CVE-2026-55600

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB renders BOM validation information messages using Twig's |raw filter. These messages include translated placeholders populated with user-controlled Part names. A user who can edit a...

CVE-2026-54615

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the "Extra" column of the activity-log table /log and in element history tables. Every branch of LogEntryExtraFormatter::getInternalFormat runs...

CVE-2026-55600

Part-DB, an open source inventory management system for electronic components, is vulnerable to a cross-user stored HTML injection in versions prior to 2.12.2 . The root cause is the use of Twig's |raw filter to render BOM validation messages containing user-controlled Part names without proper e...

CVE-2026-55600 Part-DB: Stored HTML injection in BOM validation results via unescaped Part name

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB renders BOM validation information messages using Twig's |raw filter. These messages include translated placeholders populated with user-controlled Part names. A user who can edit a...

EUVD-2026-108576

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB renders BOM validation information messages using Twig's |raw filter. These messages include translated placeholders populated with user-controlled Part names. A user who can edit a...

CVE-2026-54615

The open source inventory management system Part-DB is vulnerable to stored cross-site scripting (XSS) and HTML injection prior to version 2.12.1 . The root cause is a sanitizer gap in LogEntryExtraFormatter::getInternalFormat() where the CollectionElementDeleted branch fails to escape getOldName...

CVE-2026-54615 Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap)

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the "Extra" column of the activity-log table /log and in element history tables. Every branch of LogEntryExtraFormatter::getInternalFormat runs...

EUVD-2026-108572

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the "Extra" column of the activity-log table /log and in element history tables. Every branch of LogEntryExtraFormatter::getInternalFormat runs...

CVE-2024-30956

CVE-2024-30956 cf https://www.lauyan.com/en/toweb-updates.htmliyFEw37D DOM-based XSS HTML Injection vulnerability in TOWeb version 5 eg http://127.0.0.1:8000/message.html?==gC+QHcpJ3Yz9CPpcyUThFIkV2chJWLN9ERngCdyVGbh5DdwlmcjNHP navigate to the url, the JS code is executed PS: src contains a copy ...

WordPress Integrator 1.32 - Cross-Site Scripting

A cross-site scripting vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirectto parameter to wp-login.php. id: CVE-2012-5913 info: name: WordPress Integrator 1.32 - Cross-Site Scripti...

WordPress Ultimate FAQs <= 1.8.24 – Unauthenticated HTML Content Injection

Functions/EWDUFAQImport.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection. id: CVE-2019-17233 info: name: WordPress Ultimate FAQs = 1.8.24 – Unauthenticated HTML Content Injection author: daffainfo severity: medium description: | Functions/EWDUFAQImport.ph...

osTicket < 1.10.2 - Cross-Site Scripting

Cross-site scripting XSS vulnerability in /scp/index.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "sort" parameter. id: CVE-2018-7196 info: name: osTicket 1.10.2 - Cross-Site Scripting author: ritikchaddha severity: medium...

CVE-2026-51565

CVE-2026-51565 Security Advisory for CVE-2026-51565 Description Cross-site scripting XSS vulnerability in Modules/Docs/DocsController.php in Milk admin =0.9.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter in a crafted request Mitigation At the time of...

PT-2026-121763

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to build markup, which could allow users with the author role and above to inject iframe and form elements into published pages...

PT-2026-121743

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the "Extra" column of the activity-log table /log and in element history tables. Every branch of LogEntryExtraFormatter::getInternalFormat runs...

PT-2026-121746

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB renders BOM validation information messages using Twig's |raw filter. These messages include translated placeholders populated with user-controlled Part names. A user who can edit a...

Swagger-HTML-Injection-CVE-2025-8191

https://example.com/swagger/swagger.html?configURL=https://raw.githubusercontent.com/mayank-s16/Swagger-HTML-Injection-CVE-2025-8191/refs/heads/main/test.json...

cve-disclosures

CVE Disclosures — Aman Bahiniya Three CVEs assigned by MITRE in December 2024. The records were reserved but never published, so nothing is indexed yet. This repo publishes the advisories so the CVEs become searchable and credited. CVE| Product| Type ---|---|--- CVE-2024-57551| Online Food Orderi...

Yordam-Kutuphane-Otomasyonunda-Coklu-HTML-Enjeksiyonu

Yordam-Kütüphane-Otomasyonunda-Çoklu-HTML-Enjeksiyonu CVE-2026-77818 · CVSS 3.1 6.1 Orta · Siber Güvenlik Başkanlığı · Yayımlanma 2026-09-04 · TR-26-1011 Durum: Zafiyetler v22.2 sürümünde giderilmiştir. Etkilenen kurulumların v22.2 veya üzerine yükseltilmesi gerekmektedir. Genel Bakış Yordam...

CVE-2026-64638

CVE-2026-64638 CVE-2026-64638 fast try import requests target = "http://127.0.0.1:9000/wp-login.php" payload = 'X' response = requests.posttarget, data="log": payload, "pwd": "x", timeout=5 printresponse.statuscode printresponse.text or POST /wp-login.php HTTP/1.1 Host: 127.0.0.1:9000 Content-Typ...