EUVD-2026-88559

SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .sy documents with non-read-only SQL statements that execute automatically during background indexing, rendering, or export operations witho...

CVE-2026-56011-Lab

CVE-2026-56011 - MapPress Maps para WordPress: XSS no autenticado en la renderización de mapas iframe Resumen ejecutivo Este repositorio contiene un laboratorio Docker local para reproducir y validar CVE-2026-56011, una vulnerabilidad de Cross-Site Scripting no autenticado que afecta a MapPress...

CVE-2026-101091

SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .sy documents with non-read-only SQL statements that execute automatically during background indexing, rendering, or export operations witho...

CVE-2022-30929

CVE-2022-30929 CVE-2022-30929 POC Descripción sugerida Mini-Tmall v1.0 es vulnerable a Permisos inseguros a través de tomcat-embed-jasper. Tipo de vulnerabilidad Permisos inseguros Proveedor del producto github;gitee Código base del producto afectado...

CVE-2026-101091 SiYuan before v3.8.4 SQL Injection via Block Query Embed

SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .sy documents with non-read-only SQL statements that execute automatically during background indexing, rendering, or export operations witho...

Zhilly

Asistente de pentesting con IA 🛡️ Asistente de Pentesting Zhilly con IA Herramienta de ciberseguridad e interacción cibernética, portátil e impulsada por IA Herramienta portátil de ciberseguridad e interacción cibernética con inteligencia artificial 🇬🇧 Inglés • 🇹🇷 Turco • ⚡ Web Flasher 🇬🇧 Inglés /...

CVE-2026-96895

The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when rendering the block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks...

CVE-2026-96895 WP YouTube Lyte < 1.7.31 - Contributor+ Stored XSS via Embed Block Attributes

The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when rendering the block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks...

EUVD-2026-87898

The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when rendering the block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks...

CVE-2026-96895

The WP YouTube Lyte WordPress plugin (versions before 1.7.31 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to escape certain attributes of YouTube embed blocks before they are output as HTML attributes during block rendering. This flaw allows users with perm...

CVE-2026-100676

January, the media proxy/embed service of stoatchat stoatchat/stoatchat, before version 0.15.5 improperly resolves SVG values as local filesystem paths when a fetched resource is served as image/svg+xml. An unauthenticated remote attacker who causes the service to proxy an attacker-hosted SVG e.g...

CVE-2020-13094

Título: Dolibarr 11.0.3 - Cross-Site Scripting Persistente Autor: Mehmet Kelepce / Gais Cyber Security Fecha: 2020-04-14 Proveedor: https://www.dolibarr.org/ ID de autor en Exploit-DB: 8763 Explotable remotamente: Sí Lenguaje de programación dinámica: PHP Puntuación base CVSSv3: 7.4 AV:N, AC:L,...

CVE-2026-100676

The media proxy/embed service of stoatchat (stoatchat/stoatchat) before version 0.15.5 contains a vulnerability where it improperly resolves SVG values as local filesystem paths when a fetched resource is served as image/svg+xml . An unauthenticated remote attacker can exploit this via the /prox...

EUVD-2026-87649

January, the media proxy/embed service of stoatchat stoatchat/stoatchat, before version 0.15.5 improperly resolves SVG values as local filesystem paths when a fetched resource is served as image/svg+xml. An unauthenticated remote attacker who causes the service to proxy an attacker-hosted SVG e.g...

CVE-2024-50473

CVE-2024-50473 Ajar in5 Embed = 3.1.3 - Unauthenticated Arbitrary File Upload Description: The Ajar in5 Embed plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 3.1.3. This makes it possible for unauthenticated...

tomcat-embed-core-9.0.31-CVE-2020-11996

Por favor, consulte el PoC en la prueba unitaria testImplicitCloseLargeId de TestHttp2Section51.java: https://github.com/rusakovichma/tomcat-embed-core-9.0.31-CVE-2020-11996/blob/master/test/org/apache/coyote/http2/TestHttp2Section51.java...

CVE-2026-89330: Improper Neutralization of Input During Web Page Generation

The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'unique' parameter in all versions up to, and including, 4.6.5 due to insufficient input sanitization and outpu...

Security Bulletin: Apache Tomcat (tomcat-embed-websocket) — Insufficient Session Expiration via WebSocket

Summary tomcat-embed-websocket-10.1.57.jar detected by Mend scanner in db2-service-java/pom.xml. The affected version 10.1.57 is vulnerable to CVE-2026-73180 where a WebSocket session is not closed when the associated HTTP session ends after a session ID change, violating the Jakarta WebSocket...

Security Bulletin: DEV-EXT - tomcat-embed-core-10.1.57.jar (Publicly disclosed vulnerability found by Scanner)

Summary Multiple vulnerabilities reported in tomcat-embed-core-10.1.57.jar detected by Mend scanner in db2-service-java/pom.xml. The affected version 10.1.57 is vulnerable to 9 CVEs covering improper access control, authentication bypass, TOCTOU race condition, improper authorization, improper...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in tomcat-embed-core (CVE-2026-25854, CVE-2026-29129, CVE-2026-29145, CVE-2026-29146, CVE-2026-32990)

Summary IBM Db2 Developer Extension is affected by vulnerability in tomcat-embed-core CVE-2026-25854, CVE-2026-29129, CVE-2026-29145, CVE-2026-29146, CVE-2026-32990 Vulnerability Details CVEID:CVE-2026-25854 DESCRIPTION: Occasional URL redirection to untrusted Site 'Open Redirect' vulnerability i...