1047672 matches found
PT-2026-69869
Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6 Discourse versions prior to 2026.5.2 Discourse versions prior to 2026.6.1 Discourse versions prior to 2026.7.0 Description The discourse-local-dates plugin renders crafted local-date format data as HTML. Th...
Exploit for CVE-2026-64638
🔥 XSS2Shell — CVE-2026-64638 Scanner & PoC Toolkit Behav...
Exploit for CVE-2026-64638
CVE-2026-64638 — XSS2Shell Proof of Concept A proof-of-concep...
CVE-2026-16032 LWS Optimize < 4.1.2 - Unauthenticated Stored XSS via Real User Monitoring
The LWS Optimize WordPress plugin before 4.1.2 does not properly escape a value submitted through an unauthenticated analytics endpoint before storing it and rendering it in an administrative dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when an...
CVE-2026-16032
The CVE-2026-16032 affects the LWS Optimize WordPress plugin (pre-4.1.2). The root cause is improper escaping of a value submitted via an unauthenticated analytics endpoint, which is stored and later rendered in an administrative dashboard. This enables unauthenticated attackers to inject arbitra...
Exploit for CVE-2026-64638
CVE-2026-64638 — XSS2Shell WordPress Pre-Auth Reflected XSS...
Exploit for CVE-2026-64638
🔍 @Mr-LeonardoGomes 💀 XSS2Shell-CVE-2026-64638...
Exploit for CVE-2026-64638
💥 CVE‑2026‑64638 – WordPress XSS2Shell S...
xss2shell
XSS2Shell CVE-2026-64638 pre-auth reflected XSS on...
Exploit for CVE-2026-64638
XSS2Shell Multi-Target Scanner Developer: YogaGymn PoC/s...
EUVD-2026-54727
The Easy Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordionTitleTag' block attribute in versions up to, and including, 3.1.8. This is due to insufficient input sanitization and output escaping in the accordionheaderrenderer function, which emits the...
CVE-2026-48026
lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to version 1.81.1 of the open source edition and 1.84.0 of the enterprise edition, lakeFS Web UI renders markdown files from repository objects without sanitizing the resulting HTML. A user with write...
Exploit for CVE-2026-64638
🛡️ CVE-2026-64638 - XSS2Shell WordPress Pre-Authentic...
CVE-2026-62293
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the hidden scan command concatenates attacker-controlled Implementation Guide titles, profile titles, and source references into scan.html without escaping in Scanner.java. As...
CVE-2026-62293 HAPI FHIR: Stored XSS in scan report via unescaped IG and profile titles
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the hidden scan command concatenates attacker-controlled Implementation Guide titles, profile titles, and source references into scan.html without escaping in Scanner.java. As...
CVE-2026-64638
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires...
CVE-2026-64638
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires...
EUVD-2026-54565
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires...
Exploit for CVE-2026-64638
XSS2Shell — WordPress Pre-Auth XSS → RCE Chain PoC CVE-2026...
CVE-2026-48093
CVE-2026-48093 affects the Code Embed WordPress plugin (pre-2.6.1). The vulnerability is a stored XSS in the external URL embed feature used in post content: the code scans rendered content for URL embed tokens, fetches the remote URL, and inserts the remote response body into the page without ou...