EUVD-2026-81352

The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before 2.1.3 does not have authorisation and CSRF checks in some of its AJAX actions, allowing any authenticated users, such as subscriber, to change the title of arbitrary posts, pages and products...

CVE-2026-91009 Active Products Tables for WooCommerce < 2.1.3 - Subscriber+ Arbitrary Post Title Modification via woot_update_attachment

The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before 2.1.3 does not have authorisation and CSRF checks in some of its AJAX actions, allowing any authenticated users, such as subscriber, to change the title of arbitrary posts, pages and products...

CVE-2026-92814

changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like email and Telegram as live content when the watchtitle token i...

CVE-2026-92381

A weakness has been identified in PbootCMS up to 3.2.22. This affects the function decodestring of the file apps/admin/controller/content/ContentController.php of the component Template Rendering. This manipulation of the argument Title causes cross site scripting. The attack is possible to be...

CVE-2026-92381 PbootCMS Template Rendering ContentController.php decode_string cross site scripting

A weakness has been identified in PbootCMS up to 3.2.22. This affects the function decodestring of the file apps/admin/controller/content/ContentController.php of the component Template Rendering. This manipulation of the argument Title causes cross site scripting. The attack is possible to be...

CVE-2026-92381 PbootCMS Template Rendering ContentController.php decode_string cross site scripting

A weakness has been identified in PbootCMS up to 3.2.22. This affects the function decodestring of the file apps/admin/controller/content/ContentController.php of the component Template Rendering. This manipulation of the argument Title causes cross site scripting. The attack is possible to be...

CVE-2026-92814: Improper Neutralization of Input During Web Page Generation

changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like email and Telegram as live content when the watchtitle token i...

CVE-2026-92381: Improper Neutralization of Input During Web Page Generation

A weakness has been identified in PbootCMS up to 3.2.22. This affects the function decodestring of the file apps/admin/controller/content/ContentController.php of the component Template Rendering. This manipulation of the argument Title causes cross site scripting. The attack is possible to be...

CVE-2026-58502

githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow runs when an issue is opened or closed and interpolates github.event.issue.title directly into the Bash assignment for ISSUETITLE before shell parsing. An issue title containing...

EUVD-2026-78911

githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow runs when an issue is opened or closed and interpolates github.event.issue.title directly into the Bash assignment for ISSUETITLE before shell parsing. An issue title containing...

CVE-2026-58502 githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow

githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow runs when an issue is opened or closed and interpolates github.event.issue.title directly into the Bash assignment for ISSUETITLE before shell parsing. An issue title containing...

CVE-2026-58502

githubtoplanguages , a tool that renders a user's top GitHub languages as an SVG, is affected by a command injection in its .github/workflows/discord-issue.yml GitHub Actions workflow. The workflow interpolates github.event.issue.title directly into a Bash assignment before shell parsing, so any ...

CVE-2026-58502 githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow

githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow runs when an issue is opened or closed and interpolates github.event.issue.title directly into the Bash assignment for ISSUETITLE before shell parsing. An issue title containing...

EUVD-2026-78784

A vulnerability was identified in WuzhiCMS up to 4.1.0. Affected by this issue is the function article::getDataOfJson of the file /index.php?m=content&f=article&v=getDataOfJson. The manipulation of the argument title/mastertable leads to sql injection. Remote exploitation of the attack is possibl...

CVE-2026-91848 WuzhiCMS index.php getDataOfJson sql injection

A vulnerability was identified in WuzhiCMS up to 4.1.0. Affected by this issue is the function article::getDataOfJson of the file /index.php?m=content&f=article&v=getDataOfJson. The manipulation of the argument title/mastertable leads to sql injection. Remote exploitation of the attack is possibl...

CVE-2026-91848

CVE-2026-91848 is a SQL injection vulnerability in WuzhiCMS up to 4.1.0 , specifically in the article::getDataOfJson function accessed via /index.php?m=content&f=article&v=getDataOfJson. Manipulating the title or master_table arguments allows a remote, unauthenticated attacker to inject SQL, resu...

CVE-2026-91848 WuzhiCMS index.php getDataOfJson sql injection

A vulnerability was identified in WuzhiCMS up to 4.1.0. Affected by this issue is the function article::getDataOfJson of the file /index.php?m=content&f=article&v=getDataOfJson. The manipulation of the argument title/mastertable leads to sql injection. Remote exploitation of the attack is possibl...

CVE-2026-91848 WuzhiCMS index.php getDataOfJson sql injection

A vulnerability was identified in WuzhiCMS up to 4.1.0. Affected by this issue is the function article::getDataOfJson of the file /index.php?m=content&f=article&v=getDataOfJson. The manipulation of the argument title/mastertable leads to sql injection. Remote exploitation of the attack is possibl...

CVE-2026-91848: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in WuzhiCMS up to 4.1.0. Affected by this issue is the function article::getDataOfJson of the file /index.php?m=content&f=article&v=getDataOfJson. The manipulation of the argument title/mastertable leads to sql injection. Remote exploitation of the attack is possibl...

PT-2026-92173

githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow runs when an issue is opened or closed and interpolates github.event.issue.title directly into the Bash assignment for ISSUE TITLE before shell parsing. An issue title containing...