ids_bypass

Disclaimer These programs is for Educational purpose ONLY. Do not use it without permission. injectserver: Proof-Of-Concept for CVE-2018-6794. If as a server side you break a normal TCP 3 way handshake packets order and inject some response data before 3whs is complete then data still will be...

WordPress Ultimate FAQs <= 1.8.24 – Unauthenticated HTML Content Injection

Functions/EWDUFAQImport.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection. id: CVE-2019-17233 info: name: WordPress Ultimate FAQs = 1.8.24 – Unauthenticated HTML Content Injection author: daffainfo severity: medium description: | Functions/EWDUFAQImport.ph...

CVE-2026-110721

The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notificationx/v1/popup-submit REST route is registered with permissioncallback = 'returntrue', and the handler at...

CVE-2026-101335

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 1.58.1. This is due to the forminatorreplacequizformdata helper invoking doshortcode on the fully expanded notification bod...

EUVD-2026-102642

The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notificationx/v1/popup-submit REST route is registered with permissioncallback = 'returntrue', and the handler at...

CVE-2026-110721 NotificationX <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST Route

The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notificationx/v1/popup-submit REST route is registered with permissioncallback = 'returntrue', and the handler at...

CVE-2026-110721

The NotificationX plugin for WordPress (versions up to and including 3.3.3 ) is vulnerable to Missing Authorization leading to unauthenticated arbitrary content injection . The /notificationx/v1/popup-submit REST route uses a permission_callback set to __return_true, allowing unauthenticated atta...

EUVD-2026-102637

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 1.58.1. This is due to the forminatorreplacequizformdata helper invoking doshortcode on the fully expanded notification bod...

CVE-2026-101335

The Forminator Forms plugin for WordPress (versions up to and including 1.58.1 ) is vulnerable to unauthenticated arbitrary shortcode execution . The root cause lies in the forminator_replace_quiz_form_data() helper function, which calls do_shortcode() on a notification body after substituting th...

WordPress NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection vulnerability

Missing Authorization to Unauthenticated Arbitrary Content Injection vulnerability discovered by Eunho Kim in WordPress Plugin NotificationX versions = 3.3.3...

CLEANSTART-2026-OV41869 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

CVE-2026-56858 affects multiple packages. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. See references for individual vulnerability details...

CVE-2026-108069

The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restricted gallery before accepting comment submissions for its images, while it does perform that check when displaying comments, allowing unauthenticated attackers to inject...

EUVD-2026-100850

The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restricted gallery before accepting comment submissions for its images, while it does perform that check when displaying comments, allowing unauthenticated attackers to inject...

CVE-2026-108069

The Sunshine Photo Cart WordPress plugin (versions before 3.7.4 ) is vulnerable to unauthenticated content injection due to a lack of permission checks in the sunshine_modal_add_comment() function. While the plugin correctly validates access when displaying comments, it fails to verify if a visit...

CVE-2026-108069 Sunshine Photo Cart < 3.7.4 - Unauthenticated Content Injection via sunshine_modal_add_comment()

The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restricted gallery before accepting comment submissions for its images, while it does perform that check when displaying comments, allowing unauthenticated attackers to inject...

WordPress Sunshine Photo Cart plugin < 3.7.4 - Unauthenticated Content Injection vulnerability

Unauthenticated Content Injection vulnerability discovered by Raphael P. Cigana in WordPress Plugin Sunshine Photo Cart versions 3.7.4...

PT-2026-113675

The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restricted gallery before accepting comment submissions for its images, while it does perform that check when displaying comments, allowing unauthenticated attackers to inject...

Unity Linux 20.1070a Security Update: grafana-pcp (UTSA-2026-130157)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130157 advisory. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...

WordPress Broken Link Checker plugin <= 2.4.14.1 - Content Injection vulnerability

Content Injection vulnerability discovered by changsheng in WordPress Plugin Broken Link Checker versions = 2.4.14.1...

EUVD-2026-98201

SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An unauthenticated attacker could craft a malicious link that, when clicked by a victim, loads attacker-controlled content within the trusted application context. Successful exploitation could allo...