CVE-2026-92257

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in its L7 content management pages, specifically in the call board text and policy group handling components, which use eval() sinks to process input. Attackers with low privileges can inject persistent script...

CVE-2026-76873

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting (XSS) vulnerability in the DHCP dynamic IP display and ARP bind list display components. A LAN-based attacker can inject a malicious script via the hostname fields , which is subsequently rendered by network_config.js and n...

CVE-2026-76872

Netcore NR255-V firmware version 1.5.130703 contains a stored cross-site scripting (XSS) vulnerability in its DHCP static IP and IP ACL management pages. The affected CGI components are dhcp_add_staticip_cgi , dhcp_staticip_show_cgi , ip_acl_set_cgi , and ip_acl_show_cgi . An attacker with low pr...

CVE-2026-76867

Netcore NR255-V (firmware 1.5.130703 ) is affected by a stored cross-site scripting (XSS) vulnerability in four routing and NAT configuration CGI handlers: routing_tab_add_cgi , routing_table_list_show_cgi , route_policy_add_cgi , and route_policy_parame_show_cgi . Attackers with low privileges c...

CVE-2026-76864

Netcore NR255-V version 1.5.130703 suffers from a stored cross-site scripting (XSS) vulnerability in its QoS management interface. QoS rule names are not sanitized before being parsed via eval() in the qos_xianz_add_cgi, qos_xianz_show_cgi, qos_filter_add_cgi, and qos_filter_show_cgi CGI handlers...

CVE-2026-76858

Netcore NR255-V version 1.5.130703 is affected by a stored cross-site scripting (XSS) vulnerability in ddns_wan_list_show.cgi , caused by unsafe use of eval() to process DDNS data. An attacker with access to the DDNS configuration path can inject a malicious script that executes persistently when...

CVE-2023-43353-CMSmadesimple-Stored-XSS---News---Extra

CMSmadesimple Stored XSS v2.2.18 Author: Sergio Description: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Extra in the Content - News Menu. Attack Vectors: Scripting A vulnerability in the sanitization o...

CVE-2023-43356-CMSmadesimple-Stored-XSS---Global-Settings

CMSmadesimple XSS Almacenado v2.2.18 Autor: Sergio Descripción: Vulnerabilidad de Cross Site Scripting en CMSmadesimple v.2.2.18 permite a un atacante local ejecutar código arbitrario mediante un script manipulado en los Metadatos Globales en el menú de Configuración - Configuración Global...

CVE-2021-44217

CVE-2021-44217 Suggested description In Ericsson CodeChecker through 6.18.0, a Stored Cross-site scripting XSS vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API...

CVE-2025-44108-SXSS

CVE-2025-44108 - Stored cross site scriptingXSS vulnerabilities in the FlatPress CMS 1.3.1 Description A stored Cross-Site Scripting XSS vulnerability exists in the administration panel of Flatpress CMS 1.3.1. An attacker with admin privileges can inject a malicious JavaScript payload into the...

CVE-2026-9806

CVE-2026-9806 CVE-2026-9806 is a Stored Cross-Site Scripting Stored XSS vulnerability affecting CTI Transmute versions prior to the patched release.The flaw exists in the notification panel, where notification messages containing user-controlled convert names are rendered in the notification bell...

CVE-2023-44763_ConcreteCMS-Arbitrary-file-upload-Thumbnail

ConcreteCMS Stored XSS v.9.2.1 Author: Sergio Description: ConcreteCMS v9.2.1 is affected by Arbitrary File Upload vulnerability which allows Cross-Site Scriting XSS stored. Attack Vectors: A vulnerability in "Thumbnail" file upload sanitation allows you to upload a PDF / SVG /HTML file with hidd...

litespeed-cache-xss-poc

PoC de XSS en LiteSpeed Cache PoC de vulnerabilidad XSS en el plugin LiteSpeed Cache de WordPress que permite escalar privilegios. Esta vulnerabilidad fue corregida en la versión 5.7.0.1 del plugin y se le asignó CVE-2023-40000. Según la página de vista avanzada del plugin, aproximadamente el 35%...

EUVD-2026-79945

Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files containing potentially harmful elements" mode concrete.filemanager.images.svgsanitization.action = reject, uploaded SVGs were checked...

CVE-2026-81927

Concrete CMS before 9.5.3 contained a stored XSS vulnerability in SVG file handling, triggered only when the non-default "Reject files containing potentially harmful elements" sanitization mode was active. In this mode, uploaded SVGs were validated solely against a small built-in blocklist (the s...

CVE-2026-18426

Concrete CMS versions 9.0.0 through 9.5.2 contained an authorization flaw in the Express Form block 's control-management actions. The actions relied solely on CSRF token validation rather than a block-level edit-permission check. Because the token is bound to the user and action—not to a specifi...

EUVD-2026-79942

Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on the Express Form block's control-management actions, which relied solely on CSRF token validation. Because the token is bound to the user and action rather than to a specific block, page, or form, an...

CVE-2026-81926

Concrete CMS versions 9.4.0 through 9.5.2 are affected by a cross-site scripting (XSS) vulnerability in the location panel's duplicate-path confirmation dialog . The panel's check endpoint returned the submitted page path unmodified in its JSON response, and client-side JavaScript inserted each v...

EUVD-2026-79940

Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The panel's check endpoint returned the submitted path unmodified in its JSON response, and client-side JavaScript inserted each value into the...

Typecho-Multiple-Vulnerabilities

Múltiples Vulnerabilidades en Typecho Este repositorio contiene los exploits de las siguientes vulnerabilidades: CVE-2024-35538: En Typecho v1.3.0 existe una vulnerabilidad de Suplantación de IP del Cliente, que permite a actores maliciosos falsificar sus direcciones IP especificando una IP...