CVE-2025-46041

Anchor CMS v0.12.7 - Stored XSS CVE-2025-46041 Anchor CMS v0.12.7 is vulnerable to a Stored Cross-Site Scripting XSS vulnerability in the description field of the /admin/pages/add interface. CVE ID CVE-2025-46041 Summary Type: Stored XSS Location: Page creation interface /admin/pages/add Impact:...

XWiki < 14.10.14 - Cross-Site Scripting

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When document names are validated according to a name strategy disabled by default, XWiki starting in version 12.0-rc-1 and prior to versions 12.10.12 and 15.5-rc-1 is vulnerable to a reflecte...

Grav-CMS-RCE-Authenticated

Grav CMS Remote Code Execution Authenticated - CVE-2024-28116 Info This code is an adaptation fromGraver Github repository with some improvements based on this video. Exploit against Grav CMS for versions below 1.7.45 based on SSTI + RCE vulnerabilities, labeled as CVE-2024-28116. This script...

CVE-2022-47131

CVE-2022-47131 Academy LMS history.pushState'', '', '/'...

EUVD-2026-111130

A public shared collective always allowed recipients of the link to create pages...

CVE-2026-77171

A public shared collective always allowed recipients of the link to create pages...

PT-2026-126669

A public shared collective always allowed recipients of the link to create pages...

CVE-2026-110019

The Bulk Page Generator – LPagery plugin for WordPress (versions up to and including 3.1.0 ) is vulnerable to an authorization bypass (CWE-862). The plugin fails to properly verify if a user is authorized to perform specific actions, allowing authenticated attackers with subscriber-level access o...

CVE-2026-110019 Bulk Page Generator <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation/Modification/Deletion via 'authorize' Parameter / Suite OAuth Flow

The Bulk Page Generator – LPagery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-110019 Bulk Page Generator <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation/Modification/Deletion via 'authorize' Parameter / Suite OAuth Flow

The Bulk Page Generator – LPagery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

WordPress Bulk Page Generator – LPagery plugin <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation/Modification/Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Page Creation/Modification/Deletion vulnerability discovered by Wordfence PRISM in WordPress Plugin Bulk Landing Page Creator for WordPress LPagery versions = 3.1.0...

WordPress webtoffee-cookie-consent plugin < 3.5.3 - Consent Log Disclosure/Deletion, Page Creation & License Deactivation vulnerability

Consent Log Disclosure/Deletion, Page Creation & License Deactivation vulnerability discovered by Eran Kapeluto in WordPress Plugin webtoffee-cookie-consent versions 3.5.3...

CVE-2026-14923

The Sync Post With Other Site WordPress plugin, in versions prior to 1.9.3 , contains an authorization flaw due to an operator-precedence error . This flaw allows authenticated users with limited privileges, such as a Contributor (who only holds post-editing capabilities), to bypass intended rest...

WordPress Sync Post With Other Site plugin < 1.9.3 - Contributor+ Arbitrary Page Creation/Modification vulnerability

Contributor+ Arbitrary Page Creation/Modification vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Sync Post With Other Site versions 1.9.3...

CVE-2026-14923 Sync Post With Other Site < 1.9.3 - Contributor+ Arbitrary Page Creation/Modification

The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because of an operator-precedence flaw in its authorization check. An authenticated user holding only the post-editing capability such...

CVE-2026-14923 Sync Post With Other Site < 1.9.3 - Contributor+ Arbitrary Page Creation/Modification

The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because of an operator-precedence flaw in its authorization check. An authenticated user holding only the post-editing capability such...

XWiki < 14.10.14 - Cross-Site Scripting Detection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When document names are validated according to a name strategy disabled by default, XWiki starting in version 12.0-rc-1 and prior to versions 12.10.12 and 15.5-rc-1 is vulnerable to a reflecte...

EUVD-2026-35545

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

Microsoft SharePoint Server Spoofing Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

CVE-2026-31018

In Dolibarr ERP & CRM = 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page...