5359 matches found
CVE-2026-93303
The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'formdata' Rich Text Field via Draft Save/Resume in all versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. Th...
CVE-2026-93303
The HT Contact Form – Drag & Drop Form Builder for WordPress plugin is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) in versions up to and including 2.10.1 . The root cause is insufficient input sanitization and output escaping within the 'form_data' Rich Text Field during the Draft S...
CVE-2026-93303 HT Contact Form <= 2.10.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'form_data' Rich Text Field via Draft Save/Resume
The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'formdata' Rich Text Field via Draft Save/Resume in all versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. Th...
EUVD-2026-86545
The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'formdata' Rich Text Field via Draft Save/Resume in all versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. Th...
CVE-2026-96766 GeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'businesshours' parameter in all versions up to, and including, 2.8.183 due to insufficient input sanitization and output escaping. This make...
CVE-2026-27541-Analysis-Lab
CVE-2026-27541 — WooCommerce Wholesale Prices Authenticated Privilege Escalation Lab Overview This project is a local Docker lab for analyzing and reproducing the behavior of CVE-2026-27541 in the WooCommerce Wholesale Prices / Wholesale Suite plugin by comparing vulnerable and patched builds...
CVE-2023-51385-save
This repository does not have a README...
docker-socket-risk-demos
docker-socket-risk-demos Companion repo for the video: Stop Mounting docker.sock — Run Trivy Without Giving Away Root Access — inspired by CVE-2026-33634 https://www.youtube.com/watch?v=xLTYzfPY3xI This repo contains the sample web app and Claude Code prompt used in the video to demonstrate: 1. W...
Craft-CMS-3.0.25---Cross-Site-Scripting
Craft-CMS-3.0.25 - Cross-Site-Scripting Craft CMS 3.0.25 - Cross-Site Scripting Vulnerability CVE-CVE-2018-20418 https://vulners.com/cve/CVE-2018-20418 Proof of Concept Allows it to run a Cross-Site Scripting by saving a new title from the console tab. root@kitploit: POST...
EUVD-2026-84426
A vulnerability has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. Impacted is the function fileputcontents of the file codeEditor.php of the component Save Handler. The manipulation of the argument filename/content leads to unrestricted upload. The attack is possible to b...
CVE-2026-95500: Unrestricted Upload of File with Dangerous Type
A vulnerability has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. Impacted is the function fileputcontents of the file codeEditor.php of the component Save Handler. The manipulation of the argument filename/content leads to unrestricted upload. The attack is possible to b...
Security update for freeciv (moderate)
openSUSE Security Update: Security update for freeciv Announcement ID: openSUSE-SU-2026:0339-1 Rating: moderate References: 1248258 1278695 1278696 Cross-References: CVE-2026-90556 CVE-2026-90557 Affected Products: openSUSE Backports SLE-15-SP7 An update that solves two vulnerabilities and has on...
CVE-2026-94048
A vulnerability was detected in CodeAstro QR Code Attendance Management System 1.0. This affects the function Save of the file app/Controllers/UserController.php. The manipulation of the argument roleid results in improper privilege management. The attack can be executed remotely. The exploit is...
CVE-2026-94045
A security flaw has been discovered in newbee-ltd newbee-mall up to 1.0.0. Impacted is an unknown function of the file controller/common/UploadController.java of the component Goods Save Endpoint. Performing a manipulation of the argument goodsName results in cross site scripting. The attack may ...
CVE-2026-94045: Improper Neutralization of Input During Web Page Generation
A security flaw has been discovered in newbee-ltd newbee-mall up to 1.0.0. Impacted is an unknown function of the file controller/common/UploadController.java of the component Goods Save Endpoint. Performing a manipulation of the argument goodsName results in cross site scripting. The attack may ...
CVE-2026-92807
The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitrary Function Invocation in all versions up to, and including, 4.6.1 via the pdfcreatedcallback shortcode attribute. The evalshortcode function copies any non-button/non-email shortcode attribute verbatim into a custom...
EUVD-2026-83481
The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitrary Function Invocation in all versions up to, and including, 4.6.1 via the pdfcreatedcallback shortcode attribute. The evalshortcode function copies any non-button/non-email shortcode attribute verbatim into a custom...
CVE-2026-92807
The Save as PDF Plugin by PDFCrowd for WordPress (≤ 4.6.1) is vulnerable to arbitrary function invocation via the pdf_created_callback shortcode attribute. The eval_shortcode() function copies attacker-supplied attributes into an options array without sanitization or allowlist enforcement. When t...
CVE-2026-92807 Save as PDF Plugin by PDFCrowd <= 4.6.1 - Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via 'pdf_created_callback' Shortcode Attribute
The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitrary Function Invocation in all versions up to, and including, 4.6.1 via the pdfcreatedcallback shortcode attribute. The evalshortcode function copies any non-button/non-email shortcode attribute verbatim into a custom...
CVE-2026-92807 Save as PDF Plugin by PDFCrowd <= 4.6.1 - Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via 'pdf_created_callback' Shortcode Attribute
The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitrary Function Invocation in all versions up to, and including, 4.6.1 via the pdfcreatedcallback shortcode attribute. The evalshortcode function copies any non-button/non-email shortcode attribute verbatim into a custom...