CVE-2026-49977 tarteaucitron.js: data-cookie attribute can be used to delete arbitrary cookies

tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.purge is called on any element with the purgeBtn class and does not check whether the element is a legitimate tarteaucitron button or whether the cookie corresponds to a service handled by...

CVE-2026-49977 tarteaucitron.js: data-cookie attribute can be used to delete arbitrary cookies

tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.purge is called on any element with the purgeBtn class and does not check whether the element is a legitimate tarteaucitron button or whether the cookie corresponds to a service handled by...

CVE-2026-49977

tarteaucitron.js before version 1.33.0 is vulnerable: tarteaucitron.cookie.purge() runs on any element with purgeBtn without verifying the element or the cookie’s service, allowing an attacker who can inject HTML with data-cookie attributes to silently delete a non-HttpOnly cookie when a user cli...

tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies

Summary tarteaucitron provides a list of cookies and buttons to delete them. If an attacker can write HTML with data attributes, they could create an element that silently deletes a cookie when clicked and trick a user to delete this cookie. Details tarteaucitron.cookie.purge is called on any...

GHSA-JXJ7-G6GM-49J7 tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies

Summary tarteaucitron provides a list of cookies and buttons to delete them. If an attacker can write HTML with data attributes, they could create an element that silently deletes a cookie when clicked and trick a user to delete this cookie. Details tarteaucitron.cookie.purge is called on any...

NPM: tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies

NPM: tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies vulnerability discovered by ? in WordPress Npm tarteaucitronjs versions 1.33.0...

Improper Authorization

Overview tarteaucitronjs is a package that provides compliance to the European cookie law. Affected versions of this package are vulnerable to Improper Authorization via the purgeBtn process. An attacker can cause unintended deletion of arbitrary cookies by tricking a user into clicking a crafted...

WordPress plugin Otter Blocks 授权问题漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

Ability Mail Server 4.2.6 Cross Site Scripting

Exploit Title: Persistent Cross Site Scripting Ability Mail Server 4.2.6 CVE: CVE-2019-9557 Exploit Author: Aloyce J. Makalanga Contact: https://twitter.com/aloycemjr Vendor Homepage: https://www.codecrafters.com/AbilityMailServer Category: webapps Attack Type: Remote Impact: Data/Cookie hijackin...

IPSwitch MoveIt 9.4 Cross Site Scripting Vulnerability

Exploit for asp platform in category web applications Exploit Title: IPSwitch MoveIt Stored Cross Site Scripting XSS Software Link: https://www.ipswitch.com/moveit Affected Version: 8.1-9.4 only confirmed on 8.1 but other versions prior to 9.5 may also be vulnerable Exploit Author: email protecte...

Paypal Shopping Cart Script - 'index.php?cid' SQL Injection

source: https://www.securityfocus.com/bid/43471/info Paypal Shopping Cart Script is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow an attacker to steal...

Directory traversal

Directory traversal vulnerability in the usergetprofile function in include/functions.inc.php in Coppermine Photo Gallery CPG 1.4.18 and earlier, when the charset is utf-8, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang part of serialized data in...

Coppermine Photo Gallery < 1.4.19 data Cookie Local File Inclusion

Binary data 4613.prm...

Coppermine Photo Gallery lang参数本地文件包含漏洞

BUGTRAQ ID: 30480 Coppermine是用PHP编写的多用途集成Web图形库脚本。 Coppermine Photo Gallery没有正确地过滤对data cookie中编码的lang部分输入便用于包含文件，这允许远程攻击者通过目录遍历攻击和空字节包含本地资源的任意文件。成功攻击要求将字符编码设置为Unicode utf-8，而这是默认配置。 Coppermine Photo Gallery 1.4.18 Coppermine ---------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...