ROS-20260911-73-0019

The vulnerability of the xmtresolveodlinks function in the MP4Box utility of the GPAC multimedia platform, which stems from the use of memory after it is freed during the processing of an incorrect XMT script, allows a hacker to cause a service failure...

PT-2026-89859

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names are not encoded before being concatenated into public watch-page HTML. A video owner can inject malicious scripts via the bookmark name...

CVE-2026-90443: Improper Neutralization of Input During Web Page Generation

A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does not require authentication to reach. This allows an unauthenticated network attacker to craft a link that, when visited by a user, executes arbitrary script in...

CVE-2026-83545: Improper Neutralization of Input During Web Page Generation

The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed...

PT-2026-89781

The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed...

PT-2026-89784

The AI Builder WordPress plugin before 2.7.8 does not sanitise custom JavaScript saved against a post before echoing it inside a script tag on the front end, allowing users with contributor level access and above to store arbitrary JavaScript that will execute in the browser of anyone who views t...

OMG_KILLER

OMGKILLER Автоатакующий скрипт на базе эксплойтов CVE-2024-37890 и OOM 2026 Пока лайтовый вариант щас расширим проксями и прочим дерьмом что бы атаковать с одной тачки как огромная ботферма...

CVE-2024-31666

Vulnerability Overview A vulnerability exists in Flusity-CMS v.2.33 that allows a remote attacker to execute arbitrary code via a crafted script in the editaddonpost.php component. Affected Versions Flusity-CMS v.2.33 Vulnerability Details An attacker can exploit this vulnerability by sending a...

MAL-2026-16125 Malicious code in lucy-python-script-2030 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2195ea343abdb1205451fc7c778bdd1580cf985461949081852e9e82363ac389 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

Malicious code in lucy-python-script-2030 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2195ea343abdb1205451fc7c778bdd1580cf985461949081852e9e82363ac389 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

Exploit for CVE-2024-37890

OMGKILLER Ав...

CVE-2026-84819 WordPress WPAdverts plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WPAdverts = 2.3.3 versions...

CVE-2026-88866

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to encode the User-Agent header before storing it in login history. Attackers with any valid login account can inject malicious scripts in...

CVE-2026-88868 AVideo LiveLinks Stored XSS via title and description fields

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LiveLinks plugin where title and description fields are stored without sanitization. A user with canStream permission can inject malicious scripts that execute in the browser...

CVE-2026-88867

WWBN AVideo (up to commit c3edcc274c389816d434acadac07ee78eaf330c1 ) is affected by a stored cross-site scripting (XSS) vulnerability. The endpoint objects/categoryAddNew.json.php passes the POST parameters name and iconClass into Category::setName() and Category::setIconClass() without sanitizat...

CVE-2026-88866 WWBN AVideo LoginControl Stored XSS via User-Agent Header

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to encode the User-Agent header before storing it in login history. Attackers with any valid login account can inject malicious scripts in...

CVE-2026-88866 WWBN AVideo LoginControl Stored XSS via User-Agent Header

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to encode the User-Agent header before storing it in login history. Attackers with any valid login account can inject malicious scripts in...

DEBIAN-CVE-2026-88859

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to a...

CVE-2026-88859

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to a...

EUVD-2026-75397

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to a...