CVE-2025-56807

CVE-2025-56807 Description Une vulnérabilité de type Cross Site Scripting XSS stocké a été découverte dans FairSketch RISE Ultimate Project Manager & CRM v3.9.4 dans la fonctionnalité de gestion de fichiers. La vulnérabilité réside dans le paramètre title qui est soumis lors de la création de...

CVE-2026-38961

A Cross-Site Scripting (XSS) vulnerability in the RSS Widget of Netgate pfSense Plus (versions 26.03 and 25.11.1) and pfSense CE (version 2.8.1) allows remote authenticated attackers to inject arbitrary JavaScript via malicious content in an RSS feed title. The root cause is insufficient sanitiza...

exploit-foxit-4.1.1-title-bof

Ce depot n’a pas de fichier README...

CVE-2026-78071

Stored XSS через поле Location Title в DPCalendar Free DPCalendar Free ≤ 10.11.2 — пользователь с ролью Author обходит проверку контента и внедряет постоянный XSS через поле Location Title, срабатывающий при наведении курсора у любого посетителя -orange КРАТКОЕ ОПИСАНИЕ Поле $location-title...

CVE-2026-82024

LearnPress WordPress Plugin before 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers with the Instructor role to inject persistent malicious payloads by submitting unsanitized input into quiz question answer title fields. Attackers can store arbitrary...

EUVD-2026-70651

LearnPress WordPress Plugin before 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers with the Instructor role to inject persistent malicious payloads by submitting unsanitized input into quiz question answer title fields. Attackers can store arbitrary...

CVE-2026-85106

A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/app/artifacts/index.tsx of the component Link Title Fetch. Such manipulation of the argument url leads to server-side request forgery. The attack can be launch...

EUVD-2026-70413

A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/app/artifacts/index.tsx of the component Link Title Fetch. Such manipulation of the argument url leads to server-side request forgery. The attack can be launch...

CVE-2026-85106 NousResearch hermes-agent Link Title Fetch index.tsx fetchLinkTitle server-side request forgery

A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/app/artifacts/index.tsx of the component Link Title Fetch. Such manipulation of the argument url leads to server-side request forgery. The attack can be launch...

CVE-2026-85106

A server-side request forgery (SSRF) vulnerability exists in NousResearch hermes-agent 0.18.0 , specifically in the fetchLinkTitle function within the file apps/desktop/src/app/artifacts/index.tsx (component: Link Title Fetch). Manipulating the url argument allows a remote attacker with low privi...

CVE-2026-23009-DICOM-Network-Image-Injection-Without-Authentication

CVE-2026-23009 – Injection d'images DICOM sur le réseau sans authentification Code du programme Python pydicom root@kitploit: dicomserversim.py - DICOM C-STORE SCP with no AE title check from pynetdicom import AE, evt, AllStoragePresentationContexts def handlestoreevent: ds = event.dataset No...

POC_CVE-2026-35037

CVE-2026-35037 Laboratoire SSRF Ech0 Ce dépôt contient un laboratoire de reproduction local et isolé pour CVE-2026-35037, une vulnérabilité SSRF non authentifiée dans le point d'accès GET /api/website/title d'Ech0. Le laboratoire utilise un serveur de preuves local contrôlé au lieu de métadonnées...

Bolt-CMS-3.6.2---Cross-Site-Scripting

Bolt CMS 3.6.2 - Vulnérabilité de type Cross-Site Scripting Bolt CMS 3.6.2 - Vulnérabilité de type Cross-Site Scripting CVE-2018-19933 https://vulners.com/cve/CVE-2018-19933 Preuve de concept Pour exploiter la vulnérabilité, Bolt CMS 3.6.2 permet une XSS via un champ de texte en cliquant sur le...

Craft-CMS-3.0.25---Cross-Site-Scripting

Craft-CMS-3.0.25 - Cross-Site Scripting XSS Craft CMS 3.0.25 - Vulnérabilité de type Cross-Site Scripting XSS CVE-CVE-2018-20418 https://vulners.com/cve/CVE-2018-20418 Preuve de concept Permet d'exécuter une attaque de type Cross-Site Scripting XSS en enregistrant un nouveau titre depuis l'onglet...

CVE-2026-6184-stored-XSS

Хранимый XSS в заголовке новостей - Simple Content Management System PHP Описание Уязвимость хранимого межсайтового скриптинга Stored XSS существует в Simple Content Management System PHP. Поле заголовка новостей News Title в админ-панели не очищает пользовательский ввод перед сохранением в базу...

CVE-2026-19719

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape the post title before outputting it in an inline JavaScript event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks which are triggered when...

CVE-2026-81197

The MasterStudy LMS WordPress plugin (versions before 3.7.46 ) contains an Unauthenticated Unpublished Course Title Disclosure vulnerability. The plugin's course-list REST route does not restrict access nor filter results by publication status, allowing unauthenticated users to retrieve the title...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.46 - Unauthenticated Unpublished Course Title Disclosure vulnerability

Unauthenticated Unpublished Course Title Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin MasterStudy LMS versions 3.7.46...

WordPress Rank Math SEO plugin < 1.0.277 - Author+ Term Metadata Update and Cross-Object Post Title Overwrite vulnerability

Author+ Term Metadata Update and Cross-Object Post Title Overwrite vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Rank Math SEO versions 1.0.277...

EUVD-2026-69833

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape the post title before outputting it in an inline JavaScript event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks which are triggered when...