Malware in itsa-react-checkbox

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

WordPress Select All Categories and Taxonomies <1.3.2 - Cross-Site Scripting

WordPress Select All Categories and Taxonomies plugin before 1.3.2 contains a cross-site scripting vulnerability. The settings page of the plugin does not properly sanitize the tab parameter before outputting it back. An attacker can inject arbitrary script in the browser of an unsuspecting user ...

CVE-2026-71204-PoC

CVE-2026-71204 — changedetection.io: Omitted Checkbox in /settings Save Silently Disables API Key Enforcement Product: dgtlmoon/changedetection.io — v0.55.7 Files: changedetectionio/blueprint/settings/init.py, changedetectionio/forms.py CWE: CWE-284 — Improper Access Control CVSS 3.1:...

CVE-2026-96660

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Checkbox Field Value in all versions up to, and including, 5.2.8 due to...

CVE-2026-96660

The User Registration & Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 5.2.8 . The root cause is insufficient input sanitization and output escaping within the checkbox field value. Specifically, the nopriv AJAX action user_r...

CVE-2026-96660 User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Checkbox Field Value in all versions up to, and including, 5.2.8 due to...

CVE-2026-96660 User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Checkbox Field Value in all versions up to, and including, 5.2.8 due to...

EUVD-2026-103225

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Checkbox Field Value in all versions up to, and including, 5.2.8 due to...

PT-2026-116365

Name of the Vulnerable Software and Affected Versions User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress versions prior to 5.2.9 Description Stored Cross-Site Scripting occurs du...

CVE-2026-96660: Improper Neutralization of Input During Web Page Generation

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Checkbox Field Value in all versions up to, and including, 5.2.8 due to...

WordPress User Registration & Membership: Cross-site Script Vulnerabilities

WordPress User Registration & Membership versions 5.2.8 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for checkbox field values. Additionally, the userregistrationuserformsubmit AJAX operation does not perform...

PT-2026-114180

Name of the Vulnerable Software and Affected Versions Renovate versions prior to 44.61.3 Description A protection mechanism bypass exists that allows minimumReleaseAge checks to be skipped when a user requests a Pull Request PR rebase using the rebase/retry checkbox. This allows an attacker to...

Malicious code in dolyame-ui-checkbox (npm)

Source: amazon-inspector 2a445ffd0f222f7d58ad870ad641f9dd2fb21a1cc43795cbef5c58109cafebbe On require of the package, index.js loads vendor.js, which reconstructs a set of C2 hostnames from string-split fragments four .workers.dev mirrors and a .dl.wel1.ru DNS-TXT fallback, selects a per-platform...

CVE-2026-45116

MyBB is free and open source forum software. Prior to 1.8.40, the user datahandler does not properly validate checkbox and multiselect profile field types, resulting in stored JavaScript code injection. UserDataHandler::verifyprofilefields only performs the specialized validation when...

CVE-2026-45116

MyBB versions prior to 1.8.40 have a type-confusion flaw in UserDataHandler::verify_profile_fields() (inc/datahandlers/user.php): when a checkbox/multiselect profile field is submitted as a non-array value, the is_array() check is skipped, bypassing specialized validation. The unchecked value is ...

PT-2026-77170

MyBB is free and open source forum software. Prior to 1.8.40, the user datahandler does not properly validate checkbox and multiselect profile field types, resulting in stored JavaScript code injection. UserDataHandler::verify profile fields only performs the specialized validation when is...

EUVD-2026-59807

A flaw has been found in code-projects Online Food Order System 1.0. The impacted element is an unknown function of the file deletefooditems1.php. Executing a manipulation of the argument checkbox can lead to sql injection. The attack can be executed remotely. The exploit has been published and m...

CVE-2026-19917

A flaw has been found in code-projects Online Food Order System 1.0. The impacted element is an unknown function of the file deletefooditems1.php. Executing a manipulation of the argument checkbox can lead to sql injection. The attack can be executed remotely. The exploit has been published and m...

CVE-2026-19917 code-projects Online Food Order System delete_food_items1.php sql injection

A flaw has been found in code-projects Online Food Order System 1.0. The impacted element is an unknown function of the file deletefooditems1.php. Executing a manipulation of the argument checkbox can lead to sql injection. The attack can be executed remotely. The exploit has been published and m...

CVE-2026-19917

A flaw has been found in code-projects Online Food Order System 1.0. The impacted element is an unknown function of the file deletefooditems1.php. Executing a manipulation of the argument checkbox can lead to sql injection. The attack can be executed remotely. The exploit has been published and m...