CVE-2026-85129 Hoo Companion 1.0.2 - Unauthenticated Stored XSS via Theme Settings Import

The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated attackers to inject arbitrary web scripts which wi...

CVE-2026-81429 Export & Import WPBakery Page Builder <= 1.0.2 - Stored XSS via CSRF

The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 does not perform any CSRF check on its template-import feature and does not sanitise the imported data before storing it and echoing it back, allowing attackers to make a logged-in administrator import a crafted template via...

PT-2026-89268

The Easy Google Fonts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the control selectors meta field in all versions up to, and including, 2.0.4. This is due to the plugin registering the control selectors meta field with show in rest enabled but without a sanitize callbac...

CVE-2023-29808

漏洞标题：反射型跨站脚本（Reflected Cross Site Scripting） Google Dork： 日期：27.04.2023 漏洞作者：Lucas Noki 0xPrototype 厂商主页：https://github.com/vogtmh 软件链接：https://github.com/vogtmh/cmaps 版本：8.0 测试环境：Mac、Windows、Linux CVE：CVE-2023-29808 描述： 所发现的漏洞为反射型跨站脚本。当向 /index.php?map=overview&findme= 端点发送请求，且其中的 "findme"...

CVE-2025-57298

通过不安全的 Markdown 渲染导致的存储型 XSS 漏洞（Kotaemon） 概述 Kotaemon 是一个基于 RAG（检索增强生成）的开源文档问答系统，提供 Web 界面用于查询上传的 PDF、Word 和 Excel 等文件。 Kotaemon 的文档渲染管道中存在一个存储型跨站脚本（XSS）漏洞。 用户控制的内容经过 LLM 处理后，在 Markdown 到 HTML 的转换过程中未进行适当的清理，从而允许攻击者提供的 HTML 元素被持久性地注入到页面中。 当上传一份文档时，系统会自动触发一个摘要请求（例如“summary this...

CVE-2026-78545

The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The unsanitized value is interpolated into an nginx server block directive, resulting in execution of injected directives...

CVE-2026-86712

SiYuan before 3.8.2 is an Electron-based note-taking application vulnerable to Remote Code Execution via its clipboard paste handler. The root cause is that SiYuan trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler (app/src/protyle/util/paste....

EUVD-2026-71856

The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

EUVD-2026-69858

The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape content submitted by unauthenticated visitors before storing it and outputting it in an admin area page, and the escaping it does apply is undone by a subsequent decoding step, leading to Stored XSS which will execute i...

CVE-2026-84189 LibreNMS before 26.7.0 Stored XSS via Oxidized API

LibreNMS through 26.4.0 renders JSON fields name, ip, model, author, commit message returned by the admin-configurable Oxidized integration URL oxidized.url into the device showconfig page without applying htmlspecialchars. An administrator who points the Oxidized URL at an attacker-controlled...

CVE-2026-81524

A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have...

Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver

A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have...

EUVD-2026-66804

yx-image-recognition v1.0 is vulnerable to Path Traversal. Parameters such as dir, filePath are directly passed to new File for file system operations without any path sanitization or whitelist validation...

GHSA-W2X5-GV52-9CCV Sakai Conversations has a Stored XSS Issue

Summary The Sakai Conversations tool stores topic and post messages without HTML sanitization, and the frontend renders them using LitElement's unsafeHTML directive, resulting in stored cross-site scripting XSS. Any authenticated user with access to a site that has the Conversations tool enabled...

CVE-2026-65611

nnn does not sanitize the path variable. An attacker can create a directory on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim enters that directory in nnn and uses the batch copy or move workflow, the...

PT-2026-78482

Name of the Vulnerable Software and Affected Versions Grav API Plugin versions prior to 1.0.2 Description The plugin fails to invoke the Security::sanitizeSVG function within the HandlesMediaUploads::processUploadedFile function when processing the 'POST /api/v1/media' endpoint. While the SVG...

GHSA-M283-3H24-438V VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE

Affected: vm2 = 3.11.3 CVSS 3.1: 9.9 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CWE: CWE-693 Protection Mechanism Failure Prerequisite: Embedder exposes a host function that throws an Error with .cause referencing a powerful host object e.g., process Summary I found that handleException in...

CVE-2026-72576 Bludit - Stored Cross-Site Scripting via Malicious SVG Logo Upload

A stored cross-site scripting XSS vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user Author role to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo...

CVE-2026-38446

Summary of CVE-2026-38446 : The vulnerability exists in osTicket 1.18.3 due to improper sanitization of the thread entry title field. User-controlled input in the title is stored without adequate HTML escaping and later rendered in multiple staff-facing templates without proper output encoding. T...

Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS

Summary Easy!Appointments allows administrators to define a custom "booking disabled" message through the booking settings page. That value is stored in the disablebookingmessage setting via a rich-text editor and later passed directly to the public bookingmessage view without escaping or...