340 matches found
CVE-2025-46041
Anchor CMS v0.12.7 - ثغرة XSS مخزنة CVE-2025-46041 Anchor CMS الإصدار 0.12.7 معرض لثغرة XSS مخزنة Cross-Site Scripting في حقل description بواجهة /admin/pages/add. معرف CVE CVE-2025-46041 ملخص النوع: XSS مخزنة الموقع: واجهة إنشاء الصفحة /admin/pages/add التأثير: تنفيذ جافاسكريبت عشوائي يتطلب مصادق...
XWiki < 14.10.14 - Cross-Site Scripting
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When document names are validated according to a name strategy disabled by default, XWiki starting in version 12.0-rc-1 and prior to versions 12.10.12 and 15.5-rc-1 is vulnerable to a reflecte...
CVE-2022-47131
CVE-2022-47131 Academy LMS history.pushState'', '', '/'...
Grav-CMS-RCE-Authenticated
Grav CMS रिमोट कोड निष्पादन प्रमाणित - CVE-2024-28116 जानकारी यह कोडGraver Github रिपॉजिटरी से अनुकूलित है, जिसमें इस वीडियो के आधार पर कुछ सुधार किए गए हैं। Grav CMS 1.7.45 से नीचे के संस्करणों के लिए के विरुद्ध शोषण, SSTI + RCE कमजोरियों पर आधारित, जिसे CVE-2024-28116 के रूप में चिह्नित किया गय...
WordPress webtoffee-cookie-consent plugin < 3.5.3 - Consent Log Disclosure/Deletion, Page Creation & License Deactivation vulnerability
Consent Log Disclosure/Deletion, Page Creation & License Deactivation vulnerability discovered by Eran Kapeluto in WordPress Plugin webtoffee-cookie-consent versions 3.5.3...
CVE-2026-14923 Sync Post With Other Site < 1.9.3 - Contributor+ Arbitrary Page Creation/Modification
The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because of an operator-precedence flaw in its authorization check. An authenticated user holding only the post-editing capability such...
CVE-2026-14923 Sync Post With Other Site < 1.9.3 - Contributor+ Arbitrary Page Creation/Modification
The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because of an operator-precedence flaw in its authorization check. An authenticated user holding only the post-editing capability such...
CVE-2026-14923
The Sync Post With Other Site WordPress plugin, in versions prior to 1.9.3 , contains an authorization flaw due to an operator-precedence error . This flaw allows authenticated users with limited privileges, such as a Contributor (who only holds post-editing capabilities), to bypass intended rest...
WordPress Sync Post With Other Site plugin < 1.9.3 - Contributor+ Arbitrary Page Creation/Modification vulnerability
Contributor+ Arbitrary Page Creation/Modification vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Sync Post With Other Site versions 1.9.3...
EUVD-2026-35545
Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...
Microsoft SharePoint Server Spoofing Vulnerability
Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...
CVE-2026-31018
In Dolibarr ERP & CRM = 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page...
CVE-2026-4420
Bludit is vulnerable to Stored Cross-Site Scripting XSS in its page creating functionality. An authenticated attacker with page creation privileges such as Author, Editor, or Administrator can embed a malicious JavaScript payload in the tags field of a newly created article. This payload will be...
CVE-2026-6391
The Sentence To SEO keywords, description and tags plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the createadminpage function. This makes it possible for unauthenticated attackers...
CVE-2026-7508
A vulnerability was found in Bootstrap CMS 0.9.0-alpha. Affected is an unknown function of the file resources/views/pages/show.blade.php of the component Page Creation Handler. Performing a manipulation of the argument body results in code injection. Remote exploitation of the attack is possible...
CVE-2026-7508
A vulnerability was found in Bootstrap CMS 0.9.0-alpha. Affected is an unknown function of the file resources/views/pages/show.blade.php of the component Page Creation Handler. Performing a manipulation of the argument body results in code injection. Remote exploitation of the attack is possible...
CVE-2026-7508 Bootstrap CMS Page Creation show.blade.php code injection
A vulnerability was found in Bootstrap CMS 0.9.0-alpha. Affected is an unknown function of the file resources/views/pages/show.blade.php of the component Page Creation Handler. Performing a manipulation of the argument body results in code injection. Remote exploitation of the attack is possible...
CVE-2026-7508
A vulnerability was found in Bootstrap CMS 0.9.0-alpha. Affected is an unknown function of the file resources/views/pages/show.blade.php of the component Page Creation Handler. Performing a manipulation of the argument body results in code injection. Remote exploitation of the attack is possible...
EUVD-2026-26456
A vulnerability was found in Bootstrap CMS 0.9.0-alpha. Affected is an unknown function of the file resources/views/pages/show.blade.php of the component Page Creation Handler. Performing a manipulation of the argument body results in code injection. Remote exploitation of the attack is possible...
CVE-2026-7508: Improper Control of Generation of Code
A vulnerability was found in Bootstrap CMS 0.9.0-alpha. Affected is an unknown function of the file resources/views/pages/show.blade.php of the component Page Creation Handler. Performing a manipulation of the argument body results in code injection. Remote exploitation of the attack is possible...