704 matches found
Header Footer Code Manager < 1.1.14 - Admin+ SQL Injection
The Header Footer Code Manager WordPress plugin before 1.1.14 does not validate and escape the "orderby" and "order" request parameters before using them in a SQL statement when viewing the Snippets admin dashboard, leading to SQL injections id: CVE-2021-24791 info: name: Header Footer Code Manag...
Malicious code in bnpl-blocks-desktop-bnpl-footer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6823826cd3999be6c3dac95d5731bbce9bee98ae0b7df019a3b85c97fd5d1bad The package is advertised as a UI footer component but side-loads bridge.js on require. bridge.js selects a platform-specific asset linux/darwin/win3...
CVE-2026-15404
The Lpagery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.5.7. This is due to insufficient input sanitization and output escaping in the lpageryaddfiltertexttemplatepost function, which is hooked to adminfooter and echoes the...
CVE-2026-15394
The Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'asmcode' Snippet Meta in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for...
EUVD-2026-47906
The Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'asmcode' Snippet Meta in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-15394 Header Footer Script Adder <= 2.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'asm_code' Snippet Meta
The Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'asmcode' Snippet Meta in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-15404
CVE-2026-15404 concerns the Lpagery WordPress plugin (<= 2.5.7). It enables a Stored Cross-Site Scripting (XSS) via post titles due to insufficient sanitization and output escaping in lpagery_add_filter_text_template_post(), which runs on admin_footer and echoes the raw post_title of the post ...
CVE-2026-12869
The Header Footer Builder for Elementor WordPress plugin before 1.2.1 does not require an administrative capability for its dashboard template-import action it allows any editposts user, so a Contributor can import a template containing an Elementor HTML widget configured to display site-wide,...
CVE-2026-12869
The Header Footer Builder for Elementor WordPress plugin before 1.2.1 does not require an administrative capability for its dashboard template-import action it allows any editposts user, so a Contributor can import a template containing an Elementor HTML widget configured to display site-wide,...
CVE-2026-12907
CVE-2026-12907 affects the RTMKit WordPress plugin prior to 2.0.9. The root cause is a missing capability check on a -builder AJAX action, allowing users with at least the Author role to create and activate a site-wide template that can override header, footer, or other global areas served to all...
CVE-2026-12869 Header Footer Builder for Elementor < 1.2.1 - Contributor+ Stored XSS via Template Import
The Header Footer Builder for Elementor WordPress plugin before 1.2.1 does not require an administrative capability for its dashboard template-import action it allows any editposts user, so a Contributor can import a template containing an Elementor HTML widget configured to display site-wide,...
CVE-2026-12869
The CVE-2026-12869 entry concerns the WordPress plugin Header Footer Builder for Elementor, fixed in version 1.2.1. The vulnerability arises because dashboard template-import does not require an administrative capability, allowing any user with edit_posts to import a template. An attacker with Co...
DEBIAN-CVE-2026-39897
Cacti is an open source performance and fault management framework. Versions 1.2.30 and below contain a Reflected XSS vulnerability in the htmlauthfooter. This issue has been fixed in version 1.2.31...
UBUNTU-CVE-2026-39897
Cacti is an open source performance and fault management framework. Versions 1.2.30 and below contain a Reflected XSS vulnerability in the htmlauthfooter. This issue has been fixed in version 1.2.31...
CVE-2026-39897
Cacti (open source framework) versions 1.2.30 and earlier are affected by a Reflected XSS in the html_auth_footer. The issue is fixed in version 1.2.31. CVSS metrics in the record indicate = base score 5.3 (Medium) with network attack vector, low attack complexity, no privileges or user interacti...
CVE-2026-39897 Cacti has a Reflected XSS Vulnerability via html_auth_footer
Cacti is an open source performance and fault management framework. Versions 1.2.30 and below contain a Reflected XSS vulnerability in the htmlauthfooter. This issue has been fixed in version 1.2.31...
CVE-2026-39897 Cacti has a Reflected XSS Vulnerability via html_auth_footer
Cacti is an open source performance and fault management framework. Versions 1.2.30 and below contain a Reflected XSS vulnerability in the htmlauthfooter. This issue has been fixed in version 1.2.31...
PT-2026-52130
Name of the Vulnerable Software and Affected Versions Cacti versions prior to 1.2.31 Description Cacti contains a Reflected XSS Cross-Site Scripting issue, where an attacker can execute malicious scripts in the victim's browser via the html auth footer function. Recommendations Update to version...
Exploit for CVE-2026-36239
CVE-2026-36239 CVE-2026-36239: Authenticated RCE in PbootCMS v...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: f2fs: A fix was made to avoid accessing uninitialized data in f2fssanitychecknodefooter. syzbot reported the following bug: BUG: KMSAN: Access to uninitialized data in f2fssanitychecknodefooter+0x374/0xa20; file...