Appsmith-1.98-Stored-XSS-Exploit

CVE-2026-7299 - Appsmith 1.98 저장형 XSS SQL 자동완성 innerHTML 싱크 Appsmith SQL 쿼리 편집기의 저장형 사이트 간 스크립팅 취약점에 대한 자동화된 익스플로잇입니다. 워크스페이스 개발자는 데이터베이스 테이블 이름을 통해 임의의 JavaScript를 주입할 수 있으며, 이는 다른 워크스페이스 구성원이 SQL 자동완성을 트리거할 때 해당 구성원의 브라우저에서 실행됩니다. Appsmith v1.98 에서 확인되었으며, 사용자 정의 SQL 힌트 렌더러가 존재하는 모든 이전 버전에도 영향을...

CVE-2026-25514

CVE-2026-25514: FacturaScripts 자동완성Autocomplete 기능의 SQL 인젝션 취약점 개요...

CVE-2026-18110

Concrete CMS 9 9.0.0 through 9.5.2 does not perform an authorization check on the user selector autocomplete endpoint /ccm/system/user/autocomplete, which backs the "Preview as User" panel and other user-selector components. The endpoint validates only a CSRF-style access token that is bound to t...

CVE-2026-18110

Concrete CMS 9 (versions 9.0.0 through 9.5.2) contains a missing authorization check on the user selector autocomplete endpoint (/ccm/system/user/autocomplete). The endpoint validates only a CSRF-style token bound to display options rather than caller identity, and that token is issued to anonymo...

EUVD-2026-78830

Concrete CMS 9 9.0.0 through 9.5.2 does not perform an authorization check on the user selector autocomplete endpoint /ccm/system/user/autocomplete, which backs the "Preview as User" panel and other user-selector components. The endpoint validates only a CSRF-style access token that is bound to t...

CVE-2026-18110 Concrete CMS 9.0.0 through 9.5.2 is vulnerable to missing authorization in the user selector autocomplete endpoint (/ccm/system/user/autocomplete), allowing an unauthenticated attacker to retrieve the complete backend user directory — internal ID, username

Concrete CMS 9 9.0.0 through 9.5.2 does not perform an authorization check on the user selector autocomplete endpoint /ccm/system/user/autocomplete, which backs the "Preview as User" panel and other user-selector components. The endpoint validates only a CSRF-style access token that is bound to t...

CVE-2024-9796

CVE-2024-9796 POC SQLi - CVE-2024-9796 CVE-2024-9796 취약점에 대한 기능적 PoC입니다. 이 취약점은 WordPress의 WP Advanced Search 자동 완성 플러그인에 영향을 미치며, 정제되지 않은 GET 매개변수를 통해 SQL 인젝션SQL Injection을 허용합니다. 📌 설명 이 취약점은 공격자가 자동 완성 엔드포인트의 t 매개변수를 통해 임의의 SQL 쿼리를 주입할 수 있도록 합니다:...

CVE-2026-87759

The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisi...

CVE-2026-87759

The Add User Autocomplete WordPress plugin before 1.2 fails to perform a capability or nonce check before creating a pending site-membership invitation that carries a caller-supplied role. This allows any authenticated user (e.g., a subscriber) to grant themselves the administrator role on a mult...

CVE-2026-87759 Add User Autocomplete < 1.2 - Subscriber+ Privilege Escalation

The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisi...

EUVD-2026-76798

The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisi...

CVE-2026-84437

A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function of the file catalog/controller/account/address.php of the component Autocomplete Workflow. The manipulation of the argument address1 results in cross site scripting. It is possible to launch the...

CVE-2026-84438

A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/controller/account/edit.php of the component Autocomplete Workflow. This manipulation of the argument firstname causes cross site scripting. The attack can be initiated remotely. The...

CVE-2026-84438

OpenCart 4.1.0.3 and 4.1.0.4 are affected by a stored cross-site scripting (XSS) vulnerability in the Autocomplete Workflow component, specifically in the file catalog/controller/account/edit.php. The vulnerability is triggered through manipulation of the firstname argument, allowing a remote, au...

EUVD-2026-69801

A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/controller/account/edit.php of the component Autocomplete Workflow. This manipulation of the argument firstname causes cross site scripting. The attack can be initiated remotely. The...

CVE-2026-84438 OpenCart Autocomplete Workflow edit.php cross site scripting

A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/controller/account/edit.php of the component Autocomplete Workflow. This manipulation of the argument firstname causes cross site scripting. The attack can be initiated remotely. The...

CVE-2026-84437

A cross-site scripting (XSS) vulnerability affects OpenCart 4.1.0.3 and 4.1.0.4 , specifically in the Autocomplete Workflow component within the file catalog/controller/account/address.php. Manipulating the address_1 argument allows a remote, authenticated (low-privilege) attacker to inject scrip...

CVE-2026-84437 OpenCart Autocomplete Workflow address.php cross site scripting

A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function of the file catalog/controller/account/address.php of the component Autocomplete Workflow. The manipulation of the argument address1 results in cross site scripting. It is possible to launch the...

EUVD-2026-69799

A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function of the file catalog/controller/account/address.php of the component Autocomplete Workflow. The manipulation of the argument address1 results in cross site scripting. It is possible to launch the...

PT-2026-84585

Name of the Vulnerable Software and Affected Versions OpenCart versions 4.1.0.3 through 4.1.0.4 Description An issue exists in the Autocomplete Workflow component within the file catalog/controller/account/address.php. Remote manipulation of the address 1 argument allows for cross site scripting,...