CVE-2026-19207

A security vulnerability has been detected in PHPGurukul Company Visitor Management System 1.0. This issue affects some unknown processing of the file /manage-newvisitors.php. The manipulation of the argument fullname leads to cross site scripting. The attack can be initiated remotely. The exploi...

CVE-2026-19207

Summary: PHPGurukul Company Visitor Management System 1.0 is affected by an input handling flaw in /manage-newvisitors.php where manipulating the fullname parameter enables cross-site scripting. The vulnerability can be triggered remotely and the exploit has been publicly disclosed. The documents...

EUVD-2026-54496

A security vulnerability has been detected in PHPGurukul Company Visitor Management System 1.0. This issue affects some unknown processing of the file /manage-newvisitors.php. The manipulation of the argument fullname leads to cross site scripting. The attack can be initiated remotely. The exploi...

CVE-2026-19207 PHPGurukul Company Visitor Management System manage-newvisitors.php cross site scripting

A security vulnerability has been detected in PHPGurukul Company Visitor Management System 1.0. This issue affects some unknown processing of the file /manage-newvisitors.php. The manipulation of the argument fullname leads to cross site scripting. The attack can be initiated remotely. The exploi...

CVE-2026-66494

Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder 6.7.0 - An unauthenticated attacker can store malicious JavaScript in a Joomla site's database via a single HTTP request. When an administrator opens the SP Page Builder editor, the JavaScript...

CVE-2026-66494 Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0

Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder 6.7.0 - An unauthenticated attacker can store malicious JavaScript in a Joomla site's database via a single HTTP request. When an administrator opens the SP Page Builder editor, the JavaScript...

CVE-2026-66494

Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder 6.7.0 - An unauthenticated attacker can store malicious JavaScript in a Joomla site's database via a single HTTP request. When an administrator opens the SP Page Builder editor, the JavaScript...

CVE-2026-66494 Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0

Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder 6.7.0 - An unauthenticated attacker can store malicious JavaScript in a Joomla site's database via a single HTTP request. When an administrator opens the SP Page Builder editor, the JavaScript...

CVE-2026-66494

The vulnerability CVE-2026-66494 affects Joomla SP Page Builder via the Shapes API endpoint in the joomshaper Shapes extension, where unauthenticated stored XSS is possible in SP Page Builder versions before 6.7.0. An attacker can store malicious JavaScript in the Joomla site’s database with a si...

CVE-2026-48094

The ShareOpenly WordPress plugin prior to version 1.2.1 contains a Cross-Site Scripting vulnerability caused by the absence of WordPress's escurl escaping function on the $url variable before it is rendered into HTML content. This variable is constructed from homeurl addqueryarg array, $wp-reques...

CVE-2026-48094 ShareOpenly has Cross-Site Scripting (XSS) via Missing esc_url() on Shared URL in Content Output

The ShareOpenly WordPress plugin prior to version 1.2.1 contains a Cross-Site Scripting vulnerability caused by the absence of WordPress's escurl escaping function on the $url variable before it is rendered into HTML content. This variable is constructed from homeurl addqueryarg array, $wp-reques...

CVE-2026-48094

CVE-2026-48094 affects the ShareOpenly WordPress plugin (prior to 1.2.1). The issue is a Cross-Site Scripting (XSS) vulnerability caused by omitting WordPress esc_url() when rendering a URL into an HTML href. The vulnerable code builds the URL from home_url( add_query_arg( array(), $wp-&gt;reques...

EUVD-2026-54477

The ShareOpenly WordPress plugin prior to version 1.2.1 contains a Cross-Site Scripting vulnerability caused by the absence of WordPress's escurl escaping function on the $url variable before it is rendered into HTML content. This variable is constructed from homeurl addqueryarg array, $wp-reques...

CVE-2026-48094 ShareOpenly has Cross-Site Scripting (XSS) via Missing esc_url() on Shared URL in Content Output

The ShareOpenly WordPress plugin prior to version 1.2.1 contains a Cross-Site Scripting vulnerability caused by the absence of WordPress's escurl escaping function on the $url variable before it is rendered into HTML content. This variable is constructed from homeurl addqueryarg array, $wp-reques...

CVE-2026-54216

Tobit Laboratories AG TeamDavid's Webbox application contains a reflected cross-site scripting XSS vulnerability. By sending a specially crafted link including an arbitrary path, an XSS payload or the parameter “EntryInfo”, and the parameter “!templateName=entryMail”, an attacker can cause the...

CVE-2026-54208

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an unauthenticated attacker to create or write into existing files on the server with attacker-controlled content. This is possible because user input is written directly to files without proper...

EUVD-2026-54448

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to a stored XSS vulnerability. An attacker can send an email containing malicious JavaScript code. When a user accesses the email, the stored cross-site scripting is triggered. This issue affects TeamDavid through Rollout 524...

CVE-2026-54217

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to a stored XSS vulnerability. An attacker can send an email containing malicious JavaScript code. When a user accesses the email, the stored cross-site scripting is triggered. This issue affects TeamDavid through Rollout 524...

CVE-2026-54217 TeamDavid: Stored XSS in web application

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to a stored XSS vulnerability. An attacker can send an email containing malicious JavaScript code. When a user accesses the email, the stored cross-site scripting is triggered. This issue affects TeamDavid through Rollout 524...

CVE-2026-54216

CVE-2026-54216 affects Tobit Laboratories AG TeamDavid’s Webbox. The vulnerability is a reflected cross-site scripting (XSS) flaw in the application triggered by crafting a link with an arbitrary path and an XSS payload via the EntryInfo parameter, using the templateName=!templateName=entryMail, ...