CVE-2026-81820

Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: object UUID; object name; attribute value; attribute type; comment; first/last seen values; IDS flag. Those values were concatenated directly into HTML strings before rendering. The...

CVE-2026-81698 openssl_encrypt before 1.4.9 Shell Injection via info command

opensslencrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like peppername containing shell commands that execute when users copy the...

CVE-2026-81698

openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block . The root cause is that untrusted metadata fields (such as pepper_name) are interpolated without quoting, allowing an attacker to craft metadata values containing shell com...

CVE-2018-1000529

CVE-2018-1000529 NVD CVE-2018-1000529: https://nvd.nist.gov/vuln/detail/CVE-2018-1000529 MITRE CVE-2018-1000529: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-1000529 XSS persistente nel plugin Grails Fields =2.2.7 Questo repository è stato utilizzato per dimostrare una proof of concept del...

EUVD-2026-67131

Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: object UUID; object name; attribute value; attribute type; comment; first/last seen values; IDS flag. Those values were concatenated directly into HTML strings before rendering. The...

CVE-2021-43032

CVE-2021-43032 In XenForo ≤ 2.2.7, un attore malintenzionato con accesso al pannello di amministrazione può salvare payload di cross-site scripting in qualsiasi funzione dell'applicazione che accetta codice HTML. Un payload inserito nella funzionalità 'Advertising' verrà eseguito globalmente sul...

CVE-2026-77035

Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager 5.0.1 - A registered user with edit-own rights the eventowner=1 setting or core.edit.own can POST another user's record id together with their own id as createdby and...

CVE-2026-77035

Joomla Event Manager (joomlaeventmanager.net) versions prior to 5.0.1 are affected by a cross-user event and venue takeover vulnerability. A registered user with edit-own rights (via the eventowner=1 setting or core.edit.own permission) can forge form fields by POSTing another user's record ID to...

CVE-2026-77035 Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager < 5.0.1

Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager 5.0.1 - A registered user with edit-own rights the eventowner=1 setting or core.edit.own can POST another user's record id together with their own id as createdby and...

EUVD-2026-66863

Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager 5.0.1 - A registered user with edit-own rights the eventowner=1 setting or core.edit.own can POST another user's record id together with their own id as createdby and...

CVE-2026-13152

CVE-2026-13152: Escalação de Privilégios Não Autenticada no Custom Fields Account Registration For WooCommerce 1.4 -blue.svg 📖 Visão Geral do Advisory O CVE-2026-13152 é uma vulnerabilidade de escalação de privilégios não autenticada que afeta o plugin Custom Fields Account Registration For...

A-potential-Denial-of-Service-issue-in-protobuf-java

Ein potenzielles Denial-of-Service-Problem in protobuf-java Ein potenzielles Denial-of-Service-Problem in protobuf-java mit hoher Schwere, von GitHub geprüft, veröffentlicht vor 5 Tagen in protocolbuffers/protobuf • Aktualisiert gestern Details zur Sicherheitslücke Dependabot-Alerts 2 Paket...

CVE-2026-22849

CVE-2026-22849: Saleor verfügt nicht über eine ordnungsgemäße HTML-Bereinigung für Rich-Text-Felder Übersicht...

trappsec

trappsec trappsec è un framework open-source che aiuta gli sviluppatori a rilevare gli attaccanti che sondano la logica di business delle API. Incorporando percorsi esca realistici e campi di miele difficili da distinguere dalle vere costruzioni API, gli attaccanti vengono spinti ad autenticarsi ...

CVE-2025-56772

Beschreibung Bei der Analyse der Website ecodotempo.com.br wurde eine gespeicherte Cross-Site-Scripting XSS-Sicherheitslücke entdeckt. Diese Schwachstelle ermöglicht es einem Angreifer, bösartige Skripte in Felder einzuschleusen, die später anderen Benutzern ohne ordnungsgemäße Bereinigung...

CVE-2021-39476

CVE-2021-39476 Mehrere XSS-Schwachstellen in PhoenixCart 1.0.8.0 gefunden 2x XSS auf derselben Seite "Titel der Kategorie für SEO bearbeiten:" "Beschreibung der Kategorie bearbeiten" Link: https://www.warcloudsecurity.com/ecommerce/index.php?cPath=1...

EUVD-2026-66766

LimeSurvey Community Edition 7.0.5 contains an authenticated stored cross-site scripting vulnerability in the replacement-fields dialog used by the administrative question editor.This issue affects LimeSurvey: 7.0.5...

CVE-2026-65930

LimeSurvey Community Edition 7.0.5 contains an authenticated stored cross-site scripting vulnerability in the replacement-fields dialog used by the administrative question editor.This issue affects LimeSurvey: 7.0.5...

CVE-2025-65300

CVE-2025-65300 Beschreibung CVE-2025-65300: Gespeicherte Cross-Site-Scripting-Schwachstelle XSS in der Coohom-SaaS-Plattform Offenlegungsdatum: 2025-10-28 Zuletzt aktualisiert: 2025-10-28 Reporter: Phisit Pupiw Anbieter: Coohom CWE: CWE-79 – Cross-Site Scripting Zusammenfassung Im Modul...

CVE-2026-65930

LimeSurvey Community Edition 7.0.5 is affected by an authenticated stored cross-site scripting vulnerability in the replacement-fields dialog within the administrative question editor. An attacker with low privileges can inject a persistent script that executes in the context of other users who i...