLock. 2. Dont input...

Bolt-CMS-3.6.2---Cross-Site-Scripting

Bolt CMS 3.6.2 - Cross-Site Scripting Vulnerability Bolt CMS 3.6.2 - Cross-Site Scripting Vulnerability CVE-2018-19933 https://vulners.com/cve/CVE-2018-19933 Proof of Concept To exploit vulnerability, Bolt CMS 3.6.2 allows XSS via text input click preview button as demonstrated by the Title field...

CVE-2026-82557: Apache Software Foundation Apache Wicket: Missing authorization in Apache Wicket

Missing authorization in Apache Wicket. org.apache.wicket.markup.html.form.Form resolves the component that submitted a form from the request parameters in FormonRequest and passes the result directly to FormonFormSubmittedIFormSubmitter. The check that the submitting component is visible and...

PT-2026-135039

Missing authorization in Apache Wicket. org.apache.wicket.markup.html.form.Form resolves the component that submitted a form from the request parameters in FormonRequest and passes the result directly to FormonFormSubmittedIFormSubmitter. The check that the submitting component is visible and...

CVE-2020-27603-bbb-libreoffice-poc

CVE-2020-27603-bbb-libreoffice-poc Proof of Concept of Libreoffice file exfiltration vulnerability in Big Blue Button These ODT files show how to exploit a file exfiltration vulnerability that can happen with server-side Libreoffice rendering, e.g. BigBlueButton. Background:...

CVE-2025-69581

CVE-2025-69581 An issue was discovered in Chamillo LMS 1.11.2. The Social Network /personaldata endpoint exposes full sensitive user information even after logout because proper cache-control is missing. Using the browser back button restores all personal data, allowing unauthorized users on the...

Centry

Centry WARNING: THIS IS EXPERIMENTAL SOFTWARE. IT IS LIKELY TO CONTAIN BUGS. Updates If you have already installed Centry, please run git pull to update to the latest version. The latest updates make it much more secure against replay attacks. Introduction Centry is a panic button intended to...

CVE-2024-25293

MJML Local Code Execution PoC A Proof-Of-Concept for CVE-2024-25293 vulnerability. mjml-app v3.0.4 & 3.1.0-beta was discovered to contain a remote code execution RCE In this repository there is an example vulnerable application and proof-of-concept POC exploit of it. As a PoC there is a python fi...

CVE-2026-116552

The Like Button Rating ♥ LikeBtn plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTPCLIENTIP Client-IP header' parameter in all versions up to, and including, 2.6.64 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-116552

The Like Button Rating ♥ LikeBtn plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 2.6.64 . The root cause is insufficient input sanitization and output escaping of the 'HTTP_CLIENT_IP' (Client-IP header) parameter. Unauthenticated attackers c...

CVE-2026-116552 Like Button Rating ♥ LikeBtn <= 2.6.64 - Unauthenticated Stored Cross-Site Scripting via 'Client-IP' Header

The Like Button Rating ♥ LikeBtn plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTPCLIENTIP Client-IP header' parameter in all versions up to, and including, 2.6.64 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

EUVD-2026-114216

The Like Button Rating ♥ LikeBtn plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTPCLIENTIP Client-IP header' parameter in all versions up to, and including, 2.6.64 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-116552 Like Button Rating ♥ LikeBtn <= 2.6.64 - Unauthenticated Stored Cross-Site Scripting via 'Client-IP' Header

The Like Button Rating ♥ LikeBtn plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTPCLIENTIP Client-IP header' parameter in all versions up to, and including, 2.6.64 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

WordPress Like Button Rating ♥ LikeBtn plugin <= 2.6.64 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by GivMeInJ in WordPress Plugin Like Button Rating versions = 2.6.64...

CVE-2026-118071

The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor of the post, including...

EUVD-2026-113728

The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor of the post, including...

CVE-2026-118071

The Joinchat WordPress plugin (versions 6.3.2 - 6.4.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) due to a failure to escape the message of its button block before outputting it into an HTML attribute on the front end. This vulnerability allows users with the Author role or higher to inj...

CVE-2026-118071 Joinchat 6.3.2 - 6.4.1 - Author+ Stored XSS via Button Block Message Attribute

The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor of the post, including...

CVE-2026-118071 Joinchat 6.3.2 - 6.4.1 - Author+ Stored XSS via Button Block Message Attribute

The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor of the post, including...