71 matches found
CVE-2026-73848
Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An attacker can create a tag containing ';alertdocument.domain;//. The addslashes function does not escape HTML entities, so ' is stored as-i...
CVE-2026-73848 Emlog: Stored XSS via Tag Name in Article Editor
Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An attacker can create a tag containing ';alertdocument.domain;//. The addslashes function does not escape HTML entities, so ' is stored as-i...
EUVD-2026-71626
Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An attacker can create a tag containing ';alertdocument.domain;//. The addslashes function does not escape HTML entities, so ' is stored as-i...
CVE-2026-73848 Emlog: Stored XSS via Tag Name in Article Editor
Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An attacker can create a tag containing ';alertdocument.domain;//. The addslashes function does not escape HTML entities, so ' is stored as-i...
CVE-2026-73848 Emlog: Stored XSS via Tag Name in Article Editor
Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An attacker can create a tag containing ';alertdocument.domain;//. The addslashes function does not escape HTML entities, so ' is stored as-i...
PT-2026-86177
CVE-2026-73848: XSS in emlog ≤2.6.29 via unescaped tag names in article editor. Attacker executes arbitrary JS via crafted tag—full account takeover risk. CVSS N/A. UNPATCHED. Update or restrict editor access immediately. Details: https://t.co/utDcwWYnT1 cybersecurit valtersit CVE CVEAlert infose...
CVE-2026-85138
A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file weixin/index.php of the component WeChat Module. The manipulation of the argument Content results in sql injection. The attack may be launched remotely. The exploit is now public and may be used...
CVE-2026-85138 SeaCMS WeChat index.php addslashes sql injection
A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file weixin/index.php of the component WeChat Module. The manipulation of the argument Content results in sql injection. The attack may be launched remotely. The exploit is now public and may be used...
CVE-2026-85138 SeaCMS WeChat index.php addslashes sql injection
A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file weixin/index.php of the component WeChat Module. The manipulation of the argument Content results in sql injection. The attack may be launched remotely. The exploit is now public and may be used...
CVE-2026-46686
Emlog is an open source website building system. In 2.6.13 and earlier, the admin backend user search module's keyword parameter from admin/user.php is processed with addslashes but not HTML-escaped before being rendered into the value attribute in admin/views/user.php, allowing reflected...
VulnCheck KEV: CVE-2021-4458
The Modern Events Calendar Lite plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'wpajaxmecloadsinglepage' AJAX action in all versions up to, and including, 6.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2021-4458
The Modern Events Calendar Lite plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'wpajaxmecloadsinglepage' AJAX action in all versions up to, and including, 6.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2023-1016
The Intuitive Custom Post Order plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.1.4.1, due to insufficient escaping on the user supplied 'objects' and 'tags' parameters and lack of sufficient preparation in the 'updateoptions' function as well as the...
CVE-2010-4660
Unspecified vulnerability in statusnet through 2010 due to the way addslashes are used in SQL string escapes...
emlog security vulnerabilities
emlog is emlog open source a set of PHP and MySQL based CMS site building system . A security vulnerability exists in emlog version 2.5.7 and 2.5.8. The vulnerability stems from searchcontroller.php not using adslashes after urldecode, which may lead to SQL injection...
adodb library Authentication Bypass
The vulnerability of the adodbaddslashes function in the adodb library is related to incorrect authentication. Exploiting this vulnerability could allow an attacker to bypass the authentication process...
PT-2022-7305
Name of the Vulnerable Software and Affected Versions adodb versions prior to 5.20.21 Description The issue is related to an authentication bypass weakness in the adodb library. This weakness can be exploited by a remote attacker to bypass the authentication process. The vulnerability is associat...
GTranslate < 2.8.65 - Reflected Cross-Site Scripting (XSS)
In the Pro and Enterprise versions of GTranslate alert123;...
ImpressCMS: SQL injection when configuring a database
Summary: I found a SQL Injection in the form of a system install Database configuration Steps To Reproduce: - Run command: git clone https://github.com/ImpressCMS/impresscms.git - Stop at a menu item: Database configuration - In the Database name field, insert the following exploit: sql...
