CVE-2026-97195

The Secure Custom Fields WordPress plugin (versions before 6.9.8 ) is vulnerable to Stored XSS due to a lack of sanitization on persisted field definitions. An attacker with the ability to configure fields can inject a payload into a field definition, which is then emitted as an HTML attribute na...

CVE-2026-97195 Secure Custom Fields < 6.9.8 - Admin+ Stored XSS via HTML Attribute Name Injection into Field Definition

The Secure Custom Fields WordPress plugin before 6.9.8 does not sanitize a persisted field definition before emitting part of it as an HTML attribute name, allowing a user able to configure its fields to store a payload that executes as JavaScript in the browser of any user who views a page...

CVE-2026-110813 Advanced Custom Fields (ACF®) < 6.8.11 - Unauthenticated Stored XSS via HTML Attribute Name Injection

The Advanced Custom Fields ACF® WordPress plugin before 6.8.11 does not properly sanitize a stored field definition that can be modified through its comment handling, allowing unauthenticated users to inject a payload that is emitted as an HTML attribute name and executed as JavaScript in the...

CVE-2026-110813

The Advanced Custom Fields (ACF®) WordPress plugin before version 6.8.11 is vulnerable to an unauthenticated stored XSS vulnerability. The root cause is the improper sanitization of a stored field definition, which can be modified through its comment handling. An attacker can inject a payload tha...

HavocPwn

Havoc-PWN Authenticated This SSRF-RCE Chain was inspired by chebuya's CVE-2024-41570 SSRF POC and IncludeSecurity's Havoc Auth RCE both exploits are amazing and well crafted, please do give these creators appriciation for their hardwork! chebuya hyperreality How does it Work? The SSRF vulnerabili...

BIT-PARSE-2026-116164 Parse Server 9.0.0 before 9.10.4 Reserved Field Name Injection via Object Writes

Parse Server before 8.6.100 and 9.0.0 before 9.10.4 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal fields. Attackers can write a reserved field that makes reads of an object fail on MongoDB, disrupting queries on that class for a...

CVE-2026-116164 Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes

Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal fields. Attackers can write a reserved field that makes reads of an object fail on MongoDB, disrupting queries on that cla...

CVE-2026-116164

Parse Server versions before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 are vulnerable to a Reserved Field Name Injection via object writes. The root cause is the failure to reject reserved internal field names during client object writes, allowing attackers to store or clear internal fields. This c...

CVE-2026-116164 Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes

Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal fields. Attackers can write a reserved field that makes reads of an object fail on MongoDB, disrupting queries on that cla...

CVE-2026-104956

Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts groupby and subgroupby query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .orderbyfield, an...

CVE-2026-104956 Plane: Unauthenticated ORM field-name injection via `group_by`/`sub_group_by` on public deploy boards (DoS + blind oracle)

Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts groupby and subgroupby query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .orderbyfield, an...

EUVD-2026-92480

Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts groupby and subgroupby query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .orderbyfield, an...

CVE-2026-104956 Plane: Unauthenticated ORM field-name injection via `group_by`/`sub_group_by` on public deploy boards (DoS + blind oracle)

Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts groupby and subgroupby query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .orderbyfield, an...

CVE-2026-104956 Plane: Unauthenticated ORM field-name injection via `group_by`/`sub_group_by` on public deploy boards (DoS + blind oracle)

Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts groupby and subgroupby query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .orderbyfield, an...

CVE-2026-104956

The open-source project management tool Plane is vulnerable to unauthenticated ORM field-name injection in versions prior to 1.4.0 . The public issues endpoint fails to validate the group_by and sub_group_by query parameters, passing them directly to grouped paginators. Attackers can supply arbit...

PT-2026-106022

Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts group by and sub group by query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .order byfield...

EUVD-2026-69241

xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator...

GHSA-27P8-2357-5QQV xmldom: DocType `name` Injection Bypasses requireWellFormed

Summary The @xmldom/xmldom serializer emits DocumentType.name verbatim into the declaration with no well-formedness guard. GHSA-f6ww-3ggp-fr8h CVE-2026-41674 hardened the serializer's requireWellFormed path for a DocumentType's sibling fields — publicId, systemId, and internalSubset — but it did...

xmldom: DocType `name` Injection Bypasses requireWellFormed

Summary The @xmldom/xmldom serializer emits DocumentType.name verbatim into the declaration with no well-formedness guard. GHSA-f6ww-3ggp-fr8h CVE-2026-41674 hardened the serializer's requireWellFormed path for a DocumentType's sibling fields — publicId, systemId, and internalSubset — but it did...

NPM: xmldom: Element name injection via createElement() bypasses requireWellFormed

NPM: xmldom: Element name injection via createElement bypasses requireWellFormed vulnerability discovered by ? in WordPress Npm xmldom versions = 0.6.0...