CVE-2026-92977

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2023-31853

CVE-2023-31853 Une attaque de type Cross-Site Scripting XSS réfléchi existe dans l'interface de gestion web du Cudy LT400. La page /cgi-bin/luci/admin/network/bandwidth présente une XSS réfléchie via le paramètre icon. Les méthodes d'exploitation consistent à envoyer une requête spécialement conç...

cve-2025-5777-citrixbleed2_reproduction

CVE-2025-5777 — CitrixBleed 2 Утечка памяти Citrix NetScaler CVSS 9.3 — Критический — Активная эксплуатация в реальных условиях CitrixBleed 2 — это уязвимость раскрытия памяти в Citrix NetScaler ADC и NetScaler Gateway. Недостаточная проверка входных данных в конечной точке аутентификации приводи...

CVE-2026-92977

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 5.3.5 . The root cause is insufficient input sanitization and output escaping, specifically where a page-wide regex strips closing quo...

CVE-2026-92977 Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via Comment

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

EUVD-2026-91892

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

TBK DVR4104/DVR4216 Devices - Authentication Bypass

TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-branded versions of the original TBK DVR4104 and DVR4216 series, allow remote attackers to bypass authentication via a "Cookie: uid=admin"...

PT-2026-104577

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description A cross-site scripting defect exists where the SAML message, relay state, and target URL are placed unencoded into the load-balancer cookie bounce auto-submit page. This issue is reachable when...

PT-2026-104493

Name of the Vulnerable Software and Affected Versions The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress versions prior to 5.3.6 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject...

CVE-2026-92977: Improper Neutralization of Input During Web Page Generation

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2026-105116: Improper Neutralization of Input During Web Page Generation

OpenAM before 16.1.3 contains a latent cross-site scripting defect that places the SAML message, relay state and target URL unencoded into the load-balancer cookie bounce auto-submit page. If reachable with cookieHashRedirectEnabled set, crafted requests could execute script in the OpenAM origin,...

PT-2026-104550

Name of the Vulnerable Software and Affected Versions Burst Statistics – Simple WordPress Analytics Google Analytics Alternative versions prior to 3.7.2 Description Improper authentication allows for account persistence. The maybe load shared dashboard handler issues a genuine WordPress session...

cve-2026-19900-PoC

CVE-2026-19900 LB-LINK X-PRO Обход аутентификации и RCE через null-пользователя CVE-2026-19900 Жёстко заданные учётные данные и обход аутентификации с RCE через null-пользователя. Обход через заголовок: Cookie:user=null Использование Соберите и запустите скрипт с целевым хостом: go build...

CVE-2026-5513

CVE-2026-5513 — Bookly ≤ 27.2 XSS stocké via Cookie Aperçu Champ| Valeur ---|--- CVE ID| CVE-2026-5513 Vulnérabilité| Stored Cross-Site Scripting XSS Plugin| Bookly — Système de réservation et de planification de rendez-vous en ligne Versions affectées| ≤ 27.2 Version corrigée| 27.3+ CVSS 3.1| 7....

WordPress Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Pham Duc Anh in WordPress Plugin Real Cookie Banner versions = 5.3.5...

scripts-nse

Что это? Некоторые NSE-скрипты для поиска информации о роутерах. Автор этих скриптов — VicenDominguez. Он нашёл 0-Day на Huawei, а я лишь модифицировал его для двух других. Автор этого скрипта не несёт ответственности за его использование. Huawei HG253s v2 Vodafone-Испания начинает сдавать в арен...

CookieViz

CookieViz Французский CookieViz — это инструмент визуализации, который позволяет оценить влияние файлов cookie во время вашего собственного просмотра. CookieViz анализирует взаимодействия между браузером и удалёнными сайтами и серверами. Вы сможете узнать, каким другим участникам сайт, который вы...

CVE-2026-104469

YesWiki versions prior to 4.6.7 are susceptible to a session fixation vulnerability. The root cause is that the application fails to regenerate the PHP session ID during the login process. An attacker who obtains or sets a victim's pre-authentication YesWiki- * session cookie can reuse that cooki...

httpd: httpd: Information disclosure via session cookie leakage during internal redirects

A flaw was found in Apache HTTP Server's modsessioncookie module. When internal redirects alter the SessionCookieRemove configuration, the server may fail to strip the session cookie as expected. This issue can lead to information disclosure by inadvertently forwarding sensitive user session toke...

CVE-2026-97637

The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2. The vulnerability exists because the required PI-Media/json-api parent plugin caches controller dispatch results in transients keyed sole...