EUVD-2026-47587

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSIS.php. Performing a manipulation of the argument day results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be...

EUVD-2026-47565

A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /class.php. Such manipulation of the argument day leads to cross site scripting. The attack can be launched remotely. The exploit has been...

PT-2026-63331

The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible...

PT-2026-63901

Name of the Vulnerable Software and Affected Versions TheGem versions prior to 5.11.2 Description The TheGem theme for WordPress contains a Stored Cross-Site Scripting XSS flaw resulting from insufficient input sanitization and output escaping. This allows authenticated attackers with...

Plone 3.3.x < 4.3.12 / 5.0.x < 5.0.7 Multiple Vulnerabilities (HF 20160830)

The version of Plone installed on the remote host is 3.3.x prior to 4.3.12, or 5.0.x 5.0.7. It is, therefore, affected by the following vulnerabilities: - Directory traversal vulnerability in Plone CMS allows remote administrators to read arbitrary files via a .. dot dot in the path parameter in ...

Plone 4.3 < 5.2.7 Reflected XSS and Open Redirect (HF 20220128)

The version of Plone installed on the remote host is 4.3 prior to 5.2.7. It is, therefore, affected by a reflected cross-site scripting XSS and open redirect vulnerability exists in 'Products.ATContentTypes'. An unauthenticated, remote attacker can get a compromised version of the...

Plone < 4.2.3 Multiple Vulnerabilities (HF 20121106)

The version of Plone installed on the remote host is prior to 4.2.3. It is, therefore, affected by the following vulnerabilities: - registerConfiglet.py in Plone allows remote attackers to execute Python code via unspecified vectors, related to the admin interface. CVE-2012-5485 -...

Plone < 3.3.6 XSS

The version of Plone installed on the remote host is prior to 3.3.6. It is, therefore, affected by a cross-site scripting XSS vulnerability, in PortalTransforms due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this, by...

Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082

This module enables you to add autocomplete suggestions for search forms created with the Search API module. The module ships with a test script that is accessible to anonymous users and doesn't sufficiently validate user input, leading to a Cross Site Scripting vulnerability. This vulnerability ...

PT-2026-63350

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open without scheme validation. An attacker with workflow creation/editing privileges can cra...

Plone 3.3.x < 4.3.3 Multiple Vulnerabilities (HF 20131210)

The version of Plone installed on the remote host is 3.3.x and prior to 4.3.3. It is, therefore, affected by the following vulnerabilitites: - Products/CMFPlone/FactoryTool.py is initialized in class scope. CVE-2013-7060 - Products/CMFPlone/CatalogTool.py allows remote administrators to bypass...

PT-2026-63534

Name of the Vulnerable Software and Affected Versions Drupal Media Folders versions 0.0.0 through 1.0.8 Description Stored cross-site scripting XSS occurs because the module does not sufficiently sanitize the names and descriptions of media items and folders when they are displayed in the media...

Plone 4.3.x < 5.2.5 Multiple Vulnerabilities (HF 20210518)

The version of Plone installed on the remote host is 4.3.x prior to 5.2.5. It is, therefore, affected by the following vulnerabilities: - Plone CMS has a stored Cross-Site Scripting XSS vulnerability in the user fullname property and the file upload functionality. CVE-2021-3313 -...

PT-2026-63432

Froiden TableTrack through 1.3.10 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary HTML and JavaScript through the order notes field without sanitization. Attackers can craft malicious payloads in customer order placement that execute ...

PT-2026-63333

The Joomla extension JoomShopping is vulnerable to an reflected XSS vulnerability in the product frontend controller...

Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080

This module provides a better UI for managing and selecting Media entities in a folder structure. The module doesn't sufficiently sanitize the names and descriptions of media items and folders when they are displayed in the media browser, resulting in a stored cross-site scripting XSS...

Plone < 4.2.6 / 4.3.x < 4.3.2 Multiple Vulnerabilities (HF 20130618)

The version of Plone installed on the remote host is prior to 4.3.2. It is, therefore, affected by the following vulnerabilities: - traverser.py allows remote attackers with administrator privileges to cause a denial of service infinite loop and resource consumption via unspecified vectors relate...

Plone 3.3.x < 4.3.7 Multiple Vulnerabilities (HF 20150910)

The version of Plone installed on the remote host is 3.3.x prior to 4.3.7. It is, therefore, affected by the following vulnerabilities: - Plone allows remote attackers to add a new member to a Plone site with registration enabled, without acknowledgment of site administrator CVE-2015-7315 -...

Debian dla-4693 : roundcube - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4693 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4693-1 [email protected]...

Plone 5.2.3 XSS

The version of Plone installed on the remote host is 5.2.3. It is, therefore, affected by a stored cross-site scripting XSS vulnerability within the site-controlpanel due to improper validation of user-supplied input before returning it to users. An authenticated, remote attacker can exploit this...