POC_CVE-2024-40492

CVE-2024-40492: 保存型XSSからATO（アカウント乗っ取り）へ 説明 保存型クロスサイトスクリプティング（XSS）は、Webアプリケーションで一般的に見られるセキュリティ脆弱性の一種です。攻撃者が悪意のあるスクリプトをWebアプリケーションに注入し、そのスクリプトがサーバー上に保存されることで発生します。他のユーザーが悪意のあるスクリプトを含むデータにアクセスすると、そのスクリプトがブラウザ上で実行されます。 再現手順 1. https://app.heartbeat.chat/ にアクセスします。 2. 以下の内容でアカウントを作成します： 名:...

CVE-2026-92244

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields in all versions up to, and including, 5.16.1 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2026-92244 PDF Invoices & Packing Slips for WooCommerce <= 5.16.1 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields in all versions up to, and including, 5.16.1 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2026-92244 PDF Invoices & Packing Slips for WooCommerce <= 5.16.1 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields in all versions up to, and including, 5.16.1 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2026-92244

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 5.16.1 . The root cause is insufficient input sanitization and output escaping within the Billing First Name , Last Name , and Company field...

CVE-2025-14221

説明 1. CVE-2025-14221 2. 発見者: Fatma Trabelsi 3. 製品ベンダー: SourceCodester 4. 影響を受ける製品: Online Banking System 1.0 POC アプリケーションのユーザープロファイル更新機能に、格納型クロスサイトスクリプティング（XSS）の脆弱性が存在します。アプリケーションは、名前フィールドに入力されたユーザー提供データをデータベースに保存し、複数のページで表示する前に適切にサニタイズできていません。...

CVE-2024-31027

Cross Site Scripting vulnerability in Greek Universities Network GUnet Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the last name, first name, and username parameters in the user registration functionality...

CVE-2024-31027

Cross Site Scripting vulnerability in Greek Universities Network GUnet Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the last name, first name, and username parameters in the user registration functionality...

EUVD-2024-55777

Cross Site Scripting vulnerability in Greek Universities Network GUnet Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the last name, first name, and username parameters in the user registration functionality...

CVE-2024-31027

A Cross Site Scripting (XSS) vulnerability exists in the Greek Universities Network (GUnet) Open eClass Platform v.3.15 . A remote attacker can exploit this by providing malicious input through the last name , first name , and username parameters within the user registration functionality . This ...

CVE-2022-24227-updated

CVE-2022-24227 更新 - BoltWire v8.00 - 保存型クロスサイトスクリプティング XSS 説明 CVE-2022-24227 更新 : BoltWire CMS バージョン 8.00 では、メンバー登録完了ページの First Name および Last Name フィールドも、バージョン 7.10 と同様に保存型クロスサイトスクリプティング XSS 攻撃に対して脆弱です。この種の攻撃により、悪意のあるスクリプトが実行される可能性があります。 修正提案 これらのフィールドへのユーザー入力をサニタイズしてください。 再現手順: 1 新しいメンバーを作成します。 ...

PT-2026-98385

Name of the Vulnerable Software and Affected Versions s2Member versions prior to 260829 Description Unauthenticated attackers can achieve Remote Code Execution on the server due to insufficient sanitization of the first name parameter. The plugin uses the esc refs function, which only removes reg...

PT-2026-88818

The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first name' parameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

EUVD-2026-60559

A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument firstname/lastname causes basic cross site scripting. It is possible to...

CVE-2026-70560

CVE-2026-70560 affects Ultimate POS (Stock Management & Point of Sale). A stored XSS vulnerability allows low-privileged authenticated users to inject arbitrary HTML/script by submitting a malicious payload in the user first-name field during account creation. When such a user with a low-privileg...

CVE-2026-70560 Ultimate POS Stored XSS via First Name Field in Leave Notifications

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

CVE-2026-70560 Ultimate POS Stored XSS via First Name Field in Leave Notifications

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

EUVD-2026-57170

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

CVE-2026-70560: Improper Neutralization of Input During Web Page Generation

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

EUVD-2026-52965

Cross Site Scripting vulnerability in Soliton Systems MailZen Management Protal v.2.62, v.2.63 allows a remote attacker to execute arbitrary code via the Role Name, First Name, Last Name, and Username fields...