7027 matches found
CVE-2026-2498
CVE-2026-2498 concerns the WordPress plugin WP Social Meta. Wordfence and CVE records indicate a Stored Cross-Site Scripting (Stored XSS) vulnerability in admin settings for WP Social Meta versions up to 1.0.1. The issue arises from insufficient input sanitization and output escaping, affecting m...
WordPress plugin Custom Logo 跨站脚本漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...
Fleet 安全漏洞
Fleet is an open-source device management platform developed by Fleet Device Management. It supports various operating systems and devices, and helps IT and security teams with device management, vulnerability reporting, MDM operations, etc. Versions of Fleet prior to 4.80.1 contained security...
CVE-2026-25743 OpenEMR has Stored XSS in Questionnaire answers
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, users with the "Forms administration" role can fill questionnaires "forms" in patient encounters. The answers to the forms are displayed on the encounter page and in th...
CVE-2026-25743
OpenEMR prior to v8.0.0 contains a stored XSS flaw in the questionnaire answer display path. Users with the Forms administration role can submit malicious payloads through form answers, and any user with that role viewing the encounter pages or visit history will execute the injected JavaScript. ...
CVE-2025-11845
A null pointer dereference vulnerability in the certificate downloader CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50ABPM.9.6C0 and the Zyxel WX3100-T0 firmware versions through 5.50ABVL.4.8C0 could allow an authenticated attacker with administrator privileges to trigger a...
PT-2026-21950
Name of the Vulnerable Software and Affected Versions Cisco FXOS Software affected versions not specified Cisco UCS Manager Software affected versions not specified Description A flaw exists in the web-based management interface of Cisco FXOS Software and Cisco UCS Manager Software that could...
PT-2026-21855
Name of the Vulnerable Software and Affected Versions Mercator versions prior to 2026.02.22 Description Mercator is a web application for mapping information systems. A stored Cross-Site Scripting XSS issue exists because of the use of unescaped Blade directives !! !! in display templates. An...
EUVD-2026-7399
A post-authentication command injection vulnerability in the TR-369 certificate download CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50ABPM.9.7C0 could allow an authenticated attacker with administrator privileges to execute operating system OS commands on an affected device...
CVE-2025-11846
A null pointer dereference vulnerability in the account settings CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50ABPM.9.6C0 and the Zyxel WX3100-T0 firmware versions through 5.50ABVL.4.8C0 could allow an authenticated attacker with administrator privileges to trigger a...
Zyxel VMG3625-T50B和Zyxel WX3100-T0 代码问题漏洞
Both Zyxel VMG3625-T50B and Zyxel WX3100-T0 are products of the Chinese company Zyxel. Zyxel VMG3625-T50B is a Wi-Fi device. Zyxel WX3100-T0 is a wireless bridge. There are code vulnerabilities in versions of Zyxel VMG3625-T50B 5.50ABPM.9.6C0 and earlier, as well as Zyxel WX3100-T0 5.50ABVL.4.8C0...
Zyxel VMG3625-T50B和Zyxel WX3100-T0 代码问题漏洞
Both Zyxel VMG3625-T50B and Zyxel WX3100-T0 are products of the Chinese company Zyxel. Zyxel VMG3625-T50B is a Wi-Fi device. Zyxel WX3100-T0 is a wireless bridge. There are code vulnerabilities in versions of Zyxel VMG3625-T50B 5.50ABPM.9.6C0 and earlier, as well as Zyxel WX3100-T0 5.50ABVL.4.8C0...
CVE-2026-26464
Stored Cross-Site Scripting XSS was found in the /admin/edituser.php page of Society Management System Portal V1.0, which allows remote attackers to inject and store arbitrary JavaScript code that is executed in users' browsers. This vulnerability can be exploited via the name parameter in a POST...
CVE-2026-22568
CVE-2026-22568 affects the ZIA Admin UI. An authenticated administrator could potentially retrieve unauthorized internal information due to improper neutralization of certain input in rare conditions. The CVSS 3.1 base score is 5.5 (Medium) with Privileges Required: High, User Interaction: None, ...
CVE-2026-22568 Unauthorized information retrieval in ZIA Admin UI
Improper neutralization of special elements in user-supplied input within the ZIA Admin UI could allow an authenticated administrator to access or retrieve unauthorized internal information in rare conditions...
Zscaler ZIA Admin UI 安全漏洞
Zscaler ZIA Admin UI is a management console interface for the cloud-native security gateway provided by Zscaler Inc. There is a security vulnerability in Zscaler ZIA Admin UI, which stems from improper validation of user input. This vulnerability could allow authenticated administrators to trigg...
CVE-2026-1649
The Community Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cevenuename' parameter in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-lev...
CVE-2019-25405
Comodo Dome Firewall 2.7.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input to the newLicense parameter. Attackers can send POST requests to the license activation endpoint with script payloads in the newLicense fie...
CVE-2025-13590
A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution. By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by...