CVE-2026-76789: Improper Neutralization of Input During Web Page Generation

The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users to store malicious JavaScript which will be execute...

CVE-2026-16260: Improper Neutralization of Input During Web Page Generation

The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in th...

PT-2026-79541

Name of the Vulnerable Software and Affected Versions AVideo versions prior to commit 9c39d8c8 Description An authentication bypass exists where the deduplicateByEncoderQueueId function returns video id hash credentials for any video based on the encoder queue id without verifying ownership...

PT-2026-79516

Name of the Vulnerable Software and Affected Versions WP Social Media Login versions prior to 1.0.7 Description The WP Social Media Login WordPress plugin fails to verify if a social login process was successfully completed with the identity provider before authenticating a visitor. This allows...

CVE-2026-69237

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, and 11.3 are encouraged to patch. All users are...

CVE-2026-49849 xShop: Unrestricted File Upload in File Attachment Module in Admin panel leads to Arbitrary Code Execution

xShop is an open-source shop developed in Laravel. An Unrestricted File Upload vulnerability in xShop version 3.0.3 allows an authenticated administrator to upload executable files e.g., .php. By uploading a specially crafted php file, an attacker can achieve Remote Code Execution RCE on the...

CVE-2026-49849

xShop is an open-source e-commerce platform built with Laravel . Version 3.0.3 contains an Unrestricted File Upload vulnerability in the File Attachment Module within the Admin panel. An authenticated administrator can upload executable files (e.g., .php), enabling Remote Code Execution (RCE) and...

CVE-2026-49849 xShop: Unrestricted File Upload in File Attachment Module in Admin panel leads to Arbitrary Code Execution

xShop is an open-source shop developed in Laravel. An Unrestricted File Upload vulnerability in xShop version 3.0.3 allows an authenticated administrator to upload executable files e.g., .php. By uploading a specially crafted php file, an attacker can achieve Remote Code Execution RCE on the...

CVE-2026-49849 xShop: Unrestricted File Upload in File Attachment Module in Admin panel leads to Arbitrary Code Execution

xShop is an open-source shop developed in Laravel. An Unrestricted File Upload vulnerability in xShop version 3.0.3 allows an authenticated administrator to upload executable files e.g., .php. By uploading a specially crafted php file, an attacker can achieve Remote Code Execution RCE on the...

CVE-2026-69237 HTML injection vulnerability in Esri Portal for ArcGIS

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, and 11.3 are encouraged to patch. All users are...

CVE-2026-69237 HTML injection vulnerability in Esri Portal for ArcGIS

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, and 11.3 are encouraged to patch. All users are...

Cross-site Scripting (XSS)

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the addJs and addCss methods in the Twig sandbox allowlist. An attacker can execute arbitrary scripts in the...

CVE-2026-70656

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.5.1 until 3.9.2, an authenticated admin or superadmin can set matchMethod to regex and place a malicious expression...

Exploit for CVE-2026-76564

Stored XSS via User-Agent in Admin Order View in PhocaCart...

CVE-2026-75932

Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authentication configuration, and reroute traffic to the attacker-controlled app. Once connected to the target domain, the attacker's workspace is populated with the victim's OAuth...

CVE-2026-75933

Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain...

CVE-2026-75933

Jet Admin is vulnerable to a stored cross-site scripting (XSS) flaw in the sign-in page's scripts and styles option. An authenticated attacker can inject arbitrary JavaScript that executes in the context of any visiting user's domain, enabling session hijacking, data exfiltration, or further comp...

CVE-2026-75933 Jet Admin Stored XSS

Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain...

EUVD-2026-63998

Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain...

CVE-2026-75933 Jet Admin Stored XSS

Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain...