EUVD-2026-84374

MISP contains a reflected cross-site scripting XSS vulnerability in the attribute histogram view. The $selectedTypes variable, which is derived from the URL path segment , was interpolated directly into a JavaScript array literal inside an onClick HTML attribute without any encoding or escaping. ...

CVE-2026-95661

MISP is affected by a reflected XSS vulnerability in the attribute histogram view . The root cause is the $selectedTypes variable, derived from the URL path segment, being interpolated directly into a JavaScript array literal inside an onClick HTML attribute without any encoding or escaping. An a...

CVE-2015-9357-POC

CVE-2015-9357 XSS almacenado en el analizador de smileys/emoticones de wordpress, creación de usuario administrador mediante solicitud nonce falsificada. escapa del contexto del atributo a través de la expresión regular de emoticones, coloca js en un manejador onerror. no se necesita etiqueta...

CVE-2026-39200

CVE-2026-39200 — Reflected Cross-Site Scripting XSS in Toko Online RotI Summary A reflected Cross-Site Scripting XSS vulnerability was identified in the produk request parameter of the Toko Online RotI web application. The application fails to HTML-encode user-supplied input before reflecting it...

CVE-2024-25293

MJML Local Code Execution PoC A Proof-Of-Concept for CVE-2024-25293 vulnerability. mjml-app v3.0.4 & 3.1.0-beta was discovered to contain a remote code execution RCE In this repository there is an example vulnerable application and proof-of-concept POC exploit of it. As a PoC there is a python fi...

CVE-2026-94404

MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user’s browser without that user knowingly approving the change. The affected function did not properly enforce MISP’s usual protection against forged requests. Because of this, an attacker...

CVE-2026-94404 MISP CSRF vulnerability allows unauthorized attribute modification

MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user’s browser without that user knowingly approving the change. The affected function did not properly enforce MISP’s usual protection against forged requests. Because of this, an attacker...

CVE-2026-94404

MISP (Malware Information Sharing Platform) versions prior to 2.5.47 are affected by a CSRF vulnerability in its attribute modification function. The function did not properly enforce MISP's usual protection against forged requests, allowing an attacker to craft a malicious webpage that silently ...

CVE-2026-94404 MISP CSRF vulnerability allows unauthorized attribute modification

MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user’s browser without that user knowingly approving the change. The affected function did not properly enforce MISP’s usual protection against forged requests. Because of this, an attacker...

CVE-2025-64459-Poc

CVE-2025-64459: PoC de Inyección SQL en ORM de Django Vulnerabilidad: Inyección SQL a través de QuerySet y desempaquetado de argumentos de palabra clave de Q. ID de CVE: CVE-2025-64459 Descubierto por: Yo Cyberstan Fecha de divulgación: 5 de noviembre de 2025 🚨 Resumen Ejecutivo Este repositorio...

CVE-2025-61638

CVE-2025-61638 node . "https://www.mediawiki.org/w/api.php" fixed More exploitable targets can be found at https://www.mediawiki.org/wiki/SitesusingMediaWiki. https://phabricator.wikimedia.org/T401099 https://vulners.com/cve/CVE-2025-61638 XSS attack requires editing entries, so at least xss !==...

https-nj.gov---CVE-2018-14041

https-nj.gov---CVE-2018-14041 Informe de Vulnerabilidad del sitio oficial de Nueva Jersey El atributo data-target es vulnerable a ataques de Cross-Site Scripting. Test RECOMENDACIÓN La solución para este problema específico podría ser cambiar la función getTargetFromTrigger. return $target a:...

CVE-2026-52774-YESWIKI-XSS

CVE-2026-52774-YESWIKI-XSS CVE-2026-52774 es una vulnerabilidad XSS reflejado en el manejador de widgets Bazar de YesWiki. El parámetro de consulta en el endpoint NoSuchPage/widget está sanitizado de forma inadecuada mediante striptags, que no escapa las comillas dobles. Esto permite a un atacant...

CVE-2023-23397-Report

CVE-2023-23397-Report An exploitation demo of Outlook Elevation of Privilege Vulnerability CVE-2023-23397 is a critical EoP vulnerability in Microsoft Outlook that is triggered when an attacker sends a message with an extended MAPI property with a UNC path to an SMB TCP 445 share on a threat...

CVE-2026-64705

CVE-2026-64705 — Desbordamiento de montón del kernel en xattr de HFS macOS Análisis de causa raíz y prueba de concepto para CVE-2026-64705, un desbordamiento de búfer en la extensión del kernel HFS corregido en macOS Sonoma 14.8.7 HT127117: HFS — Impacto: una app podría causar una terminación...

CVE-2019-7219

CVE-2019-7219 CVE-2019-7219 Zarafa Webapp Author: verifysecurity At least Webapp version 1.6-46049 till 2.0.1.47791 are affected. hxxps://127.0.0.1/webapp/?fccc0"5f43d=1...

CVE-2026-77820

The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

EUVD-2026-83465

The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-77820 WPComplete <= 2.9.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attribute

The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-77820 WPComplete <= 2.9.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attribute

The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...