CVE-2026-14207 LifterLMS < 10.0.10 - Instructor+ Stored XSS via Featured Pricing Information

The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course...

CVE-2026-14207

The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course...

CVE-2026-17910

Insufficient policy enforcement in NFC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

PT-2026-66229

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 151.0.7922.72 Description Insufficient policy enforcement in the Near Field Communication NFC implementation allows a remote attacker to leak cross-origin data through a crafted HTML page. Cross-origi...

PT-2026-66379

The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course...

PT-2026-66368

The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and escape one of its form field configuration settings before outputting it inside an inline script when a form is rendered, which could allow users with a role as low as Contributor with delegated form-management permission, and...

CVE-2026-11881: Improper Neutralization of Input During Web Page Generation

The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and escape one of its form field configuration settings before outputting it inside an inline script when a form is rendered, which could allow users with a role as low as Contributor with delegated form-management permission, and...

CVE-2026-14207: Improper Neutralization of Input During Web Page Generation

The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course...

CVE-2025-65342: Improper Neutralization of Input During Web Page Generation

code-projects Blood System 1.0 is vulnerable to Cross Site Scripting XSS in /don.php via the city field...

PT-2026-66223

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 151.0.7922.72 Description Insufficient policy enforcement in the Near Field Communication NFC component allows a remote attacker to leak cross-origin data through a crafted HTML page. Cross-origin dat...

PT-2026-66579

Name of the Vulnerable Software and Affected Versions code-projects Blood System version 1.0 Description Cross Site Scripting XSS occurs in the '/don.php' endpoint through the city field. XSS is a flaw that allows an attacker to inject malicious scripts into web pages viewed by other users...

EUVD-2025-210559

code-projects Blood System 1.0 is vulnerable to Cross Site Scripting XSS in /don.php via the city field...

CVE-2025-65342

code-projects Blood System 1.0 is vulnerable to Cross Site Scripting XSS in /don.php via the city field...

CVE-2025-65342

The code-projects Blood System 1.0 is vulnerable to Cross-Site Scripting (XSS) . The flaw exists in the /don.php page, specifically when processing the city field due to improper neutralization of input during web page generation. While technical details regarding the root cause and remediation a...

CVE-2025-65342

code-projects Blood System 1.0 is vulnerable to Cross Site Scripting XSS in /don.php via the city field...

undici: Undici: Cookie attribute injection allows bypassing security protections

A flaw was found in undici, where its setCookie function does not fully sanitize cookie attributes. A remote attacker could exploit this by providing specially crafted input to the domain or unparsed fields, leading to the injection of additional cookie attributes. This vulnerability can allow an...

CVE-2025-65337

Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting XSS in pageEditMember.php via the address field...

CVE-2026-13309

Affected product : Autel MaxiCharger AC Elite Home NFC interface. Vulnerability : stack-based buffer overflow in NFC card response handling that can lead to arbitrary code execution . Impact : attacker with physical access can execute code on the device, with full control in its context; benefits...

EUVD-2026-50558

Autel MaxiCharger AC Elite Home NFC Stack-based Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to...

CVE-2026-13309

Autel MaxiCharger AC Elite Home NFC Stack-based Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to...