CVE-2026-19230 SourceCodester Photo Share Website Comment Input Box ajax.php save_upload cross site scripting

A vulnerability was identified in SourceCodester Photo Share Website 1.0. This affects an unknown part of the file /social/ajax.php?action=saveupload of the component Comment Input Box. The manipulation of the argument content leads to cross site scripting. The attack may be initiated remotely. T...

CVE-2026-19230

CVE-2026-19230 affects SourceCodester Photo Share Website 1.0, specifically the file /social/ajax.php?action=save_upload in the Comment Input Box component. The vulnerability is Cross-Site Scripting (XSS) caused by manipulation of the input argument content. Attackers may exploit this remotely, a...

CVE-2026-19230

A vulnerability was identified in SourceCodester Photo Share Website 1.0. This affects an unknown part of the file /social/ajax.php?action=saveupload of the component Comment Input Box. The manipulation of the argument content leads to cross site scripting. The attack may be initiated remotely. T...

CVE-2026-19230 SourceCodester Photo Share Website Comment Input Box ajax.php save_upload cross site scripting

A vulnerability was identified in SourceCodester Photo Share Website 1.0. This affects an unknown part of the file /social/ajax.php?action=saveupload of the component Comment Input Box. The manipulation of the argument content leads to cross site scripting. The attack may be initiated remotely. T...

EUVD-2026-54572

A vulnerability was identified in SourceCodester Photo Share Website 1.0. This affects an unknown part of the file /social/ajax.php?action=saveupload of the component Comment Input Box. The manipulation of the argument content leads to cross site scripting. The attack may be initiated remotely. T...

CVE-2026-19230: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in SourceCodester Photo Share Website 1.0. This affects an unknown part of the file /social/ajax.php?action=saveupload of the component Comment Input Box. The manipulation of the argument content leads to cross site scripting. The attack may be initiated remotely. T...

CVE-2026-65504

Unauthenticated Broken Access Control in BOX NOW Delivery Croatia = 3.3.0 versions...

CVE-2026-65504

Unauthenticated Broken Access Control in BOX NOW Delivery Croatia = 3.3.0 versions...

CVE-2026-65504

CVE-2026-65504 describes an unauthenticated broken access control in the WordPress BOX NOW Delivery Croatia plugin, vulnerable in versions

CVE-2026-65504 WordPress BOX NOW Delivery Croatia plugin <= 3.3.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in BOX NOW Delivery Croatia = 3.3.0 versions...

EUVD-2026-53962

Unauthenticated Broken Access Control in BOX NOW Delivery Croatia = 3.3.0 versions...

CVE-2026-65504 WordPress BOX NOW Delivery Croatia plugin <= 3.3.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in BOX NOW Delivery Croatia = 3.3.0 versions...

CVE-2026-65504: Missing Authorization

Unauthenticated Broken Access Control in BOX NOW Delivery Croatia = 3.3.0 versions...

Malicious code in twork-data-services-invest-box-account (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce404950eecf61001f88758ef82a02523d93efe8d29c01f63521ff748b82c553 On module load, index.js requires./adapter.js which detects OS/architecture, fetches an opaque binary via https.get from string-concatenated Cloudfla...

CVE-2026-11977

The WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin for WordPress is vulnerable to generic SQL Injection via the 'wpmametaboxauthorslist' parameter in all versions up to, and including, 3.9.1 due to insufficient escaping on the user supplied parameter and lack...

EUVD-2026-53288

The WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin for WordPress is vulnerable to generic SQL Injection via the 'wpmametaboxauthorslist' parameter in all versions up to, and including, 3.9.1 due to insufficient escaping on the user supplied parameter and lack...

CVE-2026-11977: Improper Neutralization of Special Elements used in an SQL Command

The WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin for WordPress is vulnerable to generic SQL Injection via the 'wpmametaboxauthorslist' parameter in all versions up to, and including, 3.9.1 due to insufficient escaping on the user supplied parameter and lack...

PT-2026-67657

The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box, allowing users with the Contributor...

ctf-writeups

🏴 CTF Writeups & PoC Collection Documented solutions from Hac...

CVE-2026-15248

The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied attachment before deleting it, allowing users with a low-privilege role such as Contributor to permanently delete arbitrary media attachments belonging to other users...