1291 matches found
CVE-2026-66603
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Artiss Draft List simple-draft-list allows Stored XSS. This issue affects Draft List: from n/a through 2.6.4...
CVE-2026-66603 WordPress Draft List plugin <= 2.6.4 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Artiss Draft List simple-draft-list allows Stored XSS. This issue affects Draft List: from n/a through 2.6.4...
CVE-2026-66603 WordPress Draft List plugin <= 2.6.4 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Artiss Draft List simple-draft-list allows Stored XSS. This issue affects Draft List: from n/a through 2.6.4...
CVE-2026-66603
CVE-2026-66603 is a Stored XSS vulnerability in the WordPress plugin Draft List (simple-draft-list) by David Artiss, affecting versions through 2.6.4 . The root cause is improper neutralization of input during web page generation , allowing an attacker to persist a malicious script that executes ...
WordPress Draft List plugin <= 2.6.4 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin Draft List versions = 2.6.4...
CVE-2026-45127
MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route in Admin CP, Users & Groups, Mass...
CVE-2026-45127 MyBB: ACP Mass Mail draft resend CSRF
MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route in Admin CP, Users & Groups, Mass...
CVE-2026-45127
MyBB versions prior to 1.8.40 have a CSRF flaw in the ACP Mass Mail Resend route: the admin/modules/user/mass_mail.php endpoint duplicates archived entries into new drafts (setting mybb_massemails.status = 0) on unprotected GET requests. A same-site attacker can trigger this via a crafted URL. Up...
CVE-2026-45127 MyBB: ACP Mass Mail draft resend CSRF
MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route in Admin CP, Users & Groups, Mass...
CVE-2026-45127
MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route in Admin CP, Users & Groups, Mass...
EUVD-2026-60977
MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route in Admin CP, Users & Groups, Mass...
WordPress Forminator Forms plugin <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter vulnerability
Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter vulnerability discovered by se1en in WordPress Plugin Forminator versions = 1.55.0.2...
PT-2026-77187
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post operations allow a low-privileged Author to access posts owned by another Author. The admin/controller/content/posts.php controller permits filteradmin id t...
PT-2026-78249
Name of the Vulnerable Software and Affected Versions Draft List versions prior to 2.6.5 Description Improper neutralization of input during web page generation in the David Artiss Draft List simple-draft-list plugin allows for Stored Cross-site Scripting XSS. Stored XSS occurs when an applicatio...
PT-2026-77150
MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route in Admin CP, Users & Groups, Mass...
CVE-2026-66603: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Artiss Draft List simple-draft-list allows Stored XSS. This issue affects Draft List: from n/a through 2.6.4...
CVE-2026-45127: Cross-Site Request Forgery (CSRF)
MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route in Admin CP, Users & Groups, Mass...
CVE-2026-75049
In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint...
CVE-2026-55704
Discourse is an open-source discussion platform. Prior o 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group’s activity, but were not permitted to see shared drafts, could still receive shared-draft entries through the group posts and group mentions endpoints. This...