CVE-2026-0627

CVE-2026-0627 affects the AMP for WP plugin for WordPress (vulnerable up to 1.1.10). It is a stored XSS via malicious SVG uploads; requires Author-level authentication and executes when a user views the uploaded file. The issue arises from insufficient sanitization that only removes script tags, ...

CVE-2026-0627 AMP for WP <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG File Upload

The AMP for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and including, 1.1.10. This is due to insufficient sanitization of SVG file content that only removes tags while allowing other XSS vectors such as event handlers onload,...

CVE-2025-14657

The Eventin – Event Manager, Events Calendar, Event Tickets and Registrations plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'postsettings' function in all versions up to, and including, 4.0.51. This makes it possible for...

CVE-2025-14657 Eventin – Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) <= 4.0.51 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via 'post_settings'

The Eventin – Event Manager, Events Calendar, Event Tickets and Registrations plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'postsettings' function in all versions up to, and including, 4.0.51. This makes it possible for...

CVE-2025-14657

CVE-2025-14657 affects the Eventin – Event Manager, Event Booking, Calendar, Tickets and Registration Plugin for WordPress (AI Powered). The WordFence report confirms an unauthenticated bypass: missing authorization to modify settings via post_settings, allowing data modification. The issue also ...

CVE-2026-20976

Improper input validation in Galaxy Store prior to version 4.6.02 allows local attacker to execute arbitrary script...

CVE-2026-20976

Improper input validation in Galaxy Store prior to version 4.6.02 allows local attacker to execute arbitrary script...

CVE-2026-20976

Galaxy Store (Samsung) before version 4.6.02 suffers from improper input validation that allows a local attacker to execute arbitrary scripts. Affected product/version details are consistently reported across CVE entries and Red Hat/CIRCL/CNNVD mirrors indicate Galaxy Store prior to 4.6.02 is vul...

EUVD-2025-206266

The Brevo for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘userconnectionid’ parameter in all versions up to, and including, 4.0.49 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

SAMSUNG Galaxy Store 安全漏洞

SAMSUNG Galaxy Store is an application store by Samsung South Korea. A security vulnerability exists in SAMSUNG Galaxy Store versions prior to 4.6.02 that stems from improper input validation and could lead to the execution of arbitrary scripts...

GESTSUP 跨站脚本漏洞

GESTSUP is a software application from the French company GESTSUP. It is 100% web-based SUPport MANAGEMENT software that manages tickets and devices. A cross-site scripting vulnerability exists in GESTSUP 3.2.56 and prior versions, which stems from a flaw in the API error logging functionality th...

Udev Persistence Script

This Metasploit module will add a script in /lib/udev/rules.d/ in order to execute a payload written on disk. It will be executed with root privileges every time a network interface other than l0 comes up. Execution is triggered through the at command, so it must be installed on the target...

📄 Eptura Archibus Directory Traversal

In Eptura Archibus versions before version 2025.01, the "Run script" and "Server File" components of the "Database Update Wizard" are vulnerable to directory traversal. Title: Eptura Archibus Directory Traversal Description: In Eptura Archibus versions before v2025.01, the "Run script" and "Serve...

Google Chrome Insufficient Policy Enforcement Vulnerability

Google Chrome is a web browser developed by Google Inc. Google Chrome suffers from an Insufficient Policy Enforcement vulnerability, which stems from a failure to strictly enforce established security policy constraints when handling WebView tags, resulting in some high-privilege pages not being...

WordPress plugin Eventin 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

PT-2026-2057

Name of the Vulnerable Software and Affected Versions Samsung Galaxy Store versions prior to 4.6.02 Description A flaw exists in the Galaxy Store application where insufficient input validation can allow a local attacker to execute arbitrary script. The issue affects the Galaxy Store application...

PT-2026-2230

Name of the Vulnerable Software and Affected Versions Angular versions prior to 19.2.18 Angular versions prior to 20.3.16 Angular versions prior to 21.0.7 Angular version 21.1.0-rc.0 Description Angular is a development platform for building mobile and desktop web applications using...

PT-2026-1749

Name of the Vulnerable Software and Affected Versions Eventin – Event Manager, Events Calendar, Event Tickets and Registrations plugin for WordPress versions up to and including 4.0.51 Description The Eventin plugin for WordPress is susceptible to unauthorized data modification because of a missi...

PT-2026-1694

Name of the Vulnerable Software and Affected Versions Header and Footer Scripts plugin for WordPress versions up to and including 2.2.2 Description The Header and Footer Scripts plugin for WordPress is susceptible to Stored Cross-Site Scripting through the inpost head script parameter. Insufficie...

CVE-2026-0732

CVE-2026-0732 affects D-Link DI-8200G (v17.12.20A1). Description: manipulation of the path parameter in the file /upgrade_filter.asp leads to a remote command injection. Exploit publicly released; attacker could trigger from remote network. Affected component is the upgrade_filter.asp function ha...