CVE-2025-26054

CVE-2025-26054 CVE-2025-26054 작성자: Rohan Deshpande 저장형 크로스 사이트 스크립팅 요약 저장형 XSS크로스 사이트 스크립팅는 공격자가 악성 스크립트를 웹 애플리케이션에 주입하고, 이를 서버에 저장하여 사용자에게 제공하는 보안 취약점입니다. 사용자가 영향을 받는 콘텐츠에 접근하면 스크립트가 사용자의 브라우저에서 실행되어 데이터 탈취, 세션 하이재킹, 무단 작업을 초래할 수 있습니다. 이러한 유형의 공격은 사용자와 웹 애플리케이션의 무결성 모두에 심각한 영향을 미칠 수 있습니다. 심각도 높음...

CVE-2021-42664

CVE-2021-42664 CVE-2021-42664 - Engineers 온라인 포털 시스템의 저장형 크로스사이트 스크립팅Stored XSS 취약점. 기술 설명: Engineers 온라인 포털 시스템에 저장형 XSS 취약점이 존재합니다. 공격자는 이 취약점을 악용하여 웹 서버 사용자를 대신해 자바스크립트를 실행할 수 있으며, 이는 쿠키 탈취, 변조 등으로 이어질 수 있습니다. 영향을 받는 구성 요소 - 취약 페이지 - addquiz.php 취약 매개변수 - "quiztitle", "description" 익스플로잇 단계: 1...

PT-2026-65051

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method enabled and a role with callback mode=direct configured are vulnerable to XSS via the error description parameter on the page for a failed...

CVE-2026-38450

An issue in Aetopia Digital Asset Management DAM v.1.0.0 allows a remote attacker to execute arbitrary code via the name and description parameter of the Add/Update Project function...

CVE-2026-13710 Jeg Kit for Elementor <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_body_description' Parameter via 'jkit_image_box' Shortcode/Widget

The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Box widget's 'sgbodydescription' parameter in versions up to, and including, 3.2.6. This is due to insufficient input...

CVE-2026-13710

The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress is affected by a Stored Cross-Site Scripting vulnerability in the Image Box widget’s sg_body_description parameter, affecting versions up to 3.2.6. The issue stems from insufficient input sanitization and...

CVE-2026-52781 OpenProject: Stored XSS on openproject.example.com through /api/v3/projects/{project}/work_packages via POST parameter "description"

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the HTML sanitizer grants elements unrestricted data- attributes via :data wildcard. An attacker injects data-controller="poll-for-changes" into a work package description, causing Stimulus.js to mount ...

CVE-2026-2834

The Age Verification & Identity Verification by Token of Trust plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘description’ parameter in all versions up to, and including, 3.32.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2021-47981

Quick.CMS 6.7 contains a cross-site scripting vulnerability in the sliders form that allows authenticated attackers to inject malicious scripts by submitting XSS payloads through the sDescription parameter. Attackers can craft CSRF forms targeting the admin.php?p=sliders-form endpoint to execute...

CVE-2021-47981

CVE-2021-47981 affects Quick.CMS 6.7. It describes a cross-site scripting vulnerability in the sliders form that can be exploited when an authenticated user submits an XSS payload via the sDescription parameter. Attackers can craft CSRF forms targeting the admin.php?p=sliders-form endpoint to cau...

OpenSolution Quick.CMS 跨站脚本漏洞

OpenSolution Quick.CMS is a lightweight website content management system developed by the Polish company OpenSolution. Version 6.7 of OpenSolution Quick.CMS contains a cross-site scripting vulnerability. This vulnerability stems from a cross-site scripting flaw in the sliders form, allowing...

CVE-2021-47968

Podcast Generator 3.1 is vulnerable to persistent cross-site scripting, allowing authenticated attackers to inject malicious scripts by submitting unfiltered JavaScript code in the longdescription parameter. Attackers can inject script tags through episode creation or editing requests to execute...

Podcast Generator 跨站脚本漏洞

Podcast Generator is an open-source set of free podcast publishing scripts written in PHP language. Version 3.1 of Podcast Generator has a cross-site scripting vulnerability. This vulnerability stems from a persistent cross-site scripting issue, which may allow authenticated attackers to inject...

SSH MCP Server 注入漏洞

SSH MCP Server is a tool developed by Tufan Tunç for remotely executing Shell commands via SSH. Versions of SSH MCP Server 1.5.0 and earlier have a vulnerability due to improper handling of the Description parameter in the shell.write function of the src/index.ts file, which may lead to command...

EUVD-2026-22824

The Age Verification & Identity Verification by Token of Trust plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘description’ parameter in all versions up to, and including, 3.32.3 due to insufficient input sanitization and output escaping. This makes it possible for...

WordPress Age Verification & Identity Verification by Token of Trust plugin <= 3.32.3 - Unauthenticated Stored Cross-Site Scripting via 'description' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 'description' Parameter vulnerability discovered by Teerachai Somprasong in WordPress Plugin Age Verification & Identity Verification by Token of Trust versions = 3.32.3...

CVE-2026-2834

The Age Verification & Identity Verification by Token of Trust plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘description’ parameter in all versions up to, and including, 3.32.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-2834

The CVE concerns the WordPress plugin “Age Verification & Identity Verification by Token of Trust” (Token of Trust) with stored cross-site scripting via the description parameter in all versions up to 3.32.3. The vulnerability results from insufficient input sanitization and output escaping, allo...

CVE-2026-2834

The Age Verification & Identity Verification by Token of Trust plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘description’ parameter in all versions up to, and including, 3.32.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-2834 Age Verification & Identity Verification by Token of Trust <= 3.32.3 - Unauthenticated Stored Cross-Site Scripting via 'description' Parameter

The Age Verification & Identity Verification by Token of Trust plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘description’ parameter in all versions up to, and including, 3.32.3 due to insufficient input sanitization and output escaping. This makes it possible for...