CVE-2026-93899 Better Messages <= 3.0.4 - Authenticated (Subscriber+) SQL Injection via 'group_id' Message Meta Parameter

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to generic SQL Injection via 'groupid' Message Meta Parameter in all versions up to, and including, 3.0.4 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-58000 luci-proto-openvpn - Command Injection via cl_meta Parameter in generateKey

luci-proto-openvpn through 0.11.1, fixed in commit e4ff45e, contains a command injection vulnerability in the generateKey ubus method where the clmeta parameter is interpolated into a shell command without proper escaping or quoting. An authenticated LuCI user with OpenVPN protocol configuration...

EUVD-2024-52754

Malicious code in bioql PyPI...

EUVD-2025-26072

Malicious code in bioql PyPI...

CVE-2024-55218

IceWarp Server 10.2.1 is vulnerable to Cross Site Scripting XSS via the meta parameter...

CVE-2010-3742

Multiple PHP remote file inclusion vulnerabilities in themes/default/index.php in Free Simple CMS 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the 1 meta or 2 phpincdir parameter, a different issue than CVE-2010-3307...

CVE-2024-55218

IceWarp Server 10.2.1 is vulnerable to Cross Site Scripting XSS via the meta parameter...

CVE-2024-55218

IceWarp Server 10.2.1 is vulnerable to Cross Site Scripting XSS via the meta parameter...

CVE-2024-55218: Improper Neutralization of Input During Web Page Generation

IceWarp Server 10.2.1 is vulnerable to Cross Site Scripting XSS via the meta parameter...

WordPress Plugin Custom Field Suite Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

CVE-2017-8876

Symphony 2 2.6.11 has XSS in the metanavigationgroup parameter to content/content.blueprintssections.php...

Code injection

Symphony 2 2.6.11 has XSS in the metanavigationgroup parameter to content/content.blueprintssections.php...

CVE-2017-8876

Symphony 2 2.6.11 has XSS in the metanavigationgroup parameter to content/content.blueprintssections.php...

CVE-2017-8876

CVE-2017-8876 affects Symphony CMS v2.6.11, where an XSS flaw exists in the user-controlled input of the meta[navigation_group] parameter handled by content/content.blueprintssections.php. The vulnerability enables injection of script/HTML in affected pages, consistent with cross-site scripting d...

CVE-2010-1996

Multiple cross-site scripting XSS vulnerabilities in index.php in TomatoCMS before 2.0.5 allow remote authenticated users, with certain creation privileges, to inject arbitrary web script or HTML via the 1 content parameter in conjunction with a /admin/poll/add PATHINFO, the 2 meta parameter in...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in index.php in TomatoCMS before 2.0.5 allow remote authenticated users, with certain creation privileges, to inject arbitrary web script or HTML via the 1 content parameter in conjunction with a /admin/poll/add PATHINFO, the 2 meta parameter in...

CVE-2010-1996: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in index.php in TomatoCMS before 2.0.5 allow remote authenticated users, with certain creation privileges, to inject arbitrary web script or HTML via the 1 content parameter in conjunction with a /admin/poll/add PATHINFO, the 2 meta parameter in...