CVE-2026-77607

Semantic MediaWiki , a free open-source MediaWiki extension, had a reflected XSS vulnerability in versions prior to 7.2.0 . The sep parameter in the Special:Ask table renderer was inserted verbatim into HTML cell joins, allowing an attacker to inject arbitrary HTML through the separator value. Pe...

CVE-2026-77607 Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, sep was inserted verbatim into HTML cell joins. This made it possible to inject HTML through the separator value. Version 7.2.0 fixes the issue...

GHSA-7XV3-GF2G-498H Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS

Failure mode sep was inserted verbatim into the HTML that joins a table cell's values. This made it possible to inject HTML through the separator value. The same unsanitised table HTML is produced both for the standard Special:Ask render and for its raw request output requesttype=raw, so the...

Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS

Failure mode sep was inserted verbatim into the HTML that joins a table cell's values. This made it possible to inject HTML through the separator value. The same unsanitised table HTML is produced both for the standard Special:Ask render and for its raw request output requesttype=raw, so the...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the sep parameter in the table rendering process. An attacker can execute arbitrary scripts in the context of the user's browser by injecting malicious HTML through the unsanitized separator value. Details...

EUVD-2026-83173

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when the value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Version 7.2.0...

Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)

Failure mode The value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Remediation - The form value is escaped before it is placed back into the input field. - Derived error messages are also escaped before being rendered into...

CVE-2026-85511

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...

WordPress WP2Social Auto Publish plugin <= 2.4.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'pages' Parameter vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting via 'pages' Parameter vulnerability discovered by Luca Jungnickel in WordPress Plugin WP2Social Auto Publish versions = 2.4.12...

WordPress Tutor LMS plugin <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Post Deletion via 'lessonid' Parameter vulnerability discovered by EUNHO KIM - Hyundai Autoever in WordPress Plugin Tutor LMS versions = 4.0.8...

CVE-2026-85511 Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth2

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...

EUVD-2026-82946

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...

CVE-2026-85511

A parameter injection flaw was identified in Red Hat EAP's Elytron security subsystem. Specifically, an EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection allows parameter substitution due to missing URL encoding . The vulnerability is rated MEDIUM...

CVE-2026-85511 Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth2

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...

CVE-2026-85511

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...

CVE-2026-88623

NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen is used to open the URL in binary read-only mode. The content is then written to the /tmp/ directory, with the filename derived from basename ...

CVE-2023-5778

Improper handling of length parameter inconsistency vulnerability in ABB Freelance Controller DCP, ABB Freelance Controller AC700, ABB Freelance Controller AC800, and ABB Freelance Controller AC900. This issue affects Freelance Controller DCP: through 2013, 2013 SP1, 2016, 2016 SP1, 2019, and 201...

CVE-2023-5778

CVE-2023-5778 is an improper handling of length parameter inconsistency vulnerability affecting ABB Freelance Controller DCP, AC700, AC800, and AC900 , all through firmware version 2019 SP1 . The flaw allows a network-based, low-complexity attack with no required privileges or user interaction to...

EUVD-2023-60692

Improper handling of length parameter inconsistency vulnerability in ABB Freelance Controller DCP, ABB Freelance Controller AC700, ABB Freelance Controller AC800, and ABB Freelance Controller AC900. This issue affects Freelance Controller DCP: through 2013, 2013 SP1, 2016, 2016 SP1, 2019, and 201...

CVE-2023-5778 Missing Length Check

Improper handling of length parameter inconsistency vulnerability in ABB Freelance Controller DCP, ABB Freelance Controller AC700, ABB Freelance Controller AC800, and ABB Freelance Controller AC900. This issue affects Freelance Controller DCP: through 2013, 2013 SP1, 2016, 2016 SP1, 2019, and 201...