23333 matches found
CVE-2026-24672
The CVE-2026-24672 entry concerns the Open eClass platform (formerly GUnet eClass). Before version 4.2, authenticated students could inject stored JavaScript into user profile fields, which executes when users with viewing privileges access affected pages. The vulnerability has been patched in ve...
CVE-2026-24672 Open eClass is Vulnerable to Stored Cross-Site Scripting (XSS) in User Profile Fields
The Open eClass platform formerly known as GUnet eClass is a complete course management system. Prior to version 4.2, a Stored Cross-Site Scripting XSS vulnerability allows authenticated students to inject malicious JavaScript into user profile fields, which is executed when users with viewing...
CVE-2026-24672 Open eClass is Vulnerable to Stored Cross-Site Scripting (XSS) in User Profile Fields
The Open eClass platform formerly known as GUnet eClass is a complete course management system. Prior to version 4.2, a Stored Cross-Site Scripting XSS vulnerability allows authenticated students to inject malicious JavaScript into user profile fields, which is executed when users with viewing...
EUVD-2026-5237
The Open eClass platform formerly known as GUnet eClass is a complete course management system. Prior to version 4.2, a Stored Cross-Site Scripting XSS vulnerability allows authenticated students to inject malicious JavaScript into user profile fields, which is executed when users with viewing...
CVE-2026-24672 Open eClass is Vulnerable to Stored Cross-Site Scripting (XSS) in User Profile Fields
The Open eClass platform formerly known as GUnet eClass is a complete course management system. Prior to version 4.2, a Stored Cross-Site Scripting XSS vulnerability allows authenticated students to inject malicious JavaScript into user profile fields, which is executed when users with viewing...
CVE-2026-24672
The Open eClass platform formerly known as GUnet eClass is a complete course management system. Prior to version 4.2, a Stored Cross-Site Scripting XSS vulnerability allows authenticated students to inject malicious JavaScript into user profile fields, which is executed when users with viewing...
CVE-2026-1287
creationtimestamp| type| source ---|---|--- 2026-02-03 15:53:03+00:00| seen| https://seclists.org/oss-sec/2026/q1/141 2026-02-03 17:16:15+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mdxugave7y2b 2026-02-13 00:46:46+00:00| seen|...
CVE-2026-1312
creationtimestamp| type| source ---|---|--- 2026-02-03 15:53:03+00:00| seen| https://seclists.org/oss-sec/2026/q1/141 2026-02-03 17:16:15+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mdxugave7y2b 2026-02-13 00:46:46+00:00| seen|...
CVE-2026-1207
creationtimestamp| type| source ---|---|--- 2026-02-03 15:53:03+00:00| seen| https://seclists.org/oss-sec/2026/q1/141 2026-02-03 17:16:15+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mdxugave7y2b 2026-02-05 11:14:02+00:00| confirmed|...
Security Bulletin: Vulnerability in IBM WebSphere Application (CVE-2020-36732) affects IBM PowerVM Novalink.
Summary IBM WebSphere Libery Profile is used by IBM PowerVM Novalink. IBM PowerVM Novalink has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2020-36732 DESCRIPTION: The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an...
CVE-2025-28162
creationtimestamp| type| source ---|---|--- 2026-02-03 12:46:15+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mdxfdkarh22c...
CVE-2025-67848
creationtimestamp| type| source ---|---|--- 2026-02-03 11:23:09+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mdxap24qmf2h...
CVE-2026-24936
creationtimestamp| type| source ---|---|--- 2026-02-03 09:21:34+00:00| seen| https://bsky.app/profile/basefortify.bsky.social/post/3mdwzvbhz6k2z 2026-02-03 09:21:35+00:00| seen| https://bsky.app/profile/basefortify.bsky.social/post/3mdwzvi6hic2z 2026-02-03 09:21:35+00:00| seen|...
CVE-2025-15030
The User Profile Builder WordPress plugin before 3.15.2 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access to their account...
CVE-2026-1375
creationtimestamp| type| source ---|---|--- 2026-02-03 08:22:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mdwwlhtsev2h 2026-04-09 21:00:05+00:00| published-proof-of-concept| Telegram/uEPSzFNr6HqJN1CCE1x2MfixnAoe1zyVBXupCwzjdQjfEc...
CVE-2026-1730
creationtimestamp| type| source ---|---|--- 2026-02-03 08:17:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mdwwdlpqnf2h 2026-02-03 08:18:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mdwweay6pl2g...
CVE-2026-24465
creationtimestamp| type| source ---|---|--- 2026-02-03 07:18:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mdwt2g2p7r2a 2026-05-11 22:15:50+00:00| seen| https://jvn.jp/en/jp/JVN94012927...
CVE-2026-0617
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer profile fields in all versions up to, and including, 5.2.5 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-0617
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer profile fields in all versions up to, and including, 5.2.5 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-0617 LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site Scripting
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer profile fields in all versions up to, and including, 5.2.5 due to insufficient input sanitization and output escaping. This makes it possible for...