vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries

A flaw in Vim's netrw plugin fails to sanitize special characters in directory paths when creating GUI menu entries. Browsing or bookmarking a maliciously crafted path in GUI Vim allows attackers to execute arbitrary OS commands as the running user...

vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries

A flaw in Vim's netrw plugin fails to sanitize special characters in directory paths when creating GUI menu entries. Browsing or bookmarking a maliciously crafted path in GUI Vim allows attackers to execute arbitrary OS commands as the running user...

vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries

A flaw in Vim's netrw plugin fails to sanitize special characters in directory paths when creating GUI menu entries. Browsing or bookmarking a maliciously crafted path in GUI Vim allows attackers to execute arbitrary OS commands as the running user...

WordPress HT Menu plugin < 1.2.7 - Subscriber+ Stored XSS vulnerability

Subscriber+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin HT Menu versions 1.2.7...

CVE-2026-84935

The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permissions such as Subscribers to store JavaScript that...

CVE-2026-84935

The HT Menu WordPress plugin (versions before 1.2.7 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The vulnerability exists because the plugin fails to perform capability or object-ownership checks when saving navigation menu-item settings and fails to escape stored settings during ...

CVE-2026-84935 HT Menu < 1.2.7 - Subscriber+ Stored XSS via Menu Settings

The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permissions such as Subscribers to store JavaScript that...

CVE-2026-84935 HT Menu < 1.2.7 - Subscriber+ Stored XSS via Menu Settings

The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permissions such as Subscribers to store JavaScript that...

EUVD-2026-71874

The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permissions such as Subscribers to store JavaScript that...

CVE-2026-84935: Improper Neutralization of Input During Web Page Generation

The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permissions such as Subscribers to store JavaScript that...

PT-2026-86358

Name of the Vulnerable Software and Affected Versions HT Menu WordPress plugin versions prior to 1.2.7 Description Insufficient input sanitization and output escaping allow authenticated users with minimal permissions, such as Subscribers, to perform Stored Cross-Site Scripting XSS. The plugin...

CVE-2026-19081

Missing Authorization vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Gastromenum Ticket and QR Menu System: before 2026.08.31...

CVE-2026-19081 Missing Authorization Allows Unauthorized Access to Critical POS Functions in Gastromenum's Gastromenum Ticket and QR Menu System

Missing Authorization vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Gastromenum Ticket and QR Menu System: before 2026.08.31...

CVE-2026-19081

CVE-2026-19081 is a Missing Authorization vulnerability in Gastromenum Ticket and QR Menu System , a point-of-sale (POS) and QR menu product. The flaw allows an authenticated low-privilege network user to access functionality not properly constrained by ACLs, specifically enabling unauthorized ac...

CVE-2026-19081 Missing Authorization Allows Unauthorized Access to Critical POS Functions in Gastromenum's Gastromenum Ticket and QR Menu System

Missing Authorization vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Gastromenum Ticket and QR Menu System: before 2026.08.31...

EUVD-2026-71104

Missing Authorization vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Gastromenum Ticket and QR Menu System: before 2026.08.31...

CVE-2026-19057 Stored XSS in Gastromenum's Gastromenum Ticket and QR Menu System

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Stored XSS. This issue affects Gastromenum Ticket and QR Menu System: before 2026.08.31...

CVE-2026-19057 Stored XSS in Gastromenum's Gastromenum Ticket and QR Menu System

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Stored XSS. This issue affects Gastromenum Ticket and QR Menu System: before 2026.08.31...

EUVD-2026-71103

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Stored XSS. This issue affects Gastromenum Ticket and QR Menu System: before 2026.08.31...

CVE-2026-19057

Gastromenum Ticket and QR Menu System is affected by a Stored Cross-Site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The flaw affects versions before 2026.08.31 . The CNA-assigned CVSS 3.1 score is 5.4 (Medium) , with an attack vector of ne...