CVE-2020-14179

CVE-2020-14179 Sensitive data exposure via /secure/QueryComponent!Default.jspa endpoint Priority: High Affects Version/s: 8.6.0 | 8.8.0 | 8.5.5 | 8.9.0 | 8.10.0 | 8.11.0 Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names a...

CVE-2026-88997

CVE-2026-88997 JSM Show Post Metadata 4.9.1 — Contributor+ Stored XSS via Custom Field Meta Key | ---|--- CVE ID| CVE-2026-88997 Status| PUBLISHED CNA| WPScan Published| 2026-09-23 Updated| 2026-09-23 CWE| CWE-79: Cross-Site Scripting XSS Description The JSM Show Post Metadata WordPress plugin...

CVE-2026-66748-Camaleon-CMS---Authenticated-RCE-via-select_eval-Custom-Field

Security Advisory: Camaleon CMS - Authenticated RCE via selecteval Custom Field Assigned CVE ID: CVE-2026-66748 Product: Camaleon CMS https://github.com/owen2345/camaleon-cms Affected versions: 2.1.1 – 2.9.1 introduced commit 415cbda6 2015-10-16; fixed commit 15882366 2026-03-29 / v2.9.2 Severity...

CVE-2026-3516

CVE-2026-3516: Authenticated Stored Cross-Site Scripting XSS in Contact List Plugin Disclaimer: This repository is created for educational purposes and ethical disclosure only. The vulnerability has been responsibly reported to the vendor and patched. Do not use this information to exploit system...

Advanced Custom Fields < 6.1.6 - Cross-Site Scripting

Advanced Custom Fields beofre 6.1.6 is susceptible to cross-site scripting via the poststatus parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow th...

Custom Field Manager WordPress - Cross-Site Scripting

Custom Field Manager WordPress plugin through 1.0 contains a reflected XSS caused by unsanitized and unescaped parameter output, letting attackers execute scripts against high privilege users such as admin, exploit requires crafted request. id: CVE-2024-12873 info: name: Custom Field Manager...

CVE-2026-115190

An insecure deserialization PHP object injection vulnerability exists in Mautic's handling of segment filters and custom field properties. Several code paths that read these stored values from the database deserialize them without restricting which PHP classes may be instantiated, instead of usin...

CVE-2026-115190

An insecure deserialization PHP object injection vulnerability exists in Mautic's handling of segment filters and custom field properties. Several code paths that read these stored values from the database deserialize them without restricting which PHP classes may be instantiated, instead of usin...

CVE-2026-115190

An insecure deserialization PHP object injection vulnerability exists in Mautic's handling of segment filters and custom field properties. Several code paths that read these stored values from the database deserialize them without restricting which PHP classes may be instantiated, instead of usin...

CVE-2026-115190

An insecure deserialization (PHP object injection) vulnerability exists in Mautic due to the improper handling of segment filters and custom field properties. The application fails to restrict which PHP classes are instantiated during deserialization of database-stored values, bypassing Mautic's ...

EUVD-2026-109793

An insecure deserialization PHP object injection vulnerability exists in Mautic's handling of segment filters and custom field properties. Several code paths that read these stored values from the database deserialize them without restricting which PHP classes may be instantiated, instead of usin...

CVE-2026-116198

Versions of Snipe-IT before 8.7.0 are vulnerable to a missing encryption flaw in the Api echtAssetsController::store method. The root cause is that the application fails to encrypt data when callers lack the assets.view.encrypted_custom_fields permission. Consequently, authenticated API users wit...

PT-2026-115432

Name of the Vulnerable Software and Affected Versions MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. versions prior to 1.2.78.7 Description An unauthenticated privilege escalation issue exists because the subscribe to email list endpoint accepts an...

CVE-2026-104993

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email Contact Email custom field htmlvarname' parameter in all versions up to, and including, 2.8.188 due to insufficient input sanitization...

EUVD-2026-96054

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email Contact Email custom field htmlvarname' parameter in all versions up to, and including, 2.8.188 due to insufficient input sanitization...

CVE-2026-104993

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress are vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.8.188 . The root cause is insufficient input sanitization and output escaping of the email (Contact Emai...

CVE-2026-104993: Improper Neutralization of Input During Web Page Generation

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email Contact Email custom field htmlvarname' parameter in all versions up to, and including, 2.8.188 due to insufficient input sanitization...

EUVD-2026-95023

pH7Builder pH7 Social Dating CMS before 18.5.1 contains a payment validation vulnerability that allows registered low-privileged members to obtain any membership tier by supplying client-controlled plan and amount fields. Attackers can set itemnumber, cartorderid, or the PayPal custom field while...

PT-2026-107995

pH7Builder pH7 Social Dating CMS before 18.5.1 contains a payment validation vulnerability that allows registered low-privileged members to obtain any membership tier by supplying client-controlled plan and amount fields. Attackers can set item number, cart order id, or the PayPal custom field...

CVE-2026-107636: External Control of Assumed-Immutable Web Parameter

pH7Builder pH7 Social Dating CMS before 18.5.1 contains a payment validation vulnerability that allows registered low-privileged members to obtain any membership tier by supplying client-controlled plan and amount fields. Attackers can set itemnumber, cartorderid, or the PayPal custom field while...