133 matches found
CVE-2025-44108-SXSS
CVE-2025-44108 - ΠΠ΅ΠΆΡΠ°ΠΉΡΠΎΠ²ΡΠΉ ΡΠΊΡΠΈΠΏΡΠΈΠ½Π³ XSS Ρ ΡΠΎΡ ΡΠ°Π½Π΅Π½ΠΈΠ΅ΠΌ Π² FlatPress CMS 1.3.1 ΠΠΏΠΈΡΠ°Π½ΠΈΠ΅ Π ΠΏΠ°Π½Π΅Π»ΠΈ ΡΠΏΡΠ°Π²Π»Π΅Π½ΠΈΡ Flatpress CMS 1.3.1 ΡΡΡΠ΅ΡΡΠ²ΡΠ΅Ρ ΡΡΠ·Π²ΠΈΠΌΠΎΡΡΡ ΠΌΠ΅ΠΆΡΠ°ΠΉΡΠΎΠ²ΠΎΠ³ΠΎ ΡΠΊΡΠΈΠΏΡΠΈΠ½Π³Π° XSS Ρ ΡΠΎΡ ΡΠ°Π½Π΅Π½ΠΈΠ΅ΠΌ. ΠΠ»ΠΎΡΠΌΡΡΠ»Π΅Π½Π½ΠΈΠΊ Ρ ΠΏΡΠ°Π²Π°ΠΌΠΈ Π°Π΄ΠΌΠΈΠ½ΠΈΡΡΡΠ°ΡΠΎΡΠ° ΠΌΠΎΠΆΠ΅Ρ Π²Π½Π΅Π΄ΡΠΈΡΡ Π²ΡΠ΅Π΄ΠΎΠ½ΠΎΡΠ½ΡΡ JavaScript-Π½Π°Π³ΡΡΠ·ΠΊΡ Π² ΡΠΈΡΡΠ΅ΠΌΡ, ΠΊΠΎΡΠΎΡΠ°Ρ...
prosey
Prosey Prosey λ YouTubeμμ λμμ μλ§μ λ€μ΄λ‘λνκ³ νμνλ CLI λꡬλ‘, μ μκ°μ λλΉνμ§ μκ³ μνλ μ 보λ₯Ό μ»μ μ μκ² ν΄μ€λλ€. μ£Όμ μ¬μ© μ¬λ‘λ λ€μκ³Ό κ°μ΅λλ€: μμ½ : λ¨μΌ λͺ λ ΉμΌλ‘ YouTube λμμμ μμ½νκ³ CLIμ νμν©λλ€ λ λΉ λ¦. μ½κΈ° : μλ³Έ λμμμ²λΌ μ±ν°λ³λ‘ μ 리λκ³ νμνλ λμμ μλ§μ μ½μ΅λλ€ μ’ μ’ λ λ§μ μκ°μ΄ νμν¨. λ μ¬μ© μ¬λ‘ λͺ¨λ μμ€ν μ AI μ΄μμ€ν΄νΈκ° νμν©λλ€ κΈ°λ³Έκ°: opencode, prosey configλ₯Ό μ¬μ©νμ¬ μ§μ ꡬμ±ν μ μμ΅λ...
NPM: Ghost: Cross-Site Scripting in Feature Image Captions
NPM: Ghost: Cross-Site Scripting in Feature Image Captions vulnerability discovered by ? in WordPress Npm ghost versions = 4.9.0, 6.54.1...
Ghost: Cross-Site Scripting in Feature Image Captions
Impact An input validation issue allowed any staff user to create a post with content that could be used to hijack another staff user's Ghost Admin session resulting in privilege escalation. Vulnerable versions This vulnerability is present in Ghost from v4.9.0 up to v6.54.0. Patches v6.54.1...
GHSA-PR22-P9RP-2CQV Ghost: Cross-Site Scripting in Feature Image Captions
Impact An input validation issue allowed any staff user to create a post with content that could be used to hijack another staff user's Ghost Admin session resulting in privilege escalation. Vulnerable versions This vulnerability is present in Ghost from v4.9.0 up to v6.54.0. Patches v6.54.1...
EUVD-2026-53391
Ghost is a Node.js content management system. From 4.9.0 until 6.54.1, an input validation issue allowed any staff user to create a post with content in featureimagecaption that could be used to hijack another staff user's Ghost Admin session, resulting in privilege escalation. This issue is fixe...
CVE-2026-70596 Ghost: Cross-Site Scripting in Feature Image Captions
Ghost is a Node.js content management system. From 4.9.0 until 6.54.1, an input validation issue allowed any staff user to create a post with content in featureimagecaption that could be used to hijack another staff user's Ghost Admin session, resulting in privilege escalation. This issue is fixe...
CVE-2026-70596
Ghost (Node.js CMS) is affected from versions 4.9.0 through 6.54.1 by an input validation issue in feature_image_caption that could be exploited by a staff user to hijack another staff userβs Ghost Admin session, enabling privilege escalation. The issue is fixed in 6.54.1. The provided metrics in...
CVE-2026-14833
The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does not sanitise or escape a link data attribute before rendering it into the image lightbox caption in the browser, allowing users with author-level access and above who lack the unfilteredhtml capability to store JavaScript that runs...
CVE-2026-11581
The Kali Forms β Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.13 does not sanitise a form field's caption before outputting it as a column header on the administrator form-entries screen, allowing users with Contributor-level access or above to store JavaScript that executes i...
GO-2026-5540 SiYuan: Remote Code Execution in the Electron desktop client via stored XSS in synced table captions in github.com/siyuan-note/siyuan/kernel
SiYuan: Remote Code Execution in the Electron desktop client via stored XSS in synced table captions in github.com/siyuan-note/siyuan/kernel...
CVE-2026-41318
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to version 1.12.1, AnythingLLM's in-chat markdown renderer has an unsafe custom rule for images that interpolates the markdown image's alt text into an HTML alt="..."...
CVE-2026-8869 Mutual Funds Data <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute
The Mutual Funds Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' shortcode attribute in versions up to, and including, 1.2.1. This is due to insufficient input sanitization and output escaping on the user supplied 'title' attribute in the mfdshortcode...
CVE-2026-7636
The Slider by Soliloquy β Responsive Image Slider for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.1 via the mapmetacap. This makes it possible for authenticated attackers, with subscriber-level access and above, to extra...
EUVD-2026-31416
The Slider by Soliloquy β Responsive Image Slider for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.1 via the mapmetacap. This makes it possible for authenticated attackers, with subscriber-level access and above, to extra...
CVE-2026-5428
The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image captions in the Image Grid/Slider/Carousel widget in versions up to and including 1.7.1056. This is due to insufficient output escaping in the renderpostthumbnail function, where wpksespost is...
CVE-2026-5428
The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image captions in the Image Grid/Slider/Carousel widget in versions up to and including 1.7.1056. This is due to insufficient output escaping in the renderpostthumbnail function, where wpksespost is...
CVE-2026-5428 Royal Addons for Elementor <= 1.7.1056 - Authenticated (Author+) Stored Cross-Site Scripting via Image Caption Field
The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image captions in the Image Grid/Slider/Carousel widget in versions up to and including 1.7.1056. This is due to insufficient output escaping in the renderpostthumbnail function, where wpksespost is...
EUVD-2026-25400
The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image captions in the Image Grid/Slider/Carousel widget in versions up to and including 1.7.1056. This is due to insufficient output escaping in the renderpostthumbnail function, where wpksespost is...
CVE-2026-5428 Royal Addons for Elementor <= 1.7.1056 - Authenticated (Author+) Stored Cross-Site Scripting via Image Caption Field
The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image captions in the Image Grid/Slider/Carousel widget in versions up to and including 1.7.1056. This is due to insufficient output escaping in the renderpostthumbnail function, where wpksespost is...