CVE-2023-28467

MyBB 1.8.33 User CP 이메일 지속형 XSS root@kitploit: - MyBB 1.8.33 User CP email persistent XSS - Mybb version "@cve.com 해결 방법 MyBB 버전 1.8.34 이상으로 업그레이드하십시오...

CVE-2025-29471

Vulnerabilità di XSS Memorizzata in Nagios Log Server Escalation dei privilegi ad Admin ▶️ Demo PoC Data: 2025-04-02 Autore dell'exploit: Seth Kraft Homepage del fornitore: https://www.nagios.com/ Changelog del fornitore: https://www.nagios.com/changelog/log-server Link del software:...

CVE-2019-13051

Pi-Hole 4.3.2 Iniezione di Comandi e Escalation dei Privilegi CVE-2019-13051 La versione 4.3.2 di Pi-Hole contiene una patch per questa vulnerabilità:https://github.com/pi-hole/AdminLTE/pull/974 Un grande ringraziamento al team di sviluppo di Pi-Hole per il loro fantastico progetto e per aver res...

CVE-2023-49973

CVE-2023-49973 Customer Support System 1.0 – Cross-Site-Scripting XSS-Schwachstelle im „email“-Feld/-Parameter auf der Seite „customerlist“ Beschreibung : Customer Support System 1.0 ist anfällig für gespeichertes XSS. Eine XSS-Schwachstelle existiert in Version 1 des Customer Support Systems. Ei...

CVE-2026-11113-SMTP-Header-Injection-in-Contact-Form

CVE-2026-11113 – संपर्क फ़ॉर्म में SMTP हेडर इंजेक्शन प्रोग्राम कोड Python root@kitploit: contactformserver.py - Mails feedback without sanitizing headers from flask import Flask, request import smtplib app = Flaskname @app.route'/contact', methods='POST' def contact: sender = request.form'email'...

CVE-2024-25412

CVE-2024-25412 Una vulnerabilità di cross-site scripting XSS in Flatpress v1.3 consente agli aggressori di eseguire script web arbitrari o HTML tramite un payload appositamente creato iniettato nel campo email. Tipo di vulnerabilità: Cross Site Scripting XSS Fornitore del prodotto:...

EUVD-2026-55636

Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. When an authenticated user follows another account, getfollowing includes the followed user's email field in the API response alongside their name, user ID, and follow date. Becaus...

CVE-2026-16143

The VikRentItems – Flexible Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer email field of the booking checkout form in versions up to, and including, 1.2.1. This is due to insufficient input sanitization and output escaping in the...

CVE-2026-16143

Vulnerability: CVE-2026-16143 affects VikRentItems Flexible Rental Management System

EUVD-2026-53036

The VikRentItems – Flexible Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer email field of the booking checkout form in versions up to, and including, 1.2.1. This is due to insufficient input sanitization and output escaping in the...

CVE-2026-16143

The VikRentItems – Flexible Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer email field of the booking checkout form in versions up to, and including, 1.2.1. This is due to insufficient input sanitization and output escaping in the...

CVE-2026-16143 VikRentItems Flexible Rental Management System <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting

The VikRentItems – Flexible Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer email field of the booking checkout form in versions up to, and including, 1.2.1. This is due to insufficient input sanitization and output escaping in the...

CVE-2026-12761 miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.7.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Profile Completion OTP Flow

The miniOrange Social Login and Register Discord, Google, Twitter, LinkedIn plugin for WordPress is vulnerable to authentication bypass leading to account takeover in versions up to and including 7.7.0. This is due to the Profile Completion flow accepting an arbitrary email address via the...

CVE-2026-6820

CVE-2026-6820: The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the email parameter in all versions up to 1.8.8 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts in ...

CVE-2026-13567

A security flaw has been discovered in code-projects Online Music Site 1.0. This affects an unknown part of the file /Frontend/Feedback.php of the component POST Request Handler. The manipulation of the argument fname/femail/faddress/fmessage results in cross site scripting. The attack may be...

EUVD-2026-40082

A security flaw has been discovered in code-projects Online Music Site 1.0. This affects an unknown part of the file /Frontend/Feedback.php of the component POST Request Handler. The manipulation of the argument fname/femail/faddress/fmessage results in cross site scripting. The attack may be...

GO-2026-5626 Ech0 comment model's Email field returned on public /api/comments endpoints in github.com/lin-snow/ech0

Ech0 comment model's Email field returned on public /api/comments endpoints in github.com/lin-snow/ech0...

EUVD-2026-38634

FlatPress versions prior to commit 10be83c, contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are rendered without proper output encoding in Smarty templates. Attackers can inject arbitrary HTML and JavaScript through these fields ...

CVE-2026-56785 FlatPress - Stored Cross-Site Scripting via Unescaped Comment and Contact Form Fields

FlatPress contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are rendered without proper output encoding in Smarty templates. Attackers can inject arbitrary HTML and JavaScript through these fields to execute malicious scripts in...

CVE-2026-56215 Capgo - Account Merge via Poisoned public.users.email in SSO Provisioning

Capgo before 12.128.12 allows authenticated users to modify their mutable public.users.email to arbitrary addresses, which the SSO provisioning endpoint trusts as an account-merge key. Attackers can pre-position their account with a victim's corporate SSO email, causing the provision-user endpoin...