Smoothwall Express Cross-Site Scripting Vulnerability

Smoothwall Express is Smoothwall open source a GNU/Linux-based firewall operating system . Smoothwall Express cross-site scripting vulnerability , the vulnerability stems from the modem.cgi script for INIT, HANGUP, SPEAKERON, SPEAKEROFF, TONEDIAL and PULSEDIAL parameters of the user-supplied data...

Zyxel EX3510-B0 TR-369 certificate download script command injection vulnerability

The Zyxel VMG3625-T50B is a VDSL2/ADSL2+ modem router produced by Zyxel Technologies. The Zyxel VMG3625-T50B has a command injection vulnerability as indicated by the TR-369 certification download script. This vulnerability stems from incorrect filtering of input parameters, allowing remote...

OpenClaw OS Command Injection Vulnerability (CNVD-2026-13373)

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from an operating system command injection vulnerability that stems from the failure of maintainer/developer scripts/update-clawtributors.ts to properly filter construct command special characters, commands...

Exploit for Reliance on Untrusted Inputs in a Security Decision in Microsoft

CVE-2026-21509 Office Kill-Bit Manager PowerShell script to...

Division by zero

Overview Affected versions of this package are vulnerable to Division by zero via the go function in the chaiscript::BoxedNumber class. An attacker can cause a denial of service by triggering a division by zero operation through local access. Remediation There is no fixed version for chaiscript...

CVE-2026-3383 ChaiScript boxed_number.hpp go divide by zero

A weakness has been identified in ChaiScript up to 6.1.0. This affects the function chaiscript::BoxedNumber::go of the file include/chaiscript/dispatchkit/boxednumber.hpp. Executing a manipulation can lead to divide by zero. The attack requires local access. The exploit has been made available to...

CVE-2026-3382

A security flaw has been discovered in ChaiScript up to 6.1.0. The impacted element is the function chaiscript::BoxedNumber::getas of the file include/chaiscript/dispatchkit/boxednumber.hpp. Performing a manipulation results in memory corruption. The attack requires a local approach. The exploit...

ChaiScript 缓冲区错误漏洞

ChaiScript is an open-source programming language developed by ChaiScript contributors. Versions of ChaiScript 6.1.0 and earlier contained a buffer error vulnerability. This vulnerability stemmed from incorrect operations on the function chaiscript::BoxedNumber::getas in the file...

ChaiScript 安全漏洞

ChaiScript is an open-source programming language developed by ChaiScript contributors. Versions of ChaiScript 6.1.0 and earlier contained security vulnerabilities, which were caused by uncontrolled recursion in the function located in the file include/chaiscript/language/chaiscripteval.hpp...

CVE-2026-28560

wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injection via forum URL data output into an inline script block using jsonencode without the JSONHEXTAG flag. Attackers set a forum slug containing a closing script tag or unescaped single quote to break o...

CVE-2026-28560

wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injection via forum URL data output into an inline script block using jsonencode without the JSONHEXTAG flag. Attackers set a forum slug containing a closing script tag or unescaped single quote to break o...

CVE-2026-28560 wpForo Forum 2.4.14 Stored XSS via Unsafe JSON Encoding in Inline Script

wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injection via forum URL data output into an inline script block using jsonencode without the JSONHEXTAG flag. Attackers set a forum slug containing a closing script tag or unescaped single quote to break o...

CVE-2026-28560 wpForo Forum 2.4.14 Stored XSS via Unsafe JSON Encoding in Inline Script

wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injection via forum URL data output into an inline script block using jsonencode without the JSONHEXTAG flag. Attackers set a forum slug containing a closing script tag or unescaped single quote to break o...

CVE-2026-28560

wpForo Forum 2.4.14 contains a stored XSS vulnerability: forum URL data output into an inline script block via json_encode without JSON_HEX_TAG. An attacker can supply a forum slug containing a closing tag or unescaped single quote to break out of the JavaScript string context and execute arbitr...

CVE-2026-28560

wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injection via forum URL data output into an inline script block using jsonencode without the JSONHEXTAG flag. Attackers set a forum slug containing a closing script tag or unescaped single quote to break o...

CVE-2026-3277

The OpenID Connect OIDC authentication configuration in PowerShell Universal before 2026.1.3 stores the OIDC client secret in cleartext in the .universal/authentication.ps1 script, which allows an attacker with read access to that file to obtain the OIDC client credentials...

Exploit for SQL Injection in Cmsmadesimple Cms_Made_Simple

updat...

OESA-2026-1430 hsqldb security update

HSQLdb is a relational database engine written in JavaTM , with a JDBC driver, supporting a subset of ANSI-92 SQL. It offers a small about 100k, fast database engine which offers both in memory and disk based tables. Embedded and server modes are available. Additionally, it includes tools such as...

MAL-2026-1086 Malicious code in tchap-bot (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ca239020bc35efc249b5f387dc3ae473132184319b88a498ba3f7ddd9dd6dfe3 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

GHSA-4RV8-5CMM-2R22 osctrl has Stored Cross-Site Scripting (XSS) in On-Demand Query List

Summary A stored Cross-site Scripting XSS vulnerability exists in the osctrl-admin on-demand query list. A user with query-level permissions can inject arbitrary JavaScript via the query parameter when running an on-demand query. The payload is stored and executes in the browser of any user...