CVE-2026-83541

The Sina Extension for Elementor WordPress plugin before 3.10.4 does not properly escape a Table widget setting before outputting it within an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

EUVD-2026-74720

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.9 does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rendered markup, allowing users with contributor-level access an...

CVE-2026-83541

The Sina Extension for Elementor WordPress plugin (versions 3.7.1 through 3.10.3) contains a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is a Table widget setting that is not properly escaped before being output within an HTML attribute. An attacker with the Contributor role o...

CVE-2026-83541 Sina Extension for Elementor 3.7.1 - 3.10.3 - Contributor+ Stored XSS via Table Widget

The Sina Extension for Elementor WordPress plugin before 3.10.4 does not properly escape a Table widget setting before outputting it within an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-33657

CVE-2026-33657 - EspoCRM 9.3.3 Stored HTML Injection in Email Notifications Authenticated proof-of-concept for stored HTML injection in EspoCRM 9.3.3 email notifications. Summary EspoCRM 9.3.3 renders stream-note notification emails by transforming the note body with Markdown and inserting the...

CVE-2024-22640

CVE-2024-22640 漏洞类型 正则表达式拒绝服务（ReDoS） 受影响产品及版本 TCPDF convertHTMLColorToDec'"t"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000!',$ref; ? 注意：在漏洞代码行之后使用 preglasterror 检查，正则表达式将以 PREGBACKTRACKLIMITERROR 退出。...

firefox: thunderbird: Use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...

CVE-2025-63420

CVE-2025-63420 CrushFTP11 11.3.757 之前版本存在存储型 HTML 注入漏洞，位于 CrushFTP 管理面板（报表 / "Who Created Folder"），可在管理员会话中实现持久化 HTML 执行。 CWE CWE-79 — 输入在网页生成过程中未正确中和（跨站脚本） CVSS v3.1 基础分：4.1（中危） root@kitploit: AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N 已修复版本 根据厂商变更日志（ https://crushftp.com/version11build.html ），11.3.757...

CVE-2022-30781

🍵 CVE-2022-30781 Gitea repository migration remote command execution exploit. How to use 1. Run an HTTP filesystem server with the files in this repository. 2. Edit the command to be exeucted in api/v1/repos/e99/exp/pulls/1/index.html L96. 3. Migrate remote repository with URL http:///e99/exp on...

CVE-2026-87624

A flaw was found in Google Chrome on Android. A remote attacker, after compromising the renderer process, could exploit a user interface UI misrepresentation vulnerability. This vulnerability allows the attacker to spoof UI elements by using a specially crafted HTML page, potentially deceiving...

CVE-2026-87630

A flaw was found in WebRTC in Chromium-browser. A remote attacker could exploit an integer overflow vulnerability by enticing a user to visit a specially crafted HTML page. This could allow the attacker to read sensitive memory within the browser's sandbox environment...

CVE-2026-87521

A flaw was found in WebMCP in Chromium. A remote attacker, after compromising the renderer process, could exploit this vulnerability by crafting a malicious HTML page. This could lead to an information leak, allowing the attacker to obtain sensitive cross-origin data...

CVE-2026-87451

A flaw was found in Google Chrome. This information leak vulnerability in the Downloads component allows a remote attacker, who has already compromised the browser's renderer process, to obtain sensitive cross-origin data. This can be achieved by enticing a user to visit a specially crafted HTML...

CVE-2026-87439

A flaw was found in chromium-browser's ServiceWorker. A remote attacker, who has already compromised the renderer process, could exploit this vulnerability by providing a specially crafted HTML page. This could lead to an information leak, allowing the attacker to obtain sensitive information...

CVE-2026-87453

A flaw was found in chromium-browser's BackgroundFetch component. A remote attacker, who has already compromised the renderer process, could exploit a confused deputy vulnerability by using a specially crafted HTML page. This could lead to the disclosure of sensitive information...

CVE-2026-87538

A flaw was found in Chromium. A remote attacker, after compromising the renderer process and leveraging social engineering, could exploit a clickjacking vulnerability in the input mechanism. This could allow the attacker to spoof user interface UI elements via a specially crafted HTML page,...

CVE-2026-87543

A flaw was found in Google Chrome. A remote attacker who has compromised the renderer process can exploit a missing authorization vulnerability by crafting a malicious HTML page. This allows them to bypass site isolation, which is a security mechanism designed to protect user data and prevent...

CVE-2026-87653

A flaw was found in chromium-browser. A remote attacker could exploit this vulnerability by crafting a malicious HTML page. This could lead to user interface UI misrepresentation in FullScreen mode, allowing the attacker to spoof UI elements...

CVE-2026-87620

A flaw was found in Google Chrome. A remote attacker could exploit an observable discrepancy in the Scalable Vector Graphics SVG rendering engine by enticing a user to open a specially crafted HTML page. This could lead to the disclosure of sensitive information...

CVE-2026-87634

A flaw was found in Chromium. A use-after-free vulnerability exists in the WebPackaging component. A remote attacker could exploit this by enticing a user to open a specially crafted HTML page. This could potentially lead to arbitrary code execution outside of the sandbox...