Appsmith-1.98-Stored-XSS-Exploit

CVE-2026-7299 - Appsmith 1.98 저장형 XSS SQL 자동완성 innerHTML 싱크 Appsmith SQL 쿼리 편집기의 저장형 사이트 간 스크립팅 취약점에 대한 자동화된 익스플로잇입니다. 워크스페이스 개발자는 데이터베이스 테이블 이름을 통해 임의의 JavaScript를 주입할 수 있으며, 이는 다른 워크스페이스 구성원이 SQL 자동완성을 트리거할 때 해당 구성원의 브라우저에서 실행됩니다. Appsmith v1.98 에서 확인되었으며, 사용자 정의 SQL 힌트 렌더러가 존재하는 모든 이전 버전에도 영향을...

CVE-2026-87759

The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisi...

CVE-2026-87759

The Add User Autocomplete WordPress plugin before 1.2 fails to perform a capability or nonce check before creating a pending site-membership invitation that carries a caller-supplied role. This allows any authenticated user (e.g., a subscriber) to grant themselves the administrator role on a mult...

EUVD-2026-76798

The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisi...

CVE-2026-87759 Add User Autocomplete < 1.2 - Subscriber+ Privilege Escalation

The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisi...

CVE-2026-25514

CVE-2026-25514: FacturaScriptsのオートコンプリートアクションにおけるSQLインジェクション 概要...

CVE-2024-9796

CVE-2024-9796 POC SQLi - CVE-2024-9796 CVE-2024-9796 취약점에 대한 기능적 PoC입니다. 이 취약점은 WordPress의 WP Advanced Search 자동 완성 플러그인에 영향을 미치며, 정제되지 않은 GET 매개변수를 통해 SQL 인젝션SQL Injection을 허용합니다. 📌 설명 이 취약점은 공격자가 자동 완성 엔드포인트의 t 매개변수를 통해 임의의 SQL 쿼리를 주입할 수 있도록 합니다:...

CVE-2026-84437

A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function of the file catalog/controller/account/address.php of the component Autocomplete Workflow. The manipulation of the argument address1 results in cross site scripting. It is possible to launch the...

CVE-2026-84438

A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/controller/account/edit.php of the component Autocomplete Workflow. This manipulation of the argument firstname causes cross site scripting. The attack can be initiated remotely. The...

CVE-2026-84438

OpenCart 4.1.0.3 and 4.1.0.4 are affected by a stored cross-site scripting (XSS) vulnerability in the Autocomplete Workflow component, specifically in the file catalog/controller/account/edit.php. The vulnerability is triggered through manipulation of the firstname argument, allowing a remote, au...

EUVD-2026-69801

A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/controller/account/edit.php of the component Autocomplete Workflow. This manipulation of the argument firstname causes cross site scripting. The attack can be initiated remotely. The...

CVE-2026-84438 OpenCart Autocomplete Workflow edit.php cross site scripting

A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/controller/account/edit.php of the component Autocomplete Workflow. This manipulation of the argument firstname causes cross site scripting. The attack can be initiated remotely. The...

CVE-2026-84437

A cross-site scripting (XSS) vulnerability affects OpenCart 4.1.0.3 and 4.1.0.4 , specifically in the Autocomplete Workflow component within the file catalog/controller/account/address.php. Manipulating the address_1 argument allows a remote, authenticated (low-privilege) attacker to inject scrip...

CVE-2026-84437 OpenCart Autocomplete Workflow address.php cross site scripting

A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function of the file catalog/controller/account/address.php of the component Autocomplete Workflow. The manipulation of the argument address1 results in cross site scripting. It is possible to launch the...

EUVD-2026-69799

A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function of the file catalog/controller/account/address.php of the component Autocomplete Workflow. The manipulation of the argument address1 results in cross site scripting. It is possible to launch the...

PT-2026-84585

Name of the Vulnerable Software and Affected Versions OpenCart versions 4.1.0.3 through 4.1.0.4 Description An issue exists in the Autocomplete Workflow component within the file catalog/controller/account/address.php. Remote manipulation of the address 1 argument allows for cross site scripting,...

Address Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-103

The Address Suggestion module provides address autocomplete functionality using configured address providers. The module doesn't sufficiently sanitize address suggestion data returned by configured providers, which can lead to a cross-site scripting XSS vulnerability. This vulnerability is...

CVE-2026-16640

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0...

CVE-2026-16640

Drupal Search API Autocomplete (versions 0.0.0 through 1.12.0) is affected by a Reflected XSS vulnerability. The root cause is a test script that is accessible to anonymous users and fails to sufficiently validate user input, allowing malicious scripts to be injected and reflected back. The issue...

CVE-2026-16640 Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0...