ECT Home Page Products - Reflected XSS

ECT Home Page Products WordPress plugin through 1.9 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users such as admin, exploit...

CVE-2023-43877-RiteCMS-Stored-XSS---Home

Rite CMS v3.0 Múltiples XSS Almacenados Autor: Sergio Descripción: Rite CMS 3.0 está afectado por una vulnerabilidad múltiple de Cross-Site Scripting XSS almacenado que permite a los atacantes ejecutar código arbitrario mediante un payload manipulado en los campos de la página de inicio Home Page...

CVE-2025-64059

Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admins are allowed to modify templates, install plugins, and upload other executable content...

CVE-2025-66024

CVE-2025-66024: XWiki Blog Application home page vulnerable to Stored XSS via Post Title Overview...

EUVD-2025-210894

Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admins are allowed to modify templates, install plugins, and upload other executable content...

CVE-2025-64059

Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admins are allowed to modify templates, install plugins, and upload other executable content...

CVE-2025-64059

Grav 1.7.50.2 allows administrators to inject JavaScript through the Home Page editor , a potential stored XSS vector. However, the practical relevance is disputed : since admins already possess the ability to modify templates, install plugins, and upload other executable content, the additional ...

CVE-2026-58444

Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...

CVE-2026-58444 Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...

CVE-2026-58444

CVE-2026-58444 covers a bypass of personal access token scope enforcement on the Gitea repository home page (GET /{owner}/{repo}), which can disclose private repository contents. Affected: Gitea (open-source Git hosting) with token scope checks on repository home pages; root cause: deficiencies i...

CVE-2026-19209 SourceCodester Photo Share Website index.php home cross site scripting

A flaw has been found in SourceCodester Photo Share Website 1.0. The affected element is an unknown function of the file /social/index.php?page=home. This manipulation of the argument Comment causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may...

EUVD-2026-54509

A flaw has been found in SourceCodester Photo Share Website 1.0. The affected element is an unknown function of the file /social/index.php?page=home. This manipulation of the argument Comment causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may...

CVE-2026-19209

A flaw has been found in SourceCodester Photo Share Website 1.0. The affected element is an unknown function of the file /social/index.php?page=home. This manipulation of the argument Comment causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may...

GO-2026-6050 Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents in gitea.dev

Gitea: Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents in gitea.dev...

Plone 2.5.5 < 4.3.16 / 5.0.x < 5.0.10 Multiple Vulnerabilities (HF 20171128)

The version of Plone installed on the remote host is 2.5.5 prior to 4.3.16, 5.0.x prior to 5.0.10. It is, therefore, affected by the following vulnerabilities: - When you visit a page where you need to login, sends you to the login form with a 'camefrom' parameter set to the previous url...

Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

Summary A personal access token PAT or OAuth2 token that does not carry the repository scope or that is public-only is correctly rejected HTTP 403 by the recently hardened web content routes archive download, raw/media file download, and repository RSS/Atom feeds. However, the repository home pag...

GHSA-CP3Q-VRJ2-GHHH Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

Summary A personal access token PAT or OAuth2 token that does not carry the repository scope or that is public-only is correctly rejected HTTP 403 by the recently hardened web content routes archive download, raw/media file download, and repository RSS/Atom feeds. However, the repository home pag...

PYSEC-2026-2962 Products.CMFPlone XSS in profile home_page property

A member of the Plone site could set javascript in the homepage property of their profile, and have this executed when a visitor clicks the home page link on the author page...

CVE-2026-56815

pwnlift before d7a9544, in a privileged deployment, contains a symlink following vulnerability in the upload handler in Components/Pages/Home.razor...

CVE-2026-54393

A stored cross-site scripting vulnerability exists in MISP when the Overmind theme is used. The setHomePage endpoint previously saved the user-controlled path value through setSettingInternal, bypassing the normal setSetting validation logic, including validatehomepage, which requires homepage...