CVE-2026-61875 luci-app-upnp Stored XSS via UPnP Port Mapping Description

luci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LAN clients to inject JavaScript via UPnP IGD AddPortMapping SOAP requests. Attackers can send malicious HTML in the NewPortMappingDescription field, which miniupnpd stores and luci-app-upnp renders...

EUVD-2024-55335

CE Phoenix v3.0.1 contains a stored cross-site scripting vulnerability in the currencies administration panel that allows attackers to inject malicious scripts. Attackers can insert XSS payloads in the title field to execute arbitrary JavaScript when administrators view the currencies page...

phpList SQL Injection Vulnerability (CNVD-2020-75154)

phpList is an open source newsletter and email marketing software from phpList UK. A SQL injection vulnerability exists in phpList 3.5.9. The vulnerability can be exploited to inject SQL queries via the attribute on line 4 of the "Config - Import Administrators" page...