1124630 matches found
CVE-2026-15787 Ultimate Addons for Elementor <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes
The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible...
CVE-2026-15787
The CVE concerns The Ultimate Addons for Elementor (WordPress) up to version 2.9.1, where a Stored XSS exists in the Navigation Menu Widget via data-toggle-icon/data-close-icon attributes. The root cause is insufficient input sanitization and output escaping; wp_kses_post is applied on save for u...
CVE-2026-63264
CVE-2026-63264 concerns the Joomla extension JoomShopping. Connected records specify a reflected XSS vulnerability in the product frontend controller, affecting JoomShopping versions prior to 5.9.3. The entry indicates an input reflected in the frontend controller without detailed mitigations or ...
EUVD-2026-47619
The Joomla extension JoomShopping is vulnerable to an reflected XSS vulnerability in the product frontend controller...
CVE-2026-12968
The CVE concerns the WordPress plugin “Product Addons and Product Options With Custom Fields” (before 1.6.15). Affected component is the unauthenticated file-upload endpoint that accepts SVG files, which are stored and served inline. This allows an unauthenticated attacker to upload a malicious S...
CVE-2026-12968 Product Addons – WowAddons < 1.6.15 - Unauthenticated Stored XSS via Arbitrary SVG Upload
The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes...
Security Bulletin: IBM Db2 Mirror for i is vulnerable to cross-site scripting due to Angular [CVE-2026-32635, CVE-2026-27970]
Summary The IBM Db2 Mirror for i GUI uses the Angular web framework. The version of Angular used by IBM Db2 Mirror for i is vulnerable to cross-site scripting as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-32635 DESCRIPTION: Angular is a development platfo...
[SECURITY] [DLA 4693-1] roundcube security update
Debian LTS Advisory DLA-4693-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin July 22, 2026 https://wiki.debian.org/LTS Package : roundcube Version : 1.4.15+dfsg.1-1+deb11u10 1.6.5+dfsg-1+deb12u10 CVE ID : CVE-2026-54432 CVE-2026-54433 CVE-2026-62641 CVE-2026-6264...
EUVD-2026-47587
A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSIS.php. Performing a manipulation of the argument day results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be...
EUVD-2026-47565
A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /class.php. Such manipulation of the argument day leads to cross site scripting. The attack can be launched remotely. The exploit has been...
PT-2026-63350
n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open without scheme validation. An attacker with workflow creation/editing privileges can cra...
PT-2026-63331
The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible...
PT-2026-63901
Name of the Vulnerable Software and Affected Versions TheGem versions prior to 5.11.2 Description The TheGem theme for WordPress contains a Stored Cross-Site Scripting XSS flaw resulting from insufficient input sanitization and output escaping. This allows authenticated attackers with...
Plone 3.3.x < 4.3.3 Multiple Vulnerabilities (HF 20131210)
The version of Plone installed on the remote host is 3.3.x and prior to 4.3.3. It is, therefore, affected by the following vulnerabilitites: - Products/CMFPlone/FactoryTool.py is initialized in class scope. CVE-2013-7060 - Products/CMFPlone/CatalogTool.py allows remote administrators to bypass...
Plone < 3.3.6 XSS
The version of Plone installed on the remote host is prior to 3.3.6. It is, therefore, affected by a cross-site scripting XSS vulnerability, in PortalTransforms due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this, by...
Plone < 4.2.3 Multiple Vulnerabilities (HF 20121106)
The version of Plone installed on the remote host is prior to 4.2.3. It is, therefore, affected by the following vulnerabilities: - registerConfiglet.py in Plone allows remote attackers to execute Python code via unspecified vectors, related to the admin interface. CVE-2012-5485 -...
Plone 3.3.x < 4.3.12 / 5.0.x < 5.0.7 Multiple Vulnerabilities (HF 20160830)
The version of Plone installed on the remote host is 3.3.x prior to 4.3.12, or 5.0.x 5.0.7. It is, therefore, affected by the following vulnerabilities: - Directory traversal vulnerability in Plone CMS allows remote administrators to read arbitrary files via a .. dot dot in the path parameter in ...
Plone 4.3 < 5.2.7 Reflected XSS and Open Redirect (HF 20220128)
The version of Plone installed on the remote host is 4.3 prior to 5.2.7. It is, therefore, affected by a reflected cross-site scripting XSS and open redirect vulnerability exists in 'Products.ATContentTypes'. An unauthenticated, remote attacker can get a compromised version of the...
PT-2026-63432
Froiden TableTrack through 1.3.10 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary HTML and JavaScript through the order notes field without sanitization. Attackers can craft malicious payloads in customer order placement that execute ...