Appsmith-1.98-Stored-XSS-Exploit

CVE-2026-7299 - Appsmith 1.98 Stored XSS SQL Autocomplete innerHTML Sink Automated exploit for a stored cross-site scripting vulnerability in Appsmith's SQL query editor. A workspace Developer can inject arbitrary JavaScript via database table names that execute in any other workspace member's...

code16/sharp: Server-side request forgery through an unanchored autocomplete endpoint check

Impact An authenticated attacker can call the Autocomplete API with the configured endpoint as a substring to request another server-side route. Patches The problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. The regex verifying the endpoint has been anchored to forbid...

GHSA-G6F8-C3X9-JV7F code16/sharp: Server-side request forgery through an unanchored autocomplete endpoint check

Impact An authenticated attacker can call the Autocomplete API with the configured endpoint as a substring to request another server-side route. Patches The problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. The regex verifying the endpoint has been anchored to forbid...

CVE-2026-25514

CVE-2026-25514: FacturaScripts has SQL Injection in Autocomplete Actions Overview Field| Details ---|--- CVE ID| CVE-2026-25514 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products facturascripts/facturascripts versions: 2025.81 CWE Classification CWE-20: Improper...

CVE-2026-126760

This module provides a field type for storing structured data with multiple sub-fields, along with several widgets including a Search - autocomplete widget. The module’s autocomplete endpoint does not sufficiently escape stored field values before returning them as suggestion labels, which can...

CVE-2026-126734

This module enables you to provide a way to embed parapraphs in any rich-text field using the WYSIWYG editor. The module doesn't sufficiently filter for malicious text in the autocomplete search filter, leading to a cross-site scripting vulnerability. This vulnerability is mitigated by the fact...

DRUPAL-CONTRIB-2026-339

This module provides a field type for storing structured data with multiple sub-fields, along with several widgets including a Search - autocomplete widget. The module’s autocomplete endpoint does not sufficiently escape stored field values before returning them as suggestion labels, which can...

DRUPAL-CONTRIB-2026-325

This module enables you to provide a way to embed parapraphs in any rich-text field using the WYSIWYG editor. The module doesn't sufficiently filter for malicious text in the autocomplete search filter, leading to a cross-site scripting vulnerability. This vulnerability is mitigated by the fact...

CVE-2024-9796

CVE-2024-9796 POC SQLi - CVE-2024-9796 Functional PoC for vulnerability CVE-2024-9796, which affects the WP Advanced Search autocompletion plugin in WordPress, allowing SQL injection through unsanitized GET parameters. 📌 Description This vulnerability allows an attacker to inject arbitrary SQL...

CVE-2026-18110-PoC

CVE-2026-18110 — Concrete CMS Unauthenticated User Enumeration Summary Concrete CMS 9.0.0 through 9.5.2 does not perform an authorization check on the user selector autocomplete endpoint /ccm/system/user/autocomplete, which backs the "Preview as User" panel and other user-selector components. Thi...

PT-2026-145650

This module enables you to provide a way to embed parapraphs in any rich-text field using the WYSIWYG editor. The module doesn't sufficiently filter for malicious text in the autocomplete search filter, leading to a cross-site scripting vulnerability. This vulnerability is mitigated by the fact...

PT-2026-145663

This module provides a field type for storing structured data with multiple sub-fields, along with several widgets including a Search - autocomplete widget. The module’s autocomplete endpoint does not sufficiently escape stored field values before returning them as suggestion labels, which can...

CVE-2026-120514

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'zpmprofilepicture' parameter in all versions up to, and including, 3.3.209 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-66982

HCL AION is affected by a vulnerability where browser autocomplete was enabled on sensitive login form fields, allowing the browser to store and suggest previously entered values. A malicious user with access to the same browser or system could retrieve saved credentials, potentially resulting in...

CVE-2026-66982

The HCL AION platform is affected by a security vulnerability where browser autocomplete is enabled on sensitive login form fields. This allows browsers to store and suggest previously entered values, which could allow a malicious user with access to the same browser or system to retrieve saved c...

EUVD-2026-118321

HCL AION is affected by a vulnerability where browser autocomplete was enabled on sensitive login form fields, allowing the browser to store and suggest previously entered values. A malicious user with access to the same browser or system could retrieve saved credentials, potentially resulting in...

CVE-2026-66982 HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where browser autocomplete was enabled on sensitive login form fields, allowing the browser to store and suggest previously entered values. A malicious user with access to the same browser or system could retrieve saved credentials, potentially resulting in...

CVE-2026-66982 HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where browser autocomplete was enabled on sensitive login form fields, allowing the browser to store and suggest previously entered values. A malicious user with access to the same browser or system could retrieve saved credentials, potentially resulting in...

CVE-2026-66982: HCL Software HCL AION: HCL AION is affected by a vulnerability where browser autocomplete was enabled on sensitive login form fields, allowing…

HCL AION is affected by a vulnerability where browser autocomplete was enabled on sensitive login form fields, allowing the browser to store and suggest previously entered values. A malicious user with access to the same browser or system could retrieve saved credentials, potentially resulting in...

CLEANSTART-2024-BK15179 In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue

Security vulnerability affects the otrs package. In the login screens in agent and customer interface, Username and Password fields use autocomplete, which might be considered as security issue...