EUVD-2026-67778

The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to issue queries through the BI Connector can influence log content so that markup supplied in a query...

CVE-2026-76798 MongoSQL Transition Readiness Tool Improper Output Encoding in Generated HTML Reports

The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to issue queries through the BI Connector can influence log content so that markup supplied in a query...

CVE-2026-76794

MongoSQL Transition Readiness Tool (part of the MongoDB BI Connector) contains an improper HTML encoding flaw when processing database metadata. A MongoDB user with write access can inject crafted metadata that, when another user generates and opens the Transition Readiness Report, may cause scri...

EUVD-2026-67873

MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce crafted metadata that may cause script code to run when another user generates and opens the report, potentially exposing report...

CVE-2025-67923

Relatório de Exploração CVE-2025-67923 JetEngine = 3.7.7 — Cross-Site Scripting Armazenado Não Autenticado via API REST CCT Data: 11 de março de 2026 Pontuação CVSS: 7.1 Alta Vetor CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Plug-in Afetado: JetEngine = 3.7.7 Slug do Plug-in: jet-engine...

CVE-2026-40179-PoC

CVE-2026-40179 — Gespeichertes XSS in Prometheus über remotewrite Ein minimaler, dependency-armer Proof of Concept für CVE-2026-40179 GHSA-vffh-x6r8-xx99: gespeichertes Cross-Site-Scripting in der Prometheus-Web-UI, ausgeliefert über einen nicht authentifizierten remotewrite-Endpunkt. Die...

CVE-2024-50803-Redaxo

CVE-2024-50803 Stored XSS in der Mediapool-Funktion von Redaxo In Redaxo-Versionen 5.18.0 wurde eine gespeicherte Cross-Site-Scripting XSS-Schwachstelle gefunden, die es Angreifern mit ausreichenden Berechtigungen ermöglicht, eine schädliche SVG-Datei über die Mediapool-Funktion hochzuladen...

Wildfire

Wildfire CVE-2026-39154 · Stored XSS in CometChat-Gruppennachrichten Gespeichertes Cross-Site-Scripting. CWE 79. CometChat JS SDK 3.0.12. Offengelegt im Februar 2026 als Anfrage 42660. Der Anbieter markierte sie als gelöst. CVE von MITRE zugewiesen. Zusammenfassung Ein authentifizierter Benutzer...

CVE-2026-55247 plone.app.event: Denial of service via iCalendar import

plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported events, and commits work per...

CVE-2026-55247

plone.app.event , Plone's event content type, contains multiple issues in its iCalendar import (src/plone/app/event/ical/importer.py) prior to versions 5.2.4 and 6.0.1 . The importer accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported ...

CVE-2026-54433

CVE-2026-54433: Roundcube प्लेन-टेक्स्ट ईमेल स्टोर्ड XSS इस रिपॉजिटरी में CVE-2026-54433 के लिए एक कॉन्फ़िगर करने योग्य Python प्रूफ ऑफ कॉन्सेप्ट है, जो Roundcube के प्लेन-टेक्स्ट ईमेल रेंडरर में एक स्टोर्ड क्रॉस-साइट स्क्रिप्टिंग भेद्यता है। एक अनप्रमाणित प्रेषक एक विशेष रूप से तैयार text/plain...

plone.app.portlets vulnerable to denial of service via RSS feed portlet

Impact By adding an RSS portlet, and giving this a link to a very large file, a member can cause a denial of service attack, because Plone will use lots of memory. The member could also use different urls to try to get information about the internal network and open port numbers SSRF. A malicious...

CVE-2022-40348_Intern-Record-System-Cross-site-Scripting-V1.0-Vulnerability-Unauthenticated

CVE-2022-40348: Intern Record System - Cross-site Scripting XSS não autenticado nos parâmetros 'name' e 'email' Título do Exploit: Intern Record System - Cross-site Scripting XSS não autenticado nos parâmetros 'name' e 'email' Data: 2022-06-09 Autor do Exploit: Hamdi Sevben Homepage do Fornecedor...

CVE-2026-55248

plone.app.portlets (Plone CMS) is vulnerable to three issues in its RSS feed portlet, all fixed in versions 5.0.8, 6.0.4, and 7.0.2 . A low-privileged member can set the RSS feed URL to a very large response, causing excessive in-memory data retention and denial of service via the FEED_DATA cache...

CVE-2026-55248 plone.app.portlets: Denial of service via RSS feed portlet

plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8, 6.0.4, and 7.0.2, a member who can add an RSS portlet can set its feed URL to a very large response, causing src/plone/app/portlets/portlets/rss.py to download and retain excessive data in...

Bludit-3.13.1-TAGS-Field-Stored-Cross-Site-Scripting-XSS

CVE-2021-45744 Exploit-Titel: Bludit 3.13.1 - Gespeichertes Cross-Site-Scripting XSS im TAGS-Feld Exploit-Autor: SANU P.L CVE: CVE-2021-45744 CVSS: 5.4 MEDIUM Referenzen: https://www.plsanu.com/bludit-3-13-1-tags-field-stored-cross-site-scripting-xss https://nvd.nist.gov/vuln/detail/CVE-2021-4574...

CVE-2026-11101-HTTP-Cache-Poisoning-via-Unkeyed-Query-Parameter

CVE-2026-11101 – Avvelenamento della cache HTTP tramite parametro di query non incluso nella chiave Panoramica Una cache web utilizza solo il percorso dell'URL come chiave della cache, ignorando i parametri di query. Un attaccante può aggiungere un payload dannoso a un parametro non incluso nella...

CVE-2026-9806

CVE-2026-9806 CVE-2026-9806 è una vulnerabilità di Cross-Site Scripting persistente Stored XSS che interessa le versioni di CTI Transmute precedenti alla release corretta. Il difetto risiede nel pannello delle notifiche, dove i messaggi di notifica contenenti nomi di convert controllati dall'uten...

CVE-2026-9811

CVE-2026-9811 CVE-2026-9811 è una vulnerabilità di Cross-Site Scripting persistente Stored XSS che colpisce Mautic 7 versioni dalla 7.0.0 alla 7.1.1. La vulnerabilità è presente nel componente Project Selector, dove i nomi dei progetti restituiti tramite una richiesta AJAX vengono inseriti nella...

CVE-2026-41472-POC

CyberPanel XSS to RCE CVE-2026-41472 Esecuzione remota di codice con un solo clic in CyberPanel v2.4.3 tramite endpoint API non autenticati. Panoramica Questo exploit combina più vulnerabilità della funzionalità AI Scanner di CyberPanel: 1. Iniezione nel database non autenticata...