204 matches found
Newsletter < 7.4.5 - Cross-Site Scripting
The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $SERVER'REQUESTURI' before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to Reflected XSS in older browsers such as...
Keycloak-12.0.1-CVE-2020-10770
Keycloak-12.0.1-CVE-2020-10770 Keycloak 12.0.1 - Слепая подделка серверных запросов SSRF без аутентификации 'requesturi' Exploit-DB-50405 Ожидаемый результат: сканирование портов localhost или внутренних хостов. Предназначено только для образовательных целей и тестирования в корпоративных средах...
CVE-2022-36663-PoC
CVE-2022-36663-PoC Scanner de réseau interne via une SSRF aveugle Gluu IAM Gluu IAM est vulnérable à une SSRF aveugle qui peut être exploitée pour scanner le réseau interne à la recherche de ports ouverts en fonction des temps de réponse. https://nvd.nist.gov/vuln/detail/CVE-2022-36663 Pour...
CVE-2024-27198-TeamCity
Митигирующие методы: regexp на WAF REQUESTURI Regex ^\S\?jsp=\S;\.jsp...
CVE-2026-93896
The WPFront Notification Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.5.1. This is due to the debug-log output path writedebuglogs reflecting the raw value of $SERVER'REQUESTURI' through vprintf directly inside a block emitted on...
CVE-2026-103421
The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUESTURI path segment after /androidjson/search/' parameter in all versions up to, and including, 11.84 due to insufficient input sanitization and output escaping. This make...
CVE-2026-93896 WPFront Notification Bar <= 3.5.1 - Reflected Cross-Site Scripting via REQUEST_URI
The WPFront Notification Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.5.1. This is due to the debug-log output path writedebuglogs reflecting the raw value of $SERVER'REQUESTURI' through vprintf directly inside a block emitted on...
EUVD-2026-91956
The WPFront Notification Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.5.1. This is due to the debug-log output path writedebuglogs reflecting the raw value of $SERVER'REQUESTURI' through vprintf directly inside a block emitted on...
CVE-2026-93896
The WPFront Notification Bar plugin for WordPress (versions up to and including 3.5.1 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the write_debug_logs output path, which reflects the raw value of $_SERVER['REQUEST_URI'] through vprintf() directly into a [removed] b...
EUVD-2026-91951
The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUESTURI path segment after /androidjson/search/' parameter in all versions up to, and including, 11.84 due to insufficient input sanitization and output escaping. This make...
CVE-2026-103421
The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 11.84 . The root cause is insufficient input sanitization and output escaping of the REQUEST_URI (specifically the path segment after /android...
CVE-2026-92826
The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...
CVE-2026-92826
The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 8.7.7 . The root cause is insufficient input sanitization and output escaping within the REQUEST_URI Parameter Key . An unauthenticated attacker can inject arbit...
CVE-2026-92826 EWWW Image Optimizer <= 8.7.7 - Reflected Cross-Site Scripting via REQUEST_URI Parameter Key
The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...
EUVD-2026-91894
The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...
CVE-2026-92826: Improper Neutralization of Input During Web Page Generation
The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...
CVE-2026-103421: Improper Neutralization of Input During Web Page Generation
The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUESTURI path segment after /androidjson/search/' parameter in all versions up to, and including, 11.84 due to insufficient input sanitization and output escaping. This make...
CVE-2026-93896: Improper Neutralization of Input During Web Page Generation
The WPFront Notification Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.5.1. This is due to the debug-log output path writedebuglogs reflecting the raw value of $SERVER'REQUESTURI' through vprintf directly inside a...
CVE-2026-97652
The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Query-Parameter Key in all versions up to, and including, 14.16.14 due to insufficient input sanitization and output escaping. This makes i...
CVE-2026-97652
The WP Statistics WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 14.16.14 . The root cause is insufficient input sanitization and output escaping of the REQUEST_URI Query-Parameter Key. This allows unauthenticated attackers to inject arb...