CVE-2026-92243 Ivory Search <= 5.5.18 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter

The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 5.5.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2005-0603-phpBB-2.0.12-Full-path-disclosure

CVE: https://vulners.com/cve/CVE-2005-0603 Neo Security Team NST® - 권고 06 - 25/02/05 프로그램: phpBB 2.0.12 홈페이지: http://www.phpbb.com 취약한 버전: phpBB 2.0.12 및 하위 버전 위험도: 낮음!! 영향: 전체 경로 공개 -==phpBB 2.0.12 전체 경로 공개==- 설명 phpBB는 강력하고, 완전히 확장 가능하며, 고도로 사용자 정의가 가능한 오픈 소스 게시판 패키지입니다. phpBB는 사용자 친화적인 인터페이스와...

Rocky Linux 8 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2025_1292)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20251292 advisory. firefox: thunderbird: Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7 CVE-2025-1017 firefox: thunderbird...

CVE

CVE CVE-2025-67586, CVE-2025-67985, CVE-2025-67986 の解説 -------------- CVE-2025-67586 Exploit PoC -------------- エクスプロイトタイトル: WordPress Plugin 5.2.0 - アクセス制御の不備 ソフトウェアリンク: https://wordpress.org/plugins/highlight-and-share/ バージョン: 説明 DLX Pluginsが開発したWordPressプラグインに、アクセス制御の不備の脆弱性が存在します。...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the highlight parameter of the search plugin due to insufficient HTML or JavaScript escaping. An attacker can execute arbitrary scripts in the context of a user's browser by enticing a victim to click a craft...

CVE-2026-100521

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript escaping. Attackers can craft malicious links with injected JavaScript in the highlight parameter that executes in the browser of any visitor...

CVE-2026-100521

Cotonti versions through 1.0.0 are vulnerable to a reflected cross-site scripting (XSS) vulnerability within the search plugin highlight parameter . The root cause is the failure to perform proper HTML or JavaScript escaping on this parameter. An attacker can craft a malicious link containing inj...

CVE-2026-100521 Cotonti through 1.0.0 Reflected XSS via search highlight parameter

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript escaping. Attackers can craft malicious links with injected JavaScript in the highlight parameter that executes in the browser of any visitor...

CVE-2026-100521 Cotonti through 1.0.0 Reflected XSS via search highlight parameter

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript escaping. Attackers can craft malicious links with injected JavaScript in the highlight parameter that executes in the browser of any visitor...

EUVD-2026-87376

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript escaping. Attackers can craft malicious links with injected JavaScript in the highlight parameter that executes in the browser of any visitor...

CVE-2026-100521 Cotonti through 1.0.0 Reflected XSS via search highlight parameter

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript escaping. Attackers can craft malicious links with injected JavaScript in the highlight parameter that executes in the browser of any visitor...

PT-2026-99147

Name of the Vulnerable Software and Affected Versions Cotonti version 1.0.0 Description A reflected cross-site scripting issue exists in the search plugin. The application fails to perform HTML or JavaScript escaping on the highlight parameter. This allows attackers to create malicious links...

PT-2026-99362

Name of the Vulnerable Software and Affected Versions Hugo versions 0.75.0 through 0.165.x Description A stored cross-site scripting issue exists because the syntax highlighter fails to escape the lineAnchors option before passing it to Chroma. This causes the value to be written verbatim into th...

CVE-2026-100521: Improper Neutralization of Input During Web Page Generation

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript escaping. Attackers can craft malicious links with injected JavaScript in the highlight parameter that executes in the browser of any visitor...

CVE-2026-86790

The WP Highlight Box WordPress plugin through 1.0 does not escape some shortcode attributes before outputting them in a page where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

WordPress WP Highlight Box plugin <= 1.0 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Pablo González and Francisco José Ramírez in WordPress Plugin WP Highlight Box versions = 1.0...

CVE-2026-86790 WP Highlight Box <= 1.0 - Contributor+ Stored XSS via highlight-box Shortcode

The WP Highlight Box WordPress plugin through 1.0 does not escape some shortcode attributes before outputting them in a page where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-86790 WP Highlight Box <= 1.0 - Contributor+ Stored XSS via highlight-box Shortcode

The WP Highlight Box WordPress plugin through 1.0 does not escape some shortcode attributes before outputting them in a page where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

EUVD-2026-76797

The WP Highlight Box WordPress plugin through 1.0 does not escape some shortcode attributes before outputting them in a page where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-86790

The WP Highlight Box WordPress plugin (versions through 1.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to escape certain shortcode attributes before they are outputted on a page where the shortcode is embedded. This flaw allows users with contributor role...