CVE-2021-46417

CVE-2021-46417 Franklin Fueling Systems Colibri Controller Module - Local File Inclusion Optional Arguments: -h, --help show this help message and exit -u url, --url url Target url eg:"http://127.0.0.1" -f file, --file file Targets in file eg:"ip.txt" Use python3 CVE-2021-46417.py -u...

CVE-2026-107758

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2026-107758 Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2026-107758 Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

EUVD-2026-102618

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2026-107758

The Colibri Page Builder plugin for WordPress (versions ≤ 1.0.390 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the comment parameter. The root cause is insufficient input sanitization and output escaping, where the comment allow-list permits SVG elements with arbitrary data-* attribut...

PT-2026-115403

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2026-107758: Improper Neutralization of Input During Web Page Generation

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

WordPress Colibri Page Builder plugin <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Tudor Lasuschevici Eutiphron in WordPress Plugin Colibri Page Builder versions = 1.0.390...

extendthemes colibri page builder cross-site scripting vulnerability

The extendthemes colibri page builder versions 1.0.390 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the comment parameter, which may lead to stored-cross-site scripting attacks. Unauthenticated attackers c...

Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 - Local File Inclusion Detection

Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 is susceptible to local file inclusion because of insecure handling of a download function that leads to disclosure of internal files due to path traversal with root privileges. !/usr/bin/env python3 -- coding: utf-8 -- """Franklin...

Malicious code in @colibri-event-types/megamarket-ru-web (npm)

Source: amazon-inspector c4780aaf3b99e11830e6a5eda56c287f9f8e93d375f1f59320ecc9849ebdf4fe scripts/postinstall.js is registered as the npm postinstall lifecycle script and is heavily packed with obfuscator.io string-array rotation plus a self-defending/anti-debug IIFE. On install it calls...

8x8: @jitsi/docker-jitsi-meet: `/colibri-relay-ws/` unsafe nginx regex (OCTO relay configuration)

An unsafe nginx regex pattern was discovered in the /colibri-relay-ws/ location of the @jitsi/docker-jitsi-meet project. The regex a-zA-Z0-9-\.+ accepted arbitrary domain names and IP addresses for proxypass directives, allowing unauthenticated requests to be proxied to attacker-specified...

Implementation and Transition to Post-Quantum Cryptography of the Minimal IKE Protocol

This paper concerns the Minimal Internet Key Exchange IKE protocol, which has received little attention to date, despite its potential to make the best-known IKE protocol sufficiently lightweight to be also applied in contexts where it is currently prohibitive, due to its large footprint. First, ...

WordPress Colibri Page Builder plugin <= 1.0.272 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'colibri_breadcrumb_element' Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'colibribreadcrumbelement' Shortcode vulnerability discovered by stealthcopter in WordPress Plugin Colibri Page Builder versions = 1.0.272...

WordPress Colibri Page Builder plugin <= 1.0.276 - Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_video_player Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via colibrivideoplayer Shortcode vulnerability discovered by Ngô Thiên An ancorn in WordPress Plugin Colibri Page Builder versions = 1.0.276...

CVE-2023-50833

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ExtendThemes Colibri Page Builder allows Stored XSS.This issue affects Colibri Page Builder: from n/a through 1.0.239...

CVE-2024-2839

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibriposttitle' shortcode in all versions up to, and including, 1.0.263 due to insufficient input sanitization and output escaping on user supplied attributes such as 'headingtype'. This...

CVE-2025-11747

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the colibriblogposts shortcode in all versions up to, and including, 1.0.345 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-11747

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the colibriblogposts shortcode in all versions up to, and including, 1.0.345 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...