10675 matches found
EUVD-2026-82687
The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at render time, allowing users with contributor-level access and above to include arbitrary local files, disclose their contents, and execute PH...
CVE-2026-88993 All Bootstrap Blocks <= 1.3.31 - Contributor+ Stored XSS via areoi/button type Attribute
The All Bootstrap Blocks WordPress plugin through 1.3.31 does not properly escape a block attribute before outputting it in HTML tag-name position, allowing users with Contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed...
CVE-2026-88993 All Bootstrap Blocks <= 1.3.31 - Contributor+ Stored XSS via areoi/button type Attribute
The All Bootstrap Blocks WordPress plugin through 1.3.31 does not properly escape a block attribute before outputting it in HTML tag-name position, allowing users with Contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed...
EUVD-2026-82679
The All Bootstrap Blocks WordPress plugin through 1.3.31 does not properly escape a block attribute before outputting it in HTML tag-name position, allowing users with Contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed...
Cross-site Scripting (XSS)
Grav is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper detection of event handlers when unpaired quotes are used in unquoted HTML attribute values, which allows an authenticated editor to bypass validation, inject malicious event handlers such as onerror=, and execut...
CVE-2024-37383_PoC
Repositorio para practicar directamente la vulnerabilidad CVE-2024-37383. Informe de análisis: blog / pdf CVE-2024-37383 Detalle Nombre : Roundcube Webmail SVG Parsing XSS Objetivo : Roundcube Webmail v1.5.7 o v1.6.x manipulada en un correo electrónico, se ejecuta un script arbitrario en el...
CVE-2026-15650
The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg WordPress plugin (versions ≤ 1.5.2) is vulnerable to an authenticated stored cross-site scripting (XSS) via the pointer_menu_item block attribute. The root cause is insufficient input sanitization and output escaping : the payload byp...
EulerOS 2.0 SP10 : libssh2 (EulerOS-SA-2026-3749)
According to the versions of the libssh2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation...
OpenNebula-CVE-2025-56535
OpenNebula-CVE-2025-56535 Título del Exploit : OpenNebula 6.10.0.1 - Stored XSS Cross-site Scripting in zone attribute Autor del Exploit : Mark Artamonov Sitio web del proveedor : https://opennebula.io/ Versión probada : OpenNebula 6.10.0.1 Versiones afectadas : OpenNebula Prueba de Concepto :...
EUVD-2026-60592
Grav: detectXss misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS...
Security Bulletin: Vulnerability in jackson-databind affects DB2 Dev Extension (CVE-2026-59888, CVE-2026-59889)
Summary Upgraded jackson-databind to 2.21.5 to remediate CVE-2026-59888 Improperly Controlled Modification of Dynamically-Determined Object Attributes and CVE-2026-59889 Incorrect Authorization — CVSS Base Score 6.5 Medium — PVR0820325. Vulnerability Details CVEID:CVE-2026-59888 DESCRIPTION:...
GHSA-269C-H76Q-8CXW Grav: Stored XSS via quoted-attribute bypass in detectXss
Summary A page editor without admin.super can place an event handler after a inside a quoted attribute. Grav accepts and stores the page, then executes the handler in the application origin when a visitor opens it. Details Security::detectXss system/src/Grav/Common/Security.php:253 anchors the...
Grav: Stored XSS via quoted-attribute bypass in detectXss
Summary A page editor without admin.super can place an event handler after a inside a quoted attribute. Grav accepts and stores the page, then executes the handler in the application origin when a visitor opens it. Details Security::detectXss system/src/Grav/Common/Security.php:253 anchors the...
EUVD-2026-58646
Grav: Stored XSS via quoted-attribute bypass in detectXss...
CVE-2026-90118
CVE-2026-90118 is an off-by-one page overflow in the Linux kernel's NTFS filesystem driver, specifically in ntfs_decompress(). The per-token range check tests dp_addr > dp_sb_end instead of dp_addr >= dp_sb_end, allowing one byte to be written past the destination page. Because NTFS_SB_SIZE...
EUVD-2026-81711
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one page overflow in ntfsdecompress The per-token range check in ntfsdecompress uses if cb = cbsbend || dpaddr dpsbend break; so dpaddr == dpsbend falls through to the symbol copy dpaddr++ = cb++, writing one byt...
CVE-2026-90118 ntfs: fix off-by-one page overflow in ntfs_decompress()
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one page overflow in ntfsdecompress The per-token range check in ntfsdecompress uses if cb = cbsbend || dpaddr dpsbend break; so dpaddr == dpsbend falls through to the symbol copy dpaddr++ = cb++, writing one byt...
CVE-2026-92987
roxmltree through 0.21.1 performs quadratic-time attribute and namespace validation during XML parsing without limits on attribute count. Attackers can craft XML documents with tens of thousands of attributes on a single element to consume excessive CPU time and cause denial of service...
CVE-2026-76781 Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute
A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a nextCatalog element lacks its mandatory catalog attribute, leading to the application crashing and causing a...
CVE-2026-76781 Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute
A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a nextCatalog element lacks its mandatory catalog attribute, leading to the application crashing and causing a...