CVE-2020-14179

CVE-2020-14179 Sensitive data exposure via /secure/QueryComponent!Default.jspa endpoint Priority: High Affects Version/s: 8.6.0 | 8.8.0 | 8.5.5 | 8.9.0 | 8.10.0 | 8.11.0 Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names a...

CVE-2026-105863

Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a reserved authentication claim name can place unintended values in the authentication token issued at login. This issue is fixed in version...

CVE-2026-105863 Payload authentication token field handling issue

Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a reserved authentication claim name can place unintended values in the authentication token issued at login. This issue is fixed in version...

CVE-2026-105863

The headless content management system Payload is vulnerable in versions after 3.0.0 and before 3.90.0 . The root cause is a custom field option that allows a field to be mapped to a reserved authentication claim name , which can cause unintended values to be placed in the authentication token is...

Custom Field Manager WordPress - Cross-Site Scripting

Custom Field Manager WordPress plugin through 1.0 contains a reflected XSS caused by unsanitized and unescaped parameter output, letting attackers execute scripts against high privilege users such as admin, exploit requires crafted request. id: CVE-2024-12873 info: name: Custom Field Manager...

Advanced Custom Fields < 6.1.6 - Cross-Site Scripting

Advanced Custom Fields beofre 6.1.6 is susceptible to cross-site scripting via the poststatus parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow th...

CVE-2026-96566

The Newsletter – Send awesome emails from WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 9.4.0 . The root cause is insufficient input sanitization and output escaping within the 'np1' Custom Field Parameter . Unauthenticated attackers can i...

CVE-2026-3516

CVE-2026-3516: Cross-Site Scripting XSS Almacenado Autenticado en el Plugin Contact List Aviso: Este repositorio se crea solo con fines educativos y divulgación ética. La vulnerabilidad ha sido reportada de forma responsable al proveedor y ha sido parcheada. No utilice esta información para...

CVE-2026-88997

CVE-2026-88997 JSM Show Post Metadata 4.9.1 — XSS Almacenado con Contributor+ a través de Custom Field Meta Key | ---|--- ID de CVE| CVE-2026-88997 Estado| PUBLICADO CNA| WPScan Publicado| 2026-09-23 Actualizado| 2026-09-23 CWE| CWE-79: Cross-Site Scripting XSS Descripción El plugin de WordPress...

CVE-2026-66748-Camaleon-CMS---Authenticated-RCE-via-select_eval-Custom-Field

Aviso de seguridad: Camaleon CMS - RCE autenticado mediante el campo personalizado selecteval ID de CVE asignado: CVE-2026-66748 Producto: Camaleon CMS https://github.com/owen2345/camaleon-cms Versiones afectadas: 2.1.1 – 2.9.1 introducido en el commit 415cbda6 2015-10-16; corregido en el commit...

CVE-2026-94131

Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension 11.1.0 - A subscriber could store a path in a file-type custom field and have AcyMailing delete that file when the field was cleared, including files outside the upload folder such as...

CVE-2026-94131 Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0

Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension 11.1.0 - A subscriber could store a path in a file-type custom field and have AcyMailing delete that file when the field was cleared, including files outside the upload folder such as...

CVE-2026-94131

The AcyMailing Enterprise extension for Joomla (versions

EUVD-2026-87773

Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension 11.1.0 - A subscriber could store a path in a file-type custom field and have AcyMailing delete that file when the field was cleared, including files outside the upload folder such as...

CVE-2026-94131 Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0

Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension 11.1.0 - A subscriber could store a path in a file-type custom field and have AcyMailing delete that file when the field was cleared, including files outside the upload folder such as...

PT-2026-99393

Name of the Vulnerable Software and Affected Versions AcyMailing Enterprise versions prior to 11.1.0 Description An unauthenticated arbitrary file deletion issue exists where a subscriber can store a file path within a file-type custom field. When this field is cleared, the system may delete the...

CVE-2026-94131: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension 11.1.0 - A subscriber could store a path in a file-type custom field and have AcyMailing delete that file when the field was cleared, including files outside the upload folder such as...

CVE-2026-93897 GeoDirectory <= 2.8.181 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone')

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text-type Custom Field e.g., 'phone' in all versions up to, and including, 2.8.181 due to insufficient input sanitization and output escaping. Th...

CVE-2026-93897: Improper Neutralization of Input During Web Page Generation

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text-type Custom Field e.g., 'phone' in all versions up to, and including, 2.8.181 due to insufficient input sanitization and output escaping. Th...

Cross-site Scripting (XSS)

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the AssetPresenter process. An attacker can execute arbitrary scripts in the context of a higher-privileged user's session by injecting maliciou...