CVE-nu11secur1ty

CVE-nu11secur1ty Link table of Analysis Description: CVE-2020| CVSS Vector| Score ---|---|--- CVE-2020-0668| CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H| 7.8 HIGH CVE-2020-0683| CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H| 7.8 HIGH CVE-2020-0796| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H| 10...

CVE-2025-55903

CVE-2025-55903: Stored HTML Injection in PerfexCRM ⚠️ Security Advisory A critical Stored HTML Injection vulnerability affecting invoices, billing, and automated communications -ff6600 📋 Overview A Stored HTML Injection vulnerability has been discovered in PerfexCRM that allows authenticated users...

EUVD-2026-91855

Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users to inject scripts into item listing descriptions when frontend TinyMCE is enabled. Attackers can submit malicious JavaScript, which ItemActions.php saves without tag stripping,...

CVE-2026-104479

Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users to inject scripts into item listing descriptions when frontend TinyMCE is enabled. Attackers can submit malicious JavaScript, which ItemActions.php saves without tag stripping,...

CVE-2026-104479: Improper Neutralization of Input During Web Page Generation

Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users to inject scripts into item listing descriptions when frontend TinyMCE is enabled. Attackers can submit malicious JavaScript, which ItemActions.php saves without tag stripping,...

PT-2026-104461

Name of the Vulnerable Software and Affected Versions Shopclass versions prior to 6.2.0 Description A stored cross-site scripting issue exists when the frontend TinyMCE is enabled. This allows self-registered non-admin users to inject malicious JavaScript into item listing descriptions. The...

Rocky Linux 8 [CIQ] Security Update: kernel-rt-debug-debuginfo / kernel-rt-debuginfo / etc (crlsa-2026_23259)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202623259 advisory. kernel: Linux kernel: smb: client: reject userspace cifs.spnego descriptions CVE-2026-46243 Tenable has extracted the preceding description block directly from the...

CVE-2026-93464

A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser...

CVE-2026-93464

A Stored Cross-Site Scripting (XSS) vulnerability (CWE-79) exists in baserCMS due to the handling of custom content descriptions . Exploitation of this flaw allows an attacker to execute arbitrary scripts within a user's web browser. To remediate this issue, users are advised to update the softwa...

EUVD-2026-89663

Stored Cross-Site Scripting via custom content descriptions vulnerability exists in baserCMS . If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser may be caused...

CVE-2026-93464

A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser...

CVE-2026-93464

A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser...

CVE-2026-93464: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser...

PT-2026-103069

A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser...

EUVD-2026-88596

GestSup versions before 3.2.62 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers to store arbitrary JavaScript in ticket descriptions and replies. Attackers can send emails to the monitored mailbox containing script tags and event handlers...

CVE-2026-102372: Improper Neutralization of Input During Web Page Generation

GestSup versions before 3.2.61 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers to store arbitrary JavaScript in ticket descriptions and replies. Attackers can send emails to the monitored mailbox containing script tags and event handlers...

CVE-2026-97564

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.idmap descriptions cifs.idmap key descriptions carry authority-bearing fields owner and group SIDs and uid/gid values in "os:"/"gs:"/"oi:"/"gi:" form that the cifs.idmap upcall helper treats as...

EUVD-2026-85055

The WPC Smart Compare for WooCommerce WordPress plugin before 6.6.1 does not apply WordPress's post-password protection when returning product content through its comparison handler, allowing unauthenticated users to read the description of password-protected products...

CVE-2026-20285

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-si...

CVE-2026-20286

A vulnerability in the web-based management interface of Cisco Identify Services Engine ISE could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-side validation of Administrator permissions. An...