dh-CVE_2016_2098

== README Proof of concept for https://groups.google.com/forum/!topic/rubyonrails-security/ly-IH-fxrQ == Exploiting: 1. You should only run rails server in a way that you are certain will not open you up to being exploited 2. Run rails s 3. Execute the following command curl -v -H "Accept:...

CVE-2026-88942

The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'wpffid' JSON Parameter in all versions up to, and including, 3.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...

EUVD-2026-114606

The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'wpffid' JSON Parameter in all versions up to, and including, 3.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...

CVE-2026-88942 Product Filter for WooCommerce by WBW <= 3.4.6 - Reflected Cross-Site Scripting via 'wpf_fid' JSON Parameter

The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'wpffid' JSON Parameter in all versions up to, and including, 3.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...

CVE-2026-88942 Product Filter for WooCommerce by WBW <= 3.4.6 - Reflected Cross-Site Scripting via 'wpf_fid' JSON Parameter

The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'wpffid' JSON Parameter in all versions up to, and including, 3.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...

CVE-2026-88942

The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 3.4.6 . The root cause is insufficient input sanitization and output escaping of the 'wpf_fid' JSON Parameter . Specifically, while a patch was ...

CVE-2026-88942: woobewoo Product Filter for WooCommerce by WBW: The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via…

The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'wpffid' JSON Parameter in all versions up to, and including, 3.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...

PT-2026-134462

Name of the Vulnerable Software and Affected Versions Product Filter for WooCommerce by WBW versions prior to 3.4.7 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when an attacker tricks a user...

CVE-2026-16146 Invisible Anti-Spam & CAPTCHA <= 5.1 - Authenticated (Editor+) SQL Injection via Pattern JSON Keys/Values

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via Pattern JSON Keys/Values in all versions up to, and including, 5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation...

CVE-2026-73618 Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter

Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query write permission can inject JSON...

CVE-2026-73618 Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter

Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query write permission can inject JSON...

CVE-2026-73618

Budibase Server prior to 3.40.0 is affected by a NoSQL injection in the MongoDB query execution endpoint. User-supplied parameters are interpolated into JSON query templates without sanitizing JSON metacharacters, allowing attackers with query write permission to inject JSON structural characters...

WordPress Jannah Theme <5.4.4 - Cross-Site Scripting Detection

WordPress Jannah theme before 5.4.4 contains a reflected cross-site scripting vulnerability. It does not properly sanitize the options JSON parameter in its tiegetuserweather AJAX action before outputting it back in the page. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Jannah theme...

Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution

Summary Budibase's MongoDB query execution endpoint POST /api/v2/queries/:queryId is vulnerable to NoSQL injection through user-supplied query parameters. The enrichContext function interpolates parameter values into JSON query templates using Handlebars with noEscaping: true, then parses the...

CVE-2026-13119

The Registrations For The Events Calendar plugin for WordPress (

CVE-2026-13119 Registrations for the Events Calendar <= 3.2 - Authenticated (Contributor+) SQL Injection via 'standard' Parameter

The Registrations For The Events Calendar plugin for WordPress is vulnerable to SQL Injection via JSON keys in the 'standard' parameter handled by the rtecrecordsedit AJAX action in versions up to and including 3.2. The handler decodes attacker-controlled JSON from $POST'standard' and uses the JS...

EUVD-2021-11277

Malware in sbrugna...

PT-2025-23226 · Vllm · Vllm

Name of the Vulnerable Software and Affected Versions: vLLM versions 0.8.0 through 0.9.0 Description: The issue arises when the /v1/completions API endpoint is hit with an invalid json schema as a Guided Param, causing the vLLM server to crash. This is similar to a previously known issue but...

CVE-2024-12766: Server-Side Request Forgery (SSRF)

parisneo/lollms-webui version V13 feather suffers from a Server-Side Request Forgery SSRF vulnerability in the POST /api/proxy REST API. Attackers can exploit this vulnerability to abuse the victim server's credentials to access unauthorized web resources by specifying the JSON parameter...

OFCMS Cross-Site Script Vulnerabilities

OFSoft OFCMS is a content management system CMS developed by China Zhongtian Network OFSoft using Java language. OFCMS version 1.1.2 cross-site scripting vulnerability, the vulnerability stems from the file /admin/system/dict/add.json?sqlid=system.dict.save parameter dictvalue on the user-supplie...