cisco-sa-sma-attack-N9bf4

Vérification d'exposition Cisco SMA Petit script Python 3 en un seul fichier pour sonder rapidement un hôte ou un domaine à la recherche de ports de gestion et de quarantaine ouverts pour Cisco Secure Email/Secure Malware Analytics indicateurs d'exposition CVE-2025-20393. Utilisation Installez...

GHSA-3753-M2X2-Q623 File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer

Summary Before 2.3.1, the legacy .doc renderer emitted document hyperlink targets after HTML escaping but without a URL-scheme allowlist. A crafted .doc could therefore render a live javascript:, vbscript:, data:, or similarly unsafe link. Script could execute in the embedding origin if a viewer...

File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer

Summary Before 2.3.1, the legacy .doc renderer emitted document hyperlink targets after HTML escaping but without a URL-scheme allowlist. A crafted .doc could therefore render a live javascript:, vbscript:, data:, or similarly unsafe link. Script could execute in the embedding origin if a viewer...

CVE-2026-91127 File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer

File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other files in private and internal web applications. Prior to @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2, the legacy DOC renderer emitted document-controlled hyperlink targets into generated HTML after character escapin...

CVE-2026-91127

File Viewer 's legacy DOC renderer in @file-viewer/doc (< 2.3.1) and msdoc-viewer (

CVE-2026-77616

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. In versions 7.0.0 through 7.1.0, Special:Ask accepts a cursor query parameter for keyset pagination added in 7.0.0. The token is decoded by CursorEncoder, which is an...

CVE-2026-93598 ArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundle

ArcadeDB Maven artifact com.arcadedb:arcadedb-engine through 26.8.1 contains an incomplete deny-list in the polyglot script sandbox: com.arcadedb.query.polyglot.HostClassLookupFilter.DENIED lists java.util.ResourceBundle as a bare class name, which is matched by exact equality and therefore does...

CVE-2026-92976

A stored XSS vulnerability affects the profile management functionality of T-Systems' TAO 2.0 suite. An authenticated user can inject malicious HTML or JavaScript into personal data fields, which are stored and rendered without proper sanitisation when viewed by another user, including administra...

CVE-2026-92976 Stored Cross-Site Scripting (XSS) in T-Systems’ TAO 2.0

A stored Cross-Site Scripting XSS vulnerability in the profile management functionality of T-Systems’ TAO 2.0 suite. An authenticated user could inject malicious HTML or JavaScript content into the fields containing their personal data. The content entered is stored and displayed without being...

EUVD-2026-82854

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via posttitle in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-87915 Popup Maker <= 1.24.0 - Unauthenticated Stored Cross-Site Scripting via values[Name] Parameter

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via valuesName Parameter in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. Th...

CVE-2026-15797 Popup Maker <= 1.24.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_title

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via posttitle in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-92125

A flaw was found in the Jenkins Script Security Plugin. Attackers with permissions to define and run sandboxed scripts, such as Pipelines, can exploit this vulnerability. By not properly rejecting the @GroovyASTTransformationClass annotation, an attacker can run an arbitrary Abstract Syntax Tree...

CVE-2026-67103 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by Cross-Site Scripting XSS vulnerability, which could allow an attacker to inject unsanitized malicious scripts that execute in a victim's browser, enabling session hijacking, account takeover, and unauthorized actions on behalf of affected users...

CVE-2026-92249 Qi Addons For Elementor <= 1.11 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter

The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 1.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...

CVE-2026-92249 Qi Addons For Elementor <= 1.11 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter

The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 1.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...

CVE-2026-15004 FileBird – WordPress Media Library Folders & File Manager <= 6.5.6 - Authenticated (Author+) Stored Cross-Site Scripting

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 6.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-90981 Newsletter <= 9.3.8 - Reflected Cross-Site Scripting via 'nn' Parameter

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nn' parameter in all versions up to, and including, 9.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-92622 Strong Testimonials <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute

The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lightboxclass' Shortcode Attribute in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-90981

The Newsletter – Send awesome emails from WordPress plugin (versions up to and including 9.3.8 ) is vulnerable to Reflected Cross-Site Scripting via the nn parameter, caused by insufficient input sanitization and output escaping in the dienow() function. An unauthenticated attacker can inject arb...