CVE-2026-54613

Vvveb is a CMS with a page builder for websites, blogs, and ecommerce stores. Prior to 1.0.8.5 , the function getThemeFolder() in admin/controller/editor/revisions.php returns the attacker-controlled theme parameter without sanitization. The method sanitizeBackupFileName() strips traversal charac...

cve-2025-50946

cve-2025-50946 CVE-2025-50946（OliveTin get-theme RCE）用のエクスプロイトスクリプトです。文字の要件が非常に厳しく、複数の引数を含む多くのコマンドは正しく実行されない可能性があります。根本原因の調査やスクリプトの堅牢化にはまだ時間をかけていません。必要な場合はご連絡いただくか、PRを開いてください。 このスクリプトの基となったオリジナルの調査は chrisWalker11 によるものです: リンク 使用例 基本PoC: root@kitploit: python cve-2025-50946.py -t...

CVE-2021-3030

CVE-2021-3030 — Cute Editor 6.4 反射型跨站脚本（XSS） CVE ID： CVE-2021-3030 状态： 由 CVE 计划（MITRE）于 2021-01-06 保留。该 ID 从未发布过任何公开记录——本文档即为完成该发布所需的公开参考。 漏洞类型： 跨站脚本（XSS），反射型 — CWE-79 发现者： Athos Nogueira Gonzaga 厂商： CuteSoft（Cute Editor for ASP.NET）— https://cutesoft.net/ 受影响版本： Cute Editor...

CVE-2025-63499

theme パラメータにおける標的型反射型 XSS 研究者: Arseniy Poblaguev、Daniil Khomichenok 影響を受けるバージョン = 5.12.4 https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.4 日付: 02.12.2025 theme パラメータには反射型 XSS の脆弱性があります:...

USN-8504-1 sogo vulnerabilities

It was discovered that SOGo did not properly sanitize categories used for events, tasks, and contacts. A remote authenticated attacker could possibly use this issue to perform cross-site scripting attacks. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu...

📄 Event Booking Calendar 5.0 Cross Site Scripting

Event Booking Calendar version 5.0 suffers from a cross site scripting vulnerability. Titles: Event Booking Calendar-5.0 Cross-site scripting reflected Author: nu11secur1ty Date: 5/13/2026 Vendor: https://www.phpjabbers.com/ Software: https://www.phpjabbers.com/event-booking-calendar/ Reference:...

📄 Car Rental Script 4.0 Cross Site Scripting

Car Rental Script version 4.0 suffers from a cross site scripting vulnerability. Titles: Car-Rental-Script4.0-XSS-Reflected Cross-site scripting reflected Author: nu11secur1ty Date: 05/08/2026 Vendor: https://www.phpjabbers.com/ Software: https://www.phpjabbers.com/car-rental-script/ Reference:...

CVE-2026-1988

The Flexi Product Slider and Grid for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0.5 via the flexipsgcarousel shortcode. This is due to the theme parameter being directly concatenated into a file path without proper sanitization ...

PT-2026-8087

The Flexi Product Slider and Grid for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0.5 via the flexipsg carousel shortcode. This is due to the theme parameter being directly concatenated into a file path without proper sanitization...

[SECURITY] [DLA 4434-1] sogo security update

Debian LTS Advisory DLA-4434-1 [email protected] https://www.debian.org/lts/security/ Tobias Frost January 06, 2026 https://wiki.debian.org/LTS Package : sogo Version : 5.0.1-4+deb11u3 CVE ID : CVE-2024-34462 CVE-2025-63499 Debian Bug : 1071163 1121952 Several XSS vulnerabiltiies have...

CVE-2020-24223

Mara CMS 7.5 allows cross-site scripting XSS in contact.php via the theme or pagetheme parameters...

MailEnable theme parameter cross-site scripting vulnerability

MailEnable is a commercial email server software designed for Windows operating systems that provides end-to-end email hosting and collaboration solutions. MailEnable suffers from a cross-site scripting vulnerability that originates from the lack of effective filtering and escaping of user-suppli...

CVE-2025-63499

Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting XSS via the theme parameter...

CVE-2025-34407

MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the theme parameter of /Mondo/lang/sys/Forms/Statistics.aspx. The theme value is insufficiently sanitized when processed via a GET request and is reflected in the response, allowing an attacker to bre...

EUVD-2025-202197

MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the theme parameter of /Mondo/lang/sys/Forms/Statistics.aspx. The theme value is insufficiently sanitized when processed via a GET request and is reflected in the response, allowing an attacker to bre...

CVE-2025-34407

MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the theme parameter of /Mondo/lang/sys/Forms/Statistics.aspx. The theme value is insufficiently sanitized when processed via a GET request and is reflected in the response, allowing an attacker to bre...

CVE-2025-34407

MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the theme parameter of /Mondo/lang/sys/Forms/Statistics.aspx. The theme value is insufficiently sanitized when processed via a GET request and is reflected in the response, allowing an attacker to bre...

CVE-2025-34407 MailEnable < 10.54 Reflected XSS in theme Parameter of Statistics.aspx

MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the theme parameter of /Mondo/lang/sys/Forms/Statistics.aspx. The theme value is insufficiently sanitized when processed via a GET request and is reflected in the response, allowing an attacker to bre...

CVE-2025-34407

MailEnable prior to 10.54 contains a reflected XSS in the theme parameter of /Mondo/lang/sys/Forms/Statistics.aspx. The theme value is echoed via GET and can break out of iframes, enabling attacker-supplied script execution in a victim’s browser, with potential redirection, cookie theft, or HTML/...

CVE-2025-34407 MailEnable < 10.54 Reflected XSS in theme Parameter of Statistics.aspx

MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the theme parameter of /Mondo/lang/sys/Forms/Statistics.aspx. The theme value is insufficiently sanitized when processed via a GET request and is reflected in the response, allowing an attacker to bre...