CVE-2023-44813

CVE-2023-44813 mooSocial v3.1.8 の Invite Friend 機能における mode パラメータに存在する反射型クロスサイトスクリプティング XSS の脆弱性。攻撃者は細工した URL を介してユーザーのセッション Cookie を窃取し、そのアカウントになりすますことができます。 脆弱なパラメータ: mode エクスプロイト - 概念実証 POC 反射型クロスサイトスクリプティング XSS root@kitploit: Payload : ';alert1// FINAL Payload URL encoded : %27%3balert1%2f%2f...

CVE-2022-48197

CVE-2022-48197 （Yahooはこの発表（https://yahooeng.tumblr.com/post/96098168666/important-announcement-regarding-yui）によりプロジェクトを更新しなくなったため、脆弱性をここで開示することにしました：） アプリケーションには、ほとんどのファイルに多数の反射型XSS脆弱性があります。脆弱性のあるファイルのサンプルとエクスプロイトはこちらにあります：...

Improper Encoding or Escaping of Output

Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the mode parameter of the openDevTools function. An attacker ca...

Gogs Vulnerable to Privilege Escalation via Collaboration Access Mode Validation

Summary A repository admin collaborator can escalate their privileges to owner-level access by exploiting an off-by-one error in the ChangeCollaborationAccessMode function. Vulnerable Code In internal/database/repocollaboration.go, line 129: go func r Repository ChangeCollaborationAccessModeuserI...

EUVD-2026-36753

Tenda 5G03 V05.03.02.04 Version 1.0 is vulnerable to Command injection in the function actionsetratmode via the ratMode parameter...

CVE-2026-38062

Tenda 5G03 V05.03.02.04 Version 1.0 is vulnerable to Command injection in the function actionsetratmode via the ratMode parameter...

PT-2026-49293

Name of the Vulnerable Software and Affected Versions Tenda 5G03 version V05.03.02.04 Version 1.0 Description Command injection is possible in the action set rat mode function through the ratMode parameter. Recommendations At the moment, there is no information about a newer version that contains...

CVE-2026-31167

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557B20221024 allowing attackers to execute arbitrary commands via the mode parameter to /cgi-bin/cstecgi.cgi...

CVE-2026-1450

The rognone plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mode' parameter in versions up to, and including, 0.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

CVE-2026-1450

The rognone plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mode' parameter in versions up to, and including, 0.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

CVE-2026-1450

The rognone WordPress plugin is affected by a Reflected XSS via the 'mode' parameter in versions up to and including 0.6.2, caused by insufficient input sanitization and output escaping. Unauthenticated attackers can exploit this if a user is tricked into a action link. A fix is available in late...

EUVD-2026-33889

The rognone plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mode' parameter in versions up to, and including, 0.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

CVE-2026-1450 rognone <= 0.6.2 - Reflected Cross-Site Scripting via 'mode' Parameter

The rognone plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mode' parameter in versions up to, and including, 0.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

CVE-2026-1450 rognone <= 0.6.2 - Reflected Cross-Site Scripting via 'mode' Parameter

The rognone plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mode' parameter in versions up to, and including, 0.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

CVE-2026-1450

The rognone plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mode' parameter in versions up to, and including, 0.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

CVE-2026-1450: Improper Neutralization of Input During Web Page Generation

The rognone plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mode' parameter in versions up to, and including, 0.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

PT-2026-45699

Name of the Vulnerable Software and Affected Versions rognone versions prior to 0.6.3 Description The rognone plugin for WordPress is subject to Reflected Cross-Site Scripting, a flaw where an application includes untrusted data in a web page without proper validation or escaping. This occurs due...

TOTOLINK A8000RU operating system command injection vulnerability (CNVD-2026-32563)

TOTOLINK A8000RU is a wireless router produced by China Jiying Electronics. The TOTOLINK A8000RU has a vulnerability related to operating system command injection. This vulnerability arises from the setScheduleCfg function failing to properly handle the mode parameter in /cgi-bin/cstecgi.cgi...

TOTOLINK A8000RU operating system command injection vulnerability (CNVD-2026-32557)

TOTOLINK A8000RU is a wireless router produced by China Jiying Electronics. The TOTOLINK A8000RU has a vulnerability related to operating system command injection. This vulnerability stems from the setWiFiAclRules function in the /cgi-bin/cstecgi.cgi file, which fails to properly handle the mode...

CVE-2026-7139

A flaw has been found in Totolink A8000RU 7.1cu.643b20200521. This issue affects the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument mode causes os command injection. The attack is possible to be carried out remotely. The...