13113 matches found
CVE-2026-7176
CVE-2026-7176: the Help text and Title parameters in the endpoint /events/-/customform/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the event...
CVE-2026-7175
CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows the injection of JavaScript code that will execute on the promoter’s public page;...
EUVD-2026-90746
CVE-2026-7176: the Help text and Title parameters in the endpoint /events/-/customform/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the event...
CVE-2026-7176 Multiple vulnerabilities in Entradium by Crocantickets
CVE-2026-7176: the Help text and Title parameters in the endpoint /events/-/customform/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the event...
CVE-2026-7176
The Entradium platform by Crocantickets is vulnerable to a JavaScript injection flaw. Specifically, the Help text and Title parameters in the /events/-/custom_form/edit endpoint lack proper sanitization during the creation or modification of ticket sale forms. This allows an attacker to inject ma...
EUVD-2026-90745
CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows the injection of JavaScript code that will execute on the promoter’s public page;...
CVE-2026-7175 Multiple vulnerabilities in Entradium by Crocantickets
CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows the injection of JavaScript code that will execute on the promoter’s public page;...
CVE-2026-7175
The Entradium platform by Crocantickets is vulnerable to a script injection flaw in the My Profile section. Specifically, the Business Name parameter within the /promoters/edit endpoint fails to properly sanitize input, allowing for the injection of JavaScript code . This malicious script can exe...
CVE-2026-7173 Multiple vulnerabilities in Entradium by Crocantickets
CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data. Stored XSS The City parameter in the endpoint /events//editgeneral during...
CVE-2026-92548
The WP Popular Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2 via the 'context' parameter. This makes it possible for unauthenticated attackers to extract sensitive edit-context fields — including raw title, raw content body,...
CVE-2026-92548
The WP Popular Posts plugin for WordPress (versions up to and including 7.4.2 ) is vulnerable to Sensitive Information Exposure . Unauthenticated attackers can extract sensitive edit-context fields—such as raw title, raw content body, password, meta, status, and guid—from non-public post objects ...
EUVD-2026-90477
The WP Popular Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2 via the 'context' parameter. This makes it possible for unauthenticated attackers to extract sensitive edit-context fields — including raw title, raw content body,...
CVE-2026-7175: Improper Neutralization of Input During Web Page Generation
CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows the injection of JavaScript code that will execute on the promoter’s public page;...
CVE-2026-7176: Improper Neutralization of Input During Web Page Generation
CVE-2026-7176: the Help text and Title parameters in the endpoint /events/ - /customform/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the even...
CVE-2026-7173: Improper Neutralization of Input During Web Page Generation
CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data. Stored XSS The City parameter in the endpoint /events/ /editgeneral during...
PT-2026-104038
Name of the Vulnerable Software and Affected Versions deeptutor version 1.4.0 Description A path traversal issue exists in the EditFileTool.execute function. A remote caller can use the live tutorbot WebSocket interface to force the tool layer to write or edit absolute paths outside the designate...
CVE-2026-100278
In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments...
EUVD-2026-90022
In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments...
CVE-2026-100278
In JetBrains YouTrack versions prior to 2026.2.19197 , a vulnerability allows users with restricted permissions to edit and hide comments belonging to other users. This flaw impacts the integrity of user comments within the platform. No specific exploit information or remediation details are prov...