CVE-2025-52122

CVE CraftCMS Freeform CraftCMS Freeform contains an SSTI vulnerability, resulting in arbitrary code injection for all users that have access to editing a form submission title. Vulnerable versions are v5.0.0 test % set form = freeform.form'pentest' % % if form % form.render % else % Form not foun...

CVE-2025-65640

CVE-2025-65640 1. Vulnerability Information CVE ID: CVE-2025-65640 Currently RESERVED Vulnerability Type: Stored Cross-Site Scripting XSS CVSSv3 score: 6.3 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N Vendor: Arket/Bluenext S.r.l. Product: Globe Document Intelligence Affected Version: 5.0.0.559 Discoverer...

CVE-2022-43332

CVE-2022-43332 Cross Site Scripting in WonderCMS Description: A cross-site scripting XSS vulnerability in Wondercms v3.3.4 allows potential attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Site title field of the Configuration Panel - coupled with the fac...

CVE-2023-31584

CVE-2023-31584 - Cross Site Scripting vulnerability in cu/silicon Github link: https://github.com/cu/silicon Version Affected: 1 Severity and CVSS: Will update when review is done by NIST. Type: Cross Site Scripting Root Cause: Lack of proper input validation and sanitization before inserting...

-CVE-2021-26904

CVE-2021-26904 LMA ISIDA Retriever 5.2 allows SQL Injection Suggested description : "ISIDA RETRIEVER v5.2" SQL Injection Vulnerable functionality : ISIDA RETRIEVER Platform is vulnerable to SQL Injection Vulnerable URL and paramert : website.com/index.php?title=Injection Vulnerable URL and parame...

CVE-2024-41503

CVE-2024-41503 CVE: CVE-2024-41503 Software: Jetimob Plataforma Imobiliaria CRM/ERP/CMS Version: 20240627-0 Vulnerability: Stored Cross-Site Scripting XSS Description: The "Busca" search function used throughout the application contains a filter option that can be saved - when saving it, there is...

CVE-2022-35501

CVE-2022-35501 Stored Cross-site Scripting XSS in blog-post creation functionality in Amasty Blog Pro for Magento 2 Description The post creation functionality in the Amasty Blog Pro 2.10.3 and 2.10.4 plugin for Magento 2 allows injection of JavaScript code in the title field, leading to XSS...

CVE-2026-36392

CVE-2026-36392: Stored XSS in RISE CRM Item Title Field Summary A stored cross-site scripting XSS vulnerability exists in the item title field of RISE CRM RISE - Ultimate Project Manager & CRM versions = 3.9.6. An authenticated administrator can inject arbitrary JavaScript into an item's title,...

CVE-2026-108908

A vulnerability was identified in Netcore NR268 1.7.121109. Affected by this vulnerability is the function eval of the file /router/l7callboarduserset.cgi of the component Web UI. Such manipulation of the argument title/note/URL/content leads to cross site scripting. The attack can be launched...

CVE-2023-43357-CMSmadesimple-Stored-XSS---Shortcut

CMSmadesimple Stored XSS v2.2.18 Author: Sergio Description: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title in the My Preferences - Manage Shortcuts Attack Vectors: Scripting A vulnerability in the...

CVE-2023-43358-CMSmadesimple-Stored-XSS---News

CMSmadesimple Stored XSS v2.2.18 Author: Sergio Description: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title in the Content - News Menu. Attack Vectors: Scripting A vulnerability in the sanitization o...

CVE-2025-54352

CVE-2025-54352 PoC Usage Steps to install and test the WordPress PoC: 1. Install a fresh version of WordPress using Docker: 1.1 Start the MySQL database container: docker run --name wp-db -e MYSQLDATABASE=wp-db -e MYSQLUSER=wpuser -e MYSQLPASSWORD=password -e MYSQLROOTPASSWORD=rootpass -d...

CVE-2025-66024

CVE-2025-66024: XWiki Blog Application home page vulnerable to Stored XSS via Post Title Overview Field| Details ---|--- CVE ID| CVE-2025-66024 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products org.xwiki.contrib.blog:application-blog-ui versions: alert'XSS in...

CVE-2023-44758_GDidees-CMS-Stored-XSS---Title

GDidees Stored XSS v3.0 Author: Sergio Description: Cross Site Scripting vulnerability in GDidees v.3.0 allows a local attacker to execute arbitrary code via a crafted script to the Page Title. Attack Vectors: Scripting A vulnerability in the sanitization of the entry in the Page Title allows...

CVE-2026-108700

1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling POST /field/source/business-title without permission checks. Users lacking CONTRACTBUSINESSTITLEREAD can retrieve organization invoicing entities,...

EUVD-2026-96708

1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling POST /field/source/business-title without permission checks. Users lacking CONTRACTBUSINESSTITLEREAD can retrieve organization invoicing entities,...

CVE-2026-108700 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title

1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling POST /field/source/business-title without permission checks. Users lacking CONTRACTBUSINESSTITLEREAD can retrieve organization invoicing entities,...

CVE-2026-108700

1Panel-dev CordysCRM versions before 1.9.2 are vulnerable to a missing authorization flaw (CWE-862) within the /field/source/business-title endpoint. Authenticated users can perform a POST request to this endpoint without the required CONTRACT_BUSINESS_TITLE_READ permission. Successful exploitati...

CVE-2026-108700 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title

1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling POST /field/source/business-title without permission checks. Users lacking CONTRACTBUSINESSTITLEREAD can retrieve organization invoicing entities,...

CVE-2026-108700: Missing Authorization

1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling POST /field/source/business-title without permission checks. Users lacking CONTRACTBUSINESSTITLEREAD can retrieve organization invoicing entities,...