CVE-2025-60378

CVE-2025-60378：RISE Ultimate Project Manager & CRM 中的存储型 HTML 注入漏洞 ⚠️ 安全公告 影响发票、消息传递和自动化通信的关键存储型 HTML 注入漏洞 -ff6600 📋 概述 在 RISE Ultimate Project Manager & CRM 中发现了一个关键的存储型 HTML 注入漏洞，该漏洞允许已认证用户将恶意 HTML 注入到发票行项目、客户备注和消息传递模块中。这些注入的内容会持久化存储在数据库中，并自动在面向客户的电子邮件、PDF...

CVE-2025-55903

CVE-2025-55903：PerfexCRM 中的存储型 HTML 注入漏洞 ⚠️ 安全公告 一个影响发票、账单和自动化通信的严重存储型 HTML 注入漏洞 -ff6600 📋 概述 在 PerfexCRM 中发现了一个存储型 HTML 注入漏洞，允许已认证用户将恶意 HTML 注入到发票描述、账单地址和客户备注中。该注入内容会持久化存储在数据库中，并自动在面向客户的电子邮件和 PDF 附件中渲染，从而能够发起大规模网络钓鱼攻击、商业电子邮件诈骗，并可能传播恶意软件。 🎯 受影响版本 产品： PerfexCRM 受影响版本： 3.3.1 修复版本： 3.3.1+ 🔍 漏洞详情 属性| ...

CVE-2026-33657

CVE-2026-33657 - EspoCRM 9.3.3 邮件通知中的存储型 HTML 注入 针对 EspoCRM 9.3.3 邮件通知中存储型 HTML 注入的已认证概念验证。 概述 EspoCRM 9.3.3 在渲染流动态通知邮件时，会通过 Markdown 转换动态正文，并将生成的 HTML 使用三重大括号（post）插入到邮件模板中。能够创建流动态帖子并触发通知的已认证用户，可以存储攻击者控制的 HTML，该 HTML 随后会在生成的邮件正文中被渲染。 该漏洞利用执行了攻击者控制的远程部分流程： 1. 向 EspoCRM 进行身份验证。 2. 可选地通过...

CVE-2025-63420

CVE-2025-63420 CrushFTP11 の 11.3.757 より前のバージョンは、CrushFTP 管理パネル（レポート / "Who Created Folder"）において保存型 HTML インジェクションの影響を受け、管理者セッションで永続的な HTML 実行が可能になります。 CWE CWE-79 — Improper Neutralization of Input During Web Page Generation クロスサイトスクリプティング CVSS v3.1 基本スコア: 4.1 中 AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N...

CVE-2025-63420

CVE-2025-63420 CrushFTP11 11.3.757 より前のバージョンは、CrushFTP 管理パネル（Reports / "Who Created Folder"）における保存型 HTML インジェクションに対して脆弱であり、管理者セッションでの永続的な HTML 実行を可能にします。 CWE CWE-79 — Web ページ生成時における入力の不適切な無効化（クロスサイトスクリプティング） CVSS v3.1 基本スコア: 4.1（中） AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N 修正されたバージョン ベンダーのチェンジログ（...

CVE-2023-2859

CVE-2023-2859: TeamPass 3.0.9 の管理者に影響するfolderNameへの保存型HTMLインジェクション - M Nadeem Qazi こんにちは、 nilsteampassnet/teampass アプリケーションにおいて、FolderNameフィールドに保存型HTMLインジェクションが発生する重大な脆弱性を発見しました。悪意のあるHTMLコードをFolderNameフィールドに挿入することで、攻撃者はフォルダ名を変更することができます。 脆弱性の詳細 脆弱性タイプ: 保存型HTMLインジェクション CVE: CVE-2023-2859...

CVE-2023-2591

CVE-2023-2591: Teampass 3.0.6 中项目标签的存储型HTML注入漏洞 - M Nadeem Qazi 我最近在 nilsteampassnet/teampass 这个流行的密码管理工具中发现了一个安全漏洞。该漏洞被标识为 CVE-2023-2591，是项目标签字段中的存储型HTML注入漏洞。如果两个用户具有相同的文件夹访问权限，恶意用户可以创建一个项目，其标签字段容易受到HTML注入攻击。当其他用户看到该项目时，可能会强制他们重定向到攻击者的网站，或者通过表单捕获他们的数据。 漏洞详情 漏洞类型：存储型HTML注入 CVE：CVE-2023-2591...

CVE-2026-67421 RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP authorization-error reason containing an attacker-controlled queue name as HTML when the OAuth management UI was enabled. Exploitation requires an...

EUVD-2026-86307

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components interpolated the free-form actioncodewho value into mention-link href attributes without URL encoding. A quote-bearing display name could...

CVE-2026-91120 Discourse: Stored HTML injection in video notification emails

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could creat...

CVE-2026-91119: Improper Neutralization of Input During Web Page Generation

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components interpolated the free-form actioncodewho value into mention-link href attributes without URL encoding. A quote-bearing display name could...

CVE-2026-81338

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding...

CVE-2026-81338

The MasterStudy LMS WordPress Plugin (versions before 3.7.50 ) is vulnerable to stored HTML injection due to insufficient sanitization and restriction of HTML in user-submitted content. This flaw allows users with subscriber-level accounts and above to inject malicious content, such as iframes , ...

CVE-2026-81338 MasterStudy LMS < 3.7.50 - Subscriber+ Stored HTML Injection via Course Discussions

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding...

CVE-2026-81338 MasterStudy LMS < 3.7.50 - Subscriber+ Stored HTML Injection via Course Discussions

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding...

CVE-2026-81338: Insufficient Verification of Data Authenticity

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding...

WordPress Royal Addons for Elementor plugin < 1.7.1067 - Unauthenticated Stored HTML Injection in Form Notification Emails vulnerability

Unauthenticated Stored HTML Injection in Form Notification Emails vulnerability discovered by Brian Willows in WordPress Plugin Royal Elementor Addons versions 1.7.1067...

CVE-2026-13407 Royal Elementor Addons < 1.7.1067 - Unauthenticated Stored HTML Injection in Form Notification Emails

The Royal Elementor Addons WordPress plugin before 1.7.1067 does not properly sanitize and escape values submitted through its form widget before including them in the body of administrator notification emails, allowing unauthenticated attackers to inject arbitrary HTML into emails sent to the si...

CVE-2026-89307

The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL Stored HTML Injection / Open Redirect...

EUVD-2026-78668

The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL Stored HTML Injection / Open Redirect...