19621 matches found
EUVD-2026-88628
A security flaw has been discovered in REBUILD up to 4.4.11. This vulnerability affects unknown code of the file /commons/file-editor-save. The manipulation of the argument url/fileKey results in missing authorization. It is possible to launch the attack remotely. The exploit has been released to...
CVE-2026-96326
The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for...
EUVD-2026-88602
The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-96326 HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field
The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-96326 HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field
The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-96326
The HT Contact Form – Drag & Drop Form Builder for WordPress plugin, for versions up to and including 2.10.2 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping within the Rich Text Editor Field . This allows unauthenticated...
CLEANSTART-2026-XZ43182 launch-editor allows users to open files with line numbers in editor from Node
Security vulnerability affects the argo-workflows package. launch-editor allows users to open files with line numbers in editor from Node...
PT-2026-102430
Name of the Vulnerable Software and Affected Versions HT Contact Form – Drag & Drop Form Builder for WordPress versions prior to 2.10.3 Description Insufficient input sanitization and output escaping in the Rich Text Editor Field allow unauthenticated attackers to perform Stored Cross-Site...
CVE-2026-96326: Improper Neutralization of Input During Web Page Generation
The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-102249: Missing Authorization
A security flaw has been discovered in REBUILD up to 4.4.11. This vulnerability affects unknown code of the file /commons/file-editor-save. The manipulation of the argument url/fileKey results in missing authorization. It is possible to launch the attack remotely. The exploit has been released to...
The vulnerability of Microsoft Visual Studio Code’s source editor, related to a flaw in its data protection mechanism, allows attackers to bypass existing security measures.
The vulnerability of Microsoft Visual Studio Code’s editor is related to a flaw in the data protection mechanism. Exploiting this vulnerability allows an attacker to bypass existing security measures remotely...
CVE-2026-48907
CVE-2026-48907 – Joomla JCE 未认证远程代码执行 RCE 严重性: 严重 CVSS 9.8 / CVSS v4 10.0 CVE: CVE-2026-48907 CWE: CWE-284 – 不适当的访问控制 受影响软件: Joomla 内容编辑器 JCE 扩展 for Joomla 状态: 已公开披露并在野外积极利用。 CVE-2026-48907 是一个影响 Joomla 内容编辑器 JCE 扩展的 严重未认证远程代码执行 RCE 漏洞。 该漏洞源于 JCE 配置文件管理功能中的不适当的访问控制 。攻击者可以在无需认证...
POC-ELEMENTOR-CSRF
POC-ELEMENTOR-CSRF — Laboratorio pedagógico del bypass del non...
Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link
Details have emerged about a high-severity security flaw in the Elementor Website Builder WordPress plugin that could be exploited by an unauthenticated attacker to create rogue administrator accounts and take control of a site. The cross-site request forgery CSRF vulnerability, which has yet to ...
PT-2026-102814
Name of the Vulnerable Software and Affected Versions argv-parser versions prior to 2.0.1 Description The parseEnv function omits VISUAL from GitEnvKeys, causing prepareEnv to drop the value before vulnerabilityCheck can classify it as allowUnsafeEditor. In applications that forward...
CVE-2026-100372
ClipBucket v5 before 5.5.3-197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrators to overwrite PHP files by supplying directory traversal sequences in the folder parameter. Attackers with managetemplateaccess permission can traverse outsi...
EUVD-2026-87315
ClipBucket v5 before 5.5.3-197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrators to overwrite PHP files by supplying directory traversal sequences in the folder parameter. Attackers with managetemplateaccess permission can traverse outsi...
CVE-2026-100372
ClipBucket v5 versions prior to 5.5.3-#197 are vulnerable to a path traversal vulnerability within the admin template editor. Authenticated users with manage_template_access permissions can exploit the folder parameter by providing directory traversal sequences to move outside the layout director...
CVE-2026-97868
A security vulnerability has been detected in sheshbabu zen up to 1.5.0. Affected by this issue is the function dangerouslySetInnerHTML of the file features/notes/NotesEditor.jsx of the component Note Editor. The manipulation leads to cross site scripting. The attack may be initiated remotely. Th...