CVE-2026-115606

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows Stored XSS.This issue affects DXP ToolKit: from n/a through 2.0.1...

CVE-2026-115607

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows SQL Injection.This issue affects DXP ToolKit: from n/a through 2.0.1...

CVE-2026-115607 WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows SQL Injection.This issue affects DXP ToolKit: from n/a through 2.0.1...

EUVD-2026-112064

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows SQL Injection.This issue affects DXP ToolKit: from n/a through 2.0.1...

CVE-2026-115607

The DXP ToolKit WordPress plugin (versions up to and including 2.0.1 ) is vulnerable to an SQL Injection flaw caused by improper neutralization of special elements in SQL commands. This vulnerability allows an attacker to execute unauthorized SQL queries, potentially leading to high confidentiali...

EUVD-2026-112062

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows Stored XSS.This issue affects DXP ToolKit: from n/a through 2.0.1...

CVE-2026-115606

The Crowd Favorite DXP ToolKit (dxp-toolkit) WordPress plugin, specifically versions up to and including 2.0.1 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the Improper Neutralization of Input During Web Page Generation , which allows an attacker to inject malicious sc...

CVE-2026-115606 WordPress DXP ToolKit plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows Stored XSS.This issue affects DXP ToolKit: from n/a through 2.0.1...

PT-2026-128237

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows Stored XSS.This issue affects DXP ToolKit: from n/a through 2.0.1...

PT-2026-128238

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows SQL Injection.This issue affects DXP ToolKit: from n/a through 2.0.1...

WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by V1T in WordPress Plugin DXP ToolKit versions = 2.0.1...

WordPress DXP ToolKit plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin DXP ToolKit versions = 2.0.1...

Malicious code in dxp-web (npm)

The package dxp-web was found to contain malicious code. --- Credit: OpenSSF source...

Liferay Portal & DXP - Cross-Site Scripting Detection

Liferay Portal 7.4.0 through 7.4.3.133 and Liferay DXP 2024.Q1.1 through 2025.Q1.4 contain a reflected XSS caused by improper sanitization in entrycoverimagecaption.jsp, letting remote non-authenticated attackers inject JavaScript. !/usr/bin/env python3 -- coding: utf-8 -- """Liferay Portal 7."""...

CVE-2026-11407

Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated administrative attackers to execute arbitrary methods on PHP objects by exploiting empty checkMethodAllowed and checkPropertyAllowed implementations in the custom Twig SecurityPolicy. Attackers can...

CVE-2026-11407: Improper Neutralization of Special Elements Used in a Template Engine

Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated administrative attackers to execute arbitrary methods on PHP objects by exploiting empty checkMethodAllowed and checkPropertyAllowed implementations in the custom Twig SecurityPolicy. Attackers can...

WS-2023-0396

Impact The route used for file downloads allows specifying the name of the downloaded file. This is an unintended side effect of the implementation, and means one could construct download URLs with filenames that have no relation to the actual file, which could lead to misunderstandings and...

WS-2023-0395

Impact The route used for file downloads allows specifying the name of the downloaded file. This is an unintended side effect of the implementation, and means one could construct download URLs with filenames that have no relation to the actual file, which could lead to misunderstandings and...

WS-2022-0380

Impact Unauthenticated GraphQL queries for user accounts can expose password hashes of users that have created or modified content, typically but not necessarily limited to administrators and editors. Patches Affected versions: Ibexa DXP v3.3., v4.2., eZ Platform v2.5. Resolving versions: Ibexa D...

WS-2022-0144

Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replace...