3680 matches found
CVE-2026-85190: Improper Neutralization of Input During Web Page Generation
Joomla Extension - regularlabs.com - Privileged stored XSS via class option in Quick Index extension for Joomla 5.0.5 - Quick Index inserts configurable class values into generated HTML without escaping them for an HTML attribute. A crafted value can close the intended class attribute and introdu...
Malicious code in iota-stub-wind-quick-promise (npm)
Source: amazon-inspector 926d033f3f79f78ed2711cf99d51fef9eae637b5fe355e222fd485b6b583a03d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
CVE-2026-85546
MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...
CVE-2026-85546 MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests
MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...
CVE-2026-85546
MISP is affected by a cross-site request forgery (CSRF) vulnerability in its sharing group quick-edit functionality. The root cause lies in the __initialiseSGQuickEdit() helper, where the allowMethod(['post']) call was commented out, allowing the addOrg, removeOrg, addServer, and removeServer act...
CVE-2026-85546 MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests
MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...
EUVD-2026-70981
MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...
CVE-2026-85546 MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests
MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...
CVE-2026-84146 Xpro Elementor Addons < 1.7.8 - Unauthenticated Draft/Private Product Disclosure via Quick View
The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and...
CVE-2026-85546: Cross-Site Request Forgery (CSRF)
MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...
PT-2026-85455
MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...
CVE-2026-84847
Unauthenticated Broken Access Control in Quick Event Manager = 9.17 versions...
CVE-2026-84848
Unauthenticated Cross Site Scripting XSS in Quick Event Manager = 9.17 versions...
CVE-2026-84848 WordPress Quick Event Manager plugin <= 9.17 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Quick Event Manager = 9.17 versions...
CVE-2026-84848
The WordPress Quick Event Manager plugin (versions
CVE-2026-84848 WordPress Quick Event Manager plugin <= 9.17 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Quick Event Manager = 9.17 versions...
EUVD-2026-70566
Unauthenticated Cross Site Scripting XSS in Quick Event Manager = 9.17 versions...
CVE-2026-84847
CVE-2026-84847 affects the WordPress Quick Event Manager plugin in versions 9.17 and earlier . The vulnerability is an unauthenticated Broken Access Control flaw, meaning an attacker with no prior access can exploit it over the network with low complexity and no user interaction. The CVSS 3.1 sco...