20089 matches found
WordPress plugin Yoast Duplicate Post has a cross-site scripting vulnerability
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...
WordPress MW WP Form plugin <= 5.1.3 - Authenticated (Editor+) Stored Cross-Site Scripting vulnerability
Authenticated Editor+ Stored Cross-Site Scripting vulnerability discovered by Sérgio Charruadas itzvenom in WordPress Plugin MW WP Form versions = 5.1.3...
tshistory-editor (0.8.2), tshistory-refinery (>=0.1.0, <=0.5.0) +1 more potentially affected by CVE-2024-21485 via dash-core-components (1.10.1)
dash-core-components PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on dash-core-components and may be impacted: - tshistory-editor 0.8.2 - tshistory-refinery =0.1.0, =0.11.1, =0.15.1 Source cves: CVE-2024-21485 Source advisory:...
tshistory-editor (>=0.2.0, <=0.4.0), tsview (>=0.2.0, <=0.2.1) potentially affected by CVE-2024-21485 via dash-core-components (0.22.1)
dash-core-components PYPI version 0.22.1 is affected by a known vulnerability. The following packages have a transitive dependency on dash-core-components and may be impacted: - tshistory-editor =0.2.0, =0.2.0, =0.2.1 Source cves: CVE-2024-21485 Source advisory: OSV:PYSEC-2026-219...
tshistory-editor (>=0.5.0, <=0.8.1), tsview (>=0.6.0, <=0.11.0) potentially affected by CVE-2024-21485 via dash-core-components (1.0.0)
dash-core-components PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on dash-core-components and may be impacted: - tshistory-editor =0.5.0, =0.6.0, =0.11.0 Source cves: CVE-2024-21485 Source advisory: OSV:PYSEC-2026-219...
tshistory-editor (>=0.2.0, <=0.4.0), tsview (>=0.2.0, <=0.2.1) potentially affected by CVE-2024-21485 via dash-html-components (0.10.0)
dash-html-components PYPI version 0.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - tshistory-editor =0.2.0, =0.2.0, =0.2.1 Source cves: CVE-2024-21485 Source advisory: OSV:PYSEC-2026-220...
dragg (0.0.0), dragg-gym (0.0.1) +6 more potentially affected by CVE-2024-21485 via dash-html-components (1.0.3)
dash-html-components PYPI version 1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - dragg 0.0.0 - dragg-gym 0.0.1 - simba-uw-no-tf =1.2.9.2, =0.70.0, =0.10.0, =0.1.0, =0.11.1, =0.15.1 Source cves:...
@burger-editor/client (>=4.0.0-alpha.62, <=4.0.0-alpha.70), @children-of-atom/reactive-api (0.3.0) +23 more potentially affected by CVE-2026-42567 via svelte (>=5.51.5, <=5.55.5)
svelte NPM version =5.51.5, =4.0.0-alpha.62, =0.0.15, =8.1.10, =6.1.0, =0.1.0, =2.6.0, =6.4.1, =6.4.1, =4.0.0-alpha.4, =5.0.0-rc.0, =5.0.0-rc.0, =4.18.0, =1.26.10, =1.0.0-dev.35, =1.0.0-dev.56 and more Source cves: CVE-2026-42567 Source advisory: MEND:CVE-2026-42567...
WordPress Booking Package plugin <= 1.7.16 - Authenticated (Editor+) Privilege Escalation vulnerability
Authenticated Editor+ Privilege Escalation vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan - Knight Squad in WordPress Plugin Booking Package versions = 1.7.16...
CVE-2026-11621
A weakness has been identified in Dcat-Admin up to 2.2.3-beta. This impacts the function editorMDUpload of the file /admin/dcat-api/editor-md/upload of the component User Setting Page. This manipulation of the argument editormd-image-file causes unrestricted upload. The attack can be initiated...
CVE-2026-11621
A weakness has been identified in Dcat-Admin up to 2.2.3-beta. This impacts the function editorMDUpload of the file /admin/dcat-api/editor-md/upload of the component User Setting Page. This manipulation of the argument editormd-image-file causes unrestricted upload. The attack can be initiated...
CVE-2026-11621 Dcat-Admin User Setting upload editorMDUpload unrestricted upload
A weakness has been identified in Dcat-Admin up to 2.2.3-beta. This impacts the function editorMDUpload of the file /admin/dcat-api/editor-md/upload of the component User Setting Page. This manipulation of the argument editormd-image-file causes unrestricted upload. The attack can be initiated...
dcat-admin Access Control Vulnerability
dcat-admin is a backend system building tool based on Laravel, developed by Jiang Qinghua. Versions of Dcat-Admin 2.2.3-beta and earlier contain an access control vulnerability. This vulnerability stems from the editorMDUpload function in /admin/dcat-api/editor-md/upload, which allows unlimited...
PT-2026-47633
A weakness has been identified in Dcat-Admin up to 2.2.3-beta. This impacts the function editorMDUpload of the file /admin/dcat-api/editor-md/upload of the component User Setting Page. This manipulation of the argument editormd-image-file causes unrestricted upload. The attack can be initiated...
Stored XSS in the table panel (TableNG)
A user with Editor permissions can craft a dashboard whose table TableNG panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard stored cross-site scripting. Upgrade to a fixed version listed below...
Stored XSS in the Geomap panel tile-layer attribution
A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard stored cross-site scripting. Upgrade to a fixed version listed belo...
UBUNTU-CVE-2026-7186
Stored cross-site scripting in the URL dashboard widget in Checkmk 2.5.0p5, 2.4.0p31, 2.3.0p48, and all 2.2.0 versions allows a user with dashboard editing permissions to store a URL with a dangerous URI scheme such as javascript: that executes scripts in other users' browsers when they view the...
TencentOS Server 4: vim (TSSA-2026:0317)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0317 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...
CVE-2026-9851
The Booking Package plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in versions up to, and including, 1.7.16. This is due to a missing capability check on the 'updateUser' branch of the packageappaction AJAX endpoint, where the handler only validates a nonce and th...