RHEL 8 : nodejs:22 (RHSA-2026:41947)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:41947 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...

Debian dsa-6391 : roundcube - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6391 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6391-1 [email protected] https://www.debian.org/securit...

CVE-2026-51025

The CVE-2026-51025 entry relates to a Cross Site Scripting (XSS) flaw in the fuint Member Marketing System <= v1.0, enabling a remote attacker to execute arbitrary code via the ClientMessageController.java file. Connected sources (EUVD-2026-46139, NVD, CVE records, and third-party trackers) co...

MAL-2026-10782 Malicious code in zoom-widget-xss-poc-paresh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17ce7f91ce8bd8ab97268072386ec0890f1edc0336138472d428df845041ac5e Package ships a single browser-side IIFE index.js that manipulates the DOM inserts a banner into root and calls window.widgetSend with a demonstratio...

Malicious code in zoom-widget-xss-poc-paresh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17ce7f91ce8bd8ab97268072386ec0890f1edc0336138472d428df845041ac5e Package ships a single browser-side IIFE index.js that manipulates the DOM inserts a banner into root and calls window.widgetSend with a demonstratio...

BIT-DRUPAL-2026-55808 Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Drupal core allows Cross-Site Scripting XSS. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0....

CVE-2026-45138

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the custom htmlpurify validation rule used to sanitize blog post bodies relies on by-reference mutation ?string &$str, but CodeIgniter 4's validator passes a local copy of the value, so the sanitized tex...

CVE-2026-45138

CVE-2026-45138 affects CI4MS (CodeIgniter 4-based CMS skeleton). Before 0.31.9.0, html_purify sanitization mutates the value by reference, but CodeIgniter’s validator uses a copy, causing sanitized text to be discarded. The Blog controller writes raw content to blog_langs and the public post temp...

CVE-2026-16229

A flaw has been found in itsourcecode Courier Management System up to 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php. Executing a manipulation of the argument page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit h...

CVE-2026-16229

A flaw has been found in itsourcecode Courier Management System up to 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php. Executing a manipulation of the argument page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit h...

CVE-2026-16229

The CVE reports a cross-site scripting (XSS) flaw in itsourcecode Courier Management System up to version 1.0. The vulnerability affects an unknown functionality of the file /index.php, where manipulating the argument page can trigger XSS. It is exploitable remotely, and an exploit has been publi...

CVE-2026-16229 itsourcecode Courier Management System index.php cross site scripting

A flaw has been found in itsourcecode Courier Management System up to 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php. Executing a manipulation of the argument page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit h...

CVE-2026-16220

A vulnerability has been found in code-projects Online Examination System 1.0. This vulnerability affects unknown code of the file /account.php?q=quiz. Such manipulation of the argument eid/n/t leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to t...

CVE-2026-16220 code-projects Online Examination System account.php cross site scripting

A vulnerability has been found in code-projects Online Examination System 1.0. This vulnerability affects unknown code of the file /account.php?q=quiz. Such manipulation of the argument eid/n/t leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to t...

EUVD-2026-45431

A vulnerability has been found in code-projects Online Examination System 1.0. This vulnerability affects unknown code of the file /account.php?q=quiz. Such manipulation of the argument eid/n/t leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to t...

CVE-2026-16220

CVE-2026-16220 affects code-projects Online Examination System 1.0. The vulnerability resides in unknown code handling the parameter eid/n/t in /account.php?q=quiz, enabling cross-site scripting through manipulation of that argument. Impact details stated include remote feasibility with low to mo...

CVE-2026-16220

A vulnerability has been found in code-projects Online Examination System 1.0. This vulnerability affects unknown code of the file /account.php?q=quiz. Such manipulation of the argument eid/n/t leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to t...

CVE-2026-16205

A weakness has been identified in Pluck CMS up to 4.7.21. This vulnerability affects the function htmlspecialcharsdecode of the file data/modules/albums/albums.admin.php of the component Albums Module. Executing a manipulation of the argument Info can lead to cross site scripting. It is possible ...

CVE-2026-16203

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /forCYS.php. Such manipulation of the argument course leads to cross site scripting. The attack may be performed from remote. The exploit is...

CVE-2026-16202

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /CYS.php. This manipulation of the argument course causes cross site scripting. The attack is possible to be carried out remotely. The...