security-advisories

🔐 Avisos de Seguridad por Minhajul Taivin Bienvenido al repositorio oficial de mis divulgaciones CVE publicadas. Este repositorio contiene avisos de seguridad detallados, información de prueba de concepto, estrategias de mitigación y análisis técnico para vulnerabilidades que he descubierto. 📌 CV...

WordPress Frontend Post Submission Manager Lite – Guest Post and Frontend Submission Forms plugin <= 1.3.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by Tarcísio Luchesi De Almeida Silva Poystick in WordPress Plugin Frontend Post Submission Manager Lite versions = 1.3.4...

CVE-2026-96649 Frontend Post Submission Manager Lite <= 1.3.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink)

The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via postcontent Parameter data-label DOM Sink in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output...

CVE-2026-96649 Frontend Post Submission Manager Lite <= 1.3.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink)

The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via postcontent Parameter data-label DOM Sink in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output...

Linux Distros Unpatched Vulnerability : CVE-2026-102279

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APPDEBUG=true pass attacker-controlled input to a...

EUVD-2026-88508

Laravel: XSS in Debug Page Information...

Laravel: XSS in Debug Page Information

Impact When APPDEBUG=true, attacker-controlled input is passed to a Tippy.js tooltip configured with allowHTML: true, enabling DOM-based XSS during mouse hover. Patches 61381...

CVE-2026-102279

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APPDEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is...

DEBIAN-CVE-2026-102279

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APPDEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is...

CVE-2026-102279 Laravel: XSS in Debug Page Information

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APPDEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is...

CVE-2026-102279

The Laravel web application framework is vulnerable to DOM-based cross-site scripting (XSS) in versions prior to 12.69.0 and 13.30.0 . When APP_DEBUG=true , the exception debug pages pass attacker-controlled input to a Tippy.js tooltip with allowHTML set to true. This allows an attacker to execut...

CVE-2026-102279 Laravel: XSS in Debug Page Information

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APPDEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is...

CVE-2026-102279 Laravel: XSS in Debug Page Information

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APPDEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is...

CVE-2026-102279

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APPDEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is...

WordPress File Manager Pro plugin < 2.1.3 - DOM-based XSS vulnerability

DOM-based XSS vulnerability discovered by Mutantgun in WordPress Plugin File Manager Pro versions 2.1.3...

WordPress FileOrganizer plugin < 1.2.1 - DOM-based XSS vulnerability

DOM-based XSS vulnerability discovered by Mutantgun in WordPress Plugin FileOrganizer versions 1.2.1...

WordPress File Manager plugin < 8.0.5 - DOM-based XSS vulnerability

DOM-based XSS vulnerability discovered by Mutantgun in WordPress Plugin Bit File Manager versions 8.0.5...

CVE-2026-102279: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APPDEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is...

CVE-2026-85081 Multiple elFinder Plugins - DOM-based XSS via postMessage Origin Bypass

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading...

CVE-2026-85081 Multiple elFinder Plugins - DOM-based XSS via postMessage Origin Bypass

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading...