CVE-2026-7004 WIT SynApps Runtime 1.4.11 Reflected XSS via LINK Parameter

WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject and execute arbitrary JavaScript by submitting a crafted LINK query parameter to the /System/Session-1 endpoint. Attackers can exploit this...

CVE-2026-7004

WIT SynApps Runtime versions through 1.4.11 are vulnerable to a pre-authentication reflected cross-site scripting (XSS) flaw. The issue is caused by insufficient neutralization of the LINK query parameter on the /System/Session-1 endpoint, allowing unauthenticated attackers to execute arbitrary J...

CVE-2024-27954

CVE-2024-27954 - WordPress wp-automatic Plugin LFI Scanner This project provides a Python-based Local File Inclusion LFI vulnerability scanner targeting CVE-2024-27954 , a critical flaw found in the WordPress plugin wp-automatic. The vulnerability allows unauthenticated attackers to read arbitrar...

PT-2026-126370

REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page, where the opener link parameter is rendered without HTML escaping. Unauthenticated attackers can lure logged-in backend users with media permissions into clicking a crafted link. Th...

CVE-2026-93649

In the Eclipse Adoptium website adoptium.net, in every deployment built from commit 0b24ea1 2025-06-18 up to the fix in commit cbb53cf 2026-09-24, the post-download page /locale/download takes a download URL from the "link" query parameter and automatically navigates to it with a meta...

EUVD-2026-102088

In the Eclipse Adoptium website adoptium.net, in every deployment built from commit 0b24ea1 2025-06-18 up to the fix in commit cbb53cf 2026-09-24, the post-download page /locale/download takes a download URL from the "link" query parameter and automatically navigates to it with a meta...

CVE-2026-93649

The Eclipse Adoptium website (adoptium.net) is vulnerable to an Open Redirect and Download of Code Without Integrity Check in deployments built from commit 0b24ea1 (2025-06-18) through cbb53cf (2026-09-24). The issue resides in the /[locale]/download post-download page, which accepts a URL via th...

CVE-2026-93649: Download of Code Without Integrity Check

In the Eclipse Adoptium website adoptium.net, in every deployment built from commit 0b24ea1 2025-06-18 up to the fix in commit cbb53cf 2026-09-24, the post-download page /locale/download takes a download URL from the "link" query parameter and automatically navigates to it with a meta...

CVE-2026-85158

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comment with zero escaping. Attackers can close the comment with -- and inject arbitrary JavaScript that executes when victims visit the crafte...

CVE-2026-85158

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comment with zero escaping. Attackers can close the comment with -- and inject arbitrary JavaScript that executes when victims visit the crafte...

CVE-2026-85158

AVideo through commit c91b5975d is affected by a reflected cross-site scripting (XSS) vulnerability in videoEmbeded.php . The root cause is that the link parameter is echoed inside an HTML comment with zero escaping , allowing an attacker to close the comment with --> and inject arbitrary Java...

CVE-2026-85158 AVideo Reflected XSS via videoEmbeded.php link parameter

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comment with zero escaping. Attackers can close the comment with -- and inject arbitrary JavaScript that executes when victims visit the crafte...

CVE-2026-85158 AVideo Reflected XSS via videoEmbeded.php link parameter

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comment with zero escaping. Attackers can close the comment with -- and inject arbitrary JavaScript that executes when victims visit the crafte...

CVE-2026-85158 AVideo Reflected XSS via videoEmbeded.php link parameter

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comment with zero escaping. Attackers can close the comment with -- and inject arbitrary JavaScript that executes when victims visit the crafte...

PT-2026-84990

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comment with zero escaping. Attackers can close the comment with -- and inject arbitrary JavaScript that executes when victims visit the crafte...

CVE-2026-85158: Improper Neutralization of Input During Web Page Generation

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comment with zero escaping. Attackers can close the comment with -- and inject arbitrary JavaScript that executes when victims visit the crafte...

CVE-2026-2445

CVE-2026-2445 involves a reflected cross-site scripting (XSS) flaw in multiple WSO2 products where user-supplied input in a URL parameter is rendered without proper sanitization/encoding. The underlying issue is unsafe handling of URL parameters that can inject malicious JavaScript, enabling brow...

CVE-2026-4653

The Block, Suspend, Report for BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' parameter in versions up to and including 3.6.4. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with...

CVE-2026-4653 Block, Suspend, Report for BuddyPress <= 3.6.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link' Parameter

The Block, Suspend, Report for BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' parameter in versions up to and including 3.6.4. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with...

CVE-2026-4653 Block, Suspend, Report for BuddyPress <= 3.6.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link' Parameter

The Block, Suspend, Report for BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' parameter in versions up to and including 3.6.4. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with...