pwndrop

pwndrop is a self-deployable file hosting service for sending out red teaming payloads or securely sharing your private files over HTTP and WebDAV. If you've ever needed to quickly set up an nginx/apache web server to host your files and you were never happy with the limitations of python -m...

PYSEC-2026-4227 Indico: Cross-Site-Scripting in link fields

Impact There is a Cross-Site-Scripting vulnerability in fields that allow entering custom URLs. Patches You should to update to Indico 3.3.13 as soon as possible. See the docs for instructions on how to update. Workarounds - Set CSPENABLED = True in indico.conf - this is recommended regardless of...

GHSA-C4WC-GGRJ-JG9V Indico: Cross-Site-Scripting in link fields

Impact There is a Cross-Site-Scripting vulnerability in fields that allow entering custom URLs. Patches You should to update to Indico 3.3.13 as soon as possible. See the docs for instructions on how to update. Workarounds - Set CSPENABLED = True in indico.conf - this is recommended regardless of...

CVE-2026-107396

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can manage events or create content, including speakers who can upload material, can store crafted javascript URLs in fields that accept custom URLs. A user...

CVE-2026-107396: Incomplete Denylist to Cross-Site Scripting

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can manage events or create content, including speakers who can upload material, can store crafted javascript URLs in fields that accept custom URLs. A user...

CVE-2024-2122: Improper Neutralization of Input During Web Page Generation

The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via album gallery custom URLs in all versions up to, and including, 2.4.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2022-1672

The Insights from Google PageSpeed WordPress plugin before 4.0.7 does not verify for CSRF before doing various actions such as deleting Custom URLs, which could allow attackers to make a logged in admin perform such actions via CSRF attacks...

CVE-2022-1672

The Insights from Google PageSpeed WordPress plugin before 4.0.7 does not verify for CSRF before doing various actions such as deleting Custom URLs, which could allow attackers to make a logged in admin perform such actions via CSRF attacks...

Cross site request forgery (csrf)

The Insights from Google PageSpeed WordPress plugin before 4.0.7 does not verify for CSRF before doing various actions such as deleting Custom URLs, which could allow attackers to make a logged in admin perform such actions via CSRF attacks...

CVE-2022-1672: Cross-Site Request Forgery (CSRF)

The Insights from Google PageSpeed WordPress plugin before 4.0.7 does not verify for CSRF before doing various actions such as deleting Custom URLs, which could allow attackers to make a logged in admin perform such actions via CSRF attacks...

PT-2022-14036

Name of the Vulnerable Software and Affected Versions Insights from Google PageSpeed WordPress plugin versions prior to 4.0.7 Description The issue concerns a lack of CSRF verification in the plugin, allowing attackers to perform actions such as deleting Custom URLs on behalf of a logged-in admin...

WordPress plugin Insights from Google PageSpeed: Cross-site Request Forgery vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Insights...

Cross-Site Scripting (XSS)

prestashop/pslinklist is vulnerable to cross-site scripting. The vulnerability exists because the custom URLs are not validated in 'buildForm' function in 'CustomUrlType.php' allowing a malicious attacker to inject arbitrary scripts...

Stored XSS with custom URLs in PrestaShop module ps_linklist

Impact Stored XSS when using custom URLs. Patches The problem is fixed in 3.1.0 References Cross-site Scripting XSS - Stored CWE-79...

Advantech BB-ERT351 XSS

The vulnerability of the microprogrammed network router Advantech BB-ERT351 is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using specially crafted URLs...

CVE-2020-5273

In PrestaShop module pslinklist versions before 3.1.0, there is a stored XSS when using custom URLs. The problem is fixed in version 3.1.0...

CVE-2020-5273

In PrestaShop module pslinklist versions before 3.1.0, there is a stored XSS when using custom URLs. The problem is fixed in version 3.1.0...

PT-2020-18363

Name of the Vulnerable Software and Affected Versions PrestaShop module ps linklist versions prior to 3.1.0 Description The issue concerns a stored XSS when using custom URLs. Recommendations For PrestaShop module ps linklist versions prior to 3.1.0, update to version 3.1.0 to resolve the issue...

CVE-2020-5273: Improper Neutralization of Input During Web Page Generation

In PrestaShop module pslinklist versions before 3.1.0, there is a stored XSS when using custom URLs. The problem is fixed in version 3.1.0...