CVE-nu11secur1ty

CVE-nu11secur1ty Link table of Analysis Description: CVE-2020| CVSS Vector| Score ---|---|--- CVE-2020-0668| CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H| 7.8 HIGH CVE-2020-0683| CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H| 7.8 HIGH CVE-2020-0796| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H| 10...

CVE-2025-55903

CVE-2025-55903: Stored HTML Injection in PerfexCRM ⚠️ Security Advisory A critical Stored HTML Injection vulnerability affecting invoices, billing, and automated communications -ff6600 📋 Overview A Stored HTML Injection vulnerability has been discovered in PerfexCRM that allows authenticated users...

CVE-2026-116883

Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to inject HTML through schema descriptions. Attackers with the smw-schemaedit permission can save HTML that is passed unescaped to Html::rawElement in...

CVE-2026-116883

Semantic MediaWiki versions 3.1.0 before 7.3.1 are vulnerable to a stored cross-site scripting (XSS) flaw. The issue exists because the HtmlBuilder component passes HTML from schema descriptions unescaped to the Html::rawElement() function. Authenticated users with the smw-schemaedit permission c...

EUVD-2026-110711

Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to inject HTML through schema descriptions. Attackers with the smw-schemaedit permission can save HTML that is passed unescaped to Html::rawElement in...

CVE-2026-116883 Semantic MediaWiki 3.1.0 before 7.3.1 Stored XSS via Schema Descriptions

Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to inject HTML through schema descriptions. Attackers with the smw-schemaedit permission can save HTML that is passed unescaped to Html::rawElement in...

CVE-2026-116883 Semantic MediaWiki 3.1.0 before 7.3.1 Stored XSS via Schema Descriptions

Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to inject HTML through schema descriptions. Attackers with the smw-schemaedit permission can save HTML that is passed unescaped to Html::rawElement in...

Semantic MediaWiki cross-site scripting vulnerability

Semantic MediaWiki versions from 3.1.0 up to and including 7.3.1 contain a cross-site scripting vulnerability. This vulnerability arises because authenticated schema editors with smw-schemaedit privileges can inject HTML via schema descriptions. The unescaped HTML is then passed to Html::rawEleme...

PT-2026-126344

Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to inject HTML through schema descriptions. Attackers with the smw-schemaedit permission can save HTML that is passed unescaped to Html::rawElement in...

CVE-2026-109368

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.0.3 via the 'id' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract private...

EUVD-2026-103223

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.0.3 via the 'id' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract private...

PT-2026-116356

Name of the Vulnerable Software and Affected Versions WP Booking System – Booking Calendar versions prior to 2.1.0.4 Description Authenticated users with subscriber-level access and above can extract private per-event booking descriptions and booking IDs from any calendar managed by the site. Thi...

CVE-2026-109368: Missing Authorization

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.0.3 via the 'id' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract private...

EUVD-2026-102488

APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node descriptions from other spaces by supplying a user-controlled nodeId. Attackers can request GET /node/nodeId/description, which skips space membership and node permission check...

CVE-2026-74923: Exposure of Sensitive Information to an Unauthorized Actor

The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating a gallery on demand, allowing unauthenticated users to enumerate and disclose the titles, descriptions and direct file URLs of media attached to unpublished, private or trashed...

CVE-2026-111344

APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node descriptions from other spaces by supplying a user-controlled nodeId. Attackers can request GET /node/nodeId/description, which skips space membership and node permission check...

CVE-2026-111344 APITable through 1.14.0-beta Authorization Bypass via GET /node/{nodeId}/description

APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node descriptions from other spaces by supplying a user-controlled nodeId. Attackers can request GET /node/nodeId/description, which skips space membership and node permission check...

CVE-2026-111344

APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node descriptions from other spaces by supplying a user-controlled nodeId. Attackers can request GET /node/nodeId/description, which skips space membership and node permission check...

CVE-2026-111344 APITable through 1.14.0-beta Authorization Bypass via GET /node/{nodeId}/description

APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node descriptions from other spaces by supplying a user-controlled nodeId. Attackers can request GET /node/nodeId/description, which skips space membership and node permission check...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: keys: ensure that the byte order of keyring key-chunks matches keyringdiffobjects keyringgetkeychunk loads description bytes into the index chunk low address first, while keyringdiffobjects identifies the first differing bit from...