45 matches found
CVE-2026-107710 Hustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title
The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'contenttitle' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for...
EUVD-2026-111605
The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'contenttitle' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-107710
The Hustle WordPress plugin (versions up to and including 7.8.14.3 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the 'content[title]' parameter. An authenticated attacker with custom-level access and above can injec...
CVE-2026-64795
Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in visitors’...
CVE-2018-9993
YUNUCMS 1.0.7 has XSS via the content title on an admin/content/addcontent/cid/ page aka a news center page...
SQL Injection
net.mingsoft:ms-mcms is vulnerable to SQL Injection. The vulnerability is due to improper sanitization of the contenttitle parameter in the /cms/content/list endpoint, which allows an attacker to inject and execute arbitrary SQL queries through crafted input in the FreeMarker template rendering...
EUVD-2025-34912
A SQL injection vulnerability in the contenttitle parameter of the /cms/content/list endpoint in MCMS 5.5.0 allows remote attackers to execute arbitrary SQL queries via unsanitized input in the FreeMarker template rendering...
MCMS vulnerable SQL injection via the content_title parameter
A SQL injection vulnerability in the contenttitle parameter of the /cms/content/list endpoint in MCMS 5.5.0 through 6.0.1 allows remote attackers to execute arbitrary SQL queries via unsanitized input in the FreeMarker template rendering...
GHSA-54WC-49QJ-5GHJ MCMS vulnerable SQL injection via the content_title parameter
A SQL injection vulnerability in the contenttitle parameter of the /cms/content/list endpoint in MCMS 5.5.0 through 6.0.1 allows remote attackers to execute arbitrary SQL queries via unsanitized input in the FreeMarker template rendering...
CVE-2025-56316
A SQL injection vulnerability in the contenttitle parameter of the /cms/content/list endpoint in MCMS 5.5.0 allows remote attackers to execute arbitrary SQL queries via unsanitized input in the FreeMarker template rendering...
SQL Injection
Overview Affected versions of this package are vulnerable to SQL Injection via unsanitized input in the contenttitle parameter of the /cms/content/list endpoint during FreeMarker template rendering. An attacker can execute arbitrary SQL queries by supplying crafted input. Remediation Upgrade...
CVE-2025-56316
The MCMS content management system (versions 5.5.0 through 6.0.1 ) is vulnerable to a SQL injection vulnerability (CWE-89). The root cause is the improper sanitization of the content_title parameter within the /cms/content/list endpoint during FreeMarker template rendering . This flaw allows remo...
CVE-2025-56316
A SQL injection vulnerability in the contenttitle parameter of the /cms/content/list endpoint in MCMS 5.5.0 allows remote attackers to execute arbitrary SQL queries via unsanitized input in the FreeMarker template rendering...
MingSoft MCMS security vulnerabilities
MingSoft MCMS is a complete open source J2ee system from China's MingSoft. A security vulnerability exists in MingSoft MCMS version 5.5.0, which stems from a FreeMarker template rendering without clearing the contenttitle parameter input, which could lead to a SQL injection attack...
CVE-2025-56316
A SQL injection vulnerability in the contenttitle parameter of the /cms/content/list endpoint in MCMS 5.5.0 allows remote attackers to execute arbitrary SQL queries via unsanitized input in the FreeMarker template rendering...
CVE-2025-56316
A SQL injection vulnerability in the contenttitle parameter of the /cms/content/list endpoint in MCMS 5.5.0 allows remote attackers to execute arbitrary SQL queries via unsanitized input in the FreeMarker template rendering...
PT-2025-42633
Name of the Vulnerable Software and Affected Versions MCMS version 5.5.0 Description A SQL injection issue exists in MCMS. The issue is due to unsanitized input within the FreeMarker template rendering, specifically affecting the content title parameter of the /cms/content/list API endpoint. This...
EUVD-2012-2690
Malware in sbrugna...