EUVD-2026-84377

MISP contains a reflected cross-site scripting XSS vulnerability in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp renders a URL-supplied event ID list into a single-quoted JavaScript string literal using PHP's...

CVE-2026-95665 MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON

MISP contains a reflected cross-site scripting XSS vulnerability in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp renders a URL-supplied event ID list into a single-quoted JavaScript string literal using PHP's...

PT-2026-96723

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description A reflected cross-site scripting XSS issue exists in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp renders a...

CVE-2026-94372

MISP contains a stored cross-site scripting XSS vulnerability in the default theme's Galaxies index page. When a MISP instance detects unknown custom or default galaxy clusters during synchronization, it renders sample tag names in an informational notice directed at site administrators. In the...

CVE-2026-94372

MISP versions below 2.5.47 contain a stored cross-site scripting (XSS) vulnerability in the default theme's Galaxies index page . When the instance detects unknown galaxy clusters during synchronization, it renders sample tag names in an informational notice to site administrators. In the default...

CVE-2026-94372 Stored Cross-Site Scripting via Unescaped Galaxy Cluster Tag Names in MISP Default Theme Galaxies Index

MISP contains a stored cross-site scripting XSS vulnerability in the default theme's Galaxies index page. When a MISP instance detects unknown custom or default galaxy clusters during synchronization, it renders sample tag names in an informational notice directed at site administrators. In the...

PT-2026-96090

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.47 Description A stored cross-site scripting XSS issue exists in the default theme's Galaxies index page. During synchronization, when unknown custom or default galaxy clusters are detected, the system displays sampl...

CVE-2026-94372: Improper Neutralization of Input During Web Page Generation

MISP contains a stored cross-site scripting XSS vulnerability in the default theme's Galaxies index page. When a MISP instance detects unknown custom or default galaxy clusters during synchronization, it renders sample tag names in an informational notice directed at site administrators. In the...

CVE-2026-72574

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When baseurl is unset the default, Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated...

CVE-2026-72574

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When baseurl is unset the default, Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated...

CVE-2026-72574

The CVE-2026-72574 entry describes a host header injection in Pico CMS (Pico, up to version 2.1.4) where Pico::getBaseUrl() builds the base URL from unvalidated request headers (Host, X-Forwarded-Host, X-Forwarded-Proto, X-Forwarded-Port) when base_url is unset. This allows an unauthenticated rem...

CVE-2025-57567

A remote code execution RCE vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file located under the default theme directory /themes/defaut/css/minify.php. An authenticated administrator user can overwrite this file with arbitrary PHP code via the admin panel,...

CVE-2025-57567

A remote code execution RCE vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file located under the default theme directory /themes/defaut/css/minify.php. An authenticated administrator user can overwrite this file with arbitrary PHP code via the admin panel,...

PluXml 安全漏洞

PluXml is a free open source content management system from PluXml Open Source that does not require a database to work. A security vulnerability exists in PluXml that stems from a minify.php file in the default theme directory that allows administrators to override arbitrary PHP code via the adm...

CVE-2025-57567

A remote code execution (RCE) vulnerability exists in the PluXml CMS theme editor , specifically within the minify.php file located in the default theme directory (/themes/defaut/css/minify.php). An authenticated administrator can exploit this by overwriting the file with arbitrary PHP code via t...

Malicious code in @cewe-phoenix-themes/default-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b8fefa5fe5221477fe4ca130e84721255986e7b048f3e5922c99cac89d94df83 The OpenSSF Package Analysis project identified '@cewe-phoenix-themes/default-theme' @ 99.9.1 npm as malicious. It is considered malicious...

Malicious code in @douinfe/semi-theme-default (npm)

--- -= Per source details. Do not edit below this line.=-...

Fedora 13 : phpMyAdmin-3.4.1-1.fc13 (2011-7703)

Welcome to phpMyAdmin 3.4, presenting a new default theme. This release contains new features, especially : - User preferences - Relation schema export to multiple formats - ENUM/SET editor - Simplified interface for export/import - AJAXification of some parts - Charts - Visual query builder and...

Fedora 14 : phpMyAdmin-3.4.1-1.fc14 (2011-7702)

Welcome to phpMyAdmin 3.4, presenting a new default theme. This release contains new features, especially : - User preferences - Relation schema export to multiple formats - ENUM/SET editor - Simplified interface for export/import - AJAXification of some parts - Charts - Visual query builder and...

Mandriva 2011 Beta 2 is Available for Testing !

Mandriva 2011 Beta 2 is Available for Testing ! Mandriva 2011 beta 2 was supposed to be released a week ago, but the release schedule was delayed by last minute defects discovered by the development and testing teams. In order to get hold of beta 2, you can visit your favorite Mandriva mirror and...