CVE-2026-104143

Prior to version 2.10.26 , the DataEase data visualization tool is vulnerable to a Stored SQL Injection . Authenticated users can provide a crafted dateFormat for a dataset field, which is inserted without validation into date conversion templates (including Dimension2SQLObj and Field2SQLObj). In...

CVE-2026-104143 DataEase: Stored SQL Injection via dateFormat field templates

DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store a crafted custom dateFormat for a dataset field. DatasetTableFieldDTO.dateFormat is inserted without validation into date conversion templates used by Dimension2SQLObj, CustomWhere2Str...

CVE-2026-105261 PublishPress Future 4.10.1 - 4.10.5 - Contributor+ Stored XSS via 'wrapper' and 'dateformat' Shortcode Attributes

The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.6 does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise attacker-controlled text placed inside the resulting elemen...

CVE-2026-105261

The Schedule Post Changes With PublishPress Future WordPress plugin, versions 4.10.1 through 4.10.5 , is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists because the plugin fails to enforce a safe HTML-element allowlist on shortcode attributes and fails to neutralize attacker-con...

PT-2010-5323 · Deluxebb · Deluxebb

SQL injection vulnerability in misc.php in DeluxeBB 1.3, and possibly earlier, when magic quotes gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the xthedateformat parameter in a register action, a different vector than CVE-2005-2989, CVE-2006-2503, and CVE-2009-103...