19673 matches found
CVE-2026-85188 Joomla Extension - regularlabs.com - Database data disclosure in Advanced Module Manager (Free, Pro) < 12.1.0, Conditional Content (Free, Pro) < 8.0.0, Content Templater (Pro) < 14.2.0, ReReplacer (Pro) < 16.2.0 for Joomla
Joomla Extension - regularlabs.com - Database data disclosure in Advanced Module Manager Free, Pro 12.1.0, Conditional Content Free, Pro 8.0.0, Content Templater Pro 14.2.0, ReReplacer Pro 16.2.0 for Joomla - The Conditions editor creates a default Condition Set name from the item to which the se...
CVE-2026-18119: Improper Neutralization of Input During Web Page Generation
Concrete CMS below 9.5.3 did not sanitize custom style values in the Block Design dialog before writing them into page CSS via a DOM sink, permitting stored cross-site scripting. An editor-level user could execute script in an administrator's session and escalate privileges. The Concrete CMS...
PT-2026-91058
Joomla Extension - regularlabs.com - Database data disclosure in Advanced Module Manager Free, Pro 12.1.0, Conditional Content Free, Pro 8.0.0, Content Templater Pro 14.2.0, ReReplacer Pro 16.2.0 for Joomla - The Conditions editor creates a default Condition Set name from the item to which the se...
CVE-2025-64059
Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admins are allowed to modify templates, install plugins, and upload other executable content...
PT-2026-90946
Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admins are allowed to modify templates, install plugins, and upload other executable content...
CVE-2025-64059
Grav 1.7.50.2 allows administrators to inject JavaScript through the Home Page editor , a potential stored XSS vector. However, the practical relevance is disputed : since admins already possess the ability to modify templates, install plugins, and upload other executable content, the additional ...
EUVD-2025-210894
Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admins are allowed to modify templates, install plugins, and upload other executable content...
CVE-2025-64059
Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admins are allowed to modify templates, install plugins, and upload other executable content...
CVE-2025-64059
Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admins are allowed to modify templates, install plugins, and upload other executable content...
CVE-2025-64059: Improper Neutralization of Input During Web Page Generation
Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admins are allowed to modify templates, install plugins, and upload other executable content...
CVE-2026-82847
The Masteriyo LMS WordPress plugin before 3.4.1 does not sanitise and escape one of its course fields before outputting it back in the course editor, allowing users with the instructor role to perform Stored Cross-Site Scripting attacks against higher privileged users such as administrators...
CVE-2026-82847 Masteriyo LMS < 3.4.1 - Instructor+ Stored XSS via Course Highlights
The Masteriyo LMS WordPress plugin before 3.4.1 does not sanitise and escape one of its course fields before outputting it back in the course editor, allowing users with the instructor role to perform Stored Cross-Site Scripting attacks against higher privileged users such as administrators...
EUVD-2026-76788
The Masteriyo LMS WordPress plugin before 3.4.1 does not sanitise and escape one of its course fields before outputting it back in the course editor, allowing users with the instructor role to perform Stored Cross-Site Scripting attacks against higher privileged users such as administrators...
CVE-2026-62112
Editor SQL Injection in Amelia = 2.4.9 versions...
CVE-2026-62109
Editor SQL Injection in Sky Addons for Elementor = 3.8.4 versions...
CVE-2026-62112 WordPress Amelia plugin <= 2.4.9 - SQL Injection vulnerability
Editor SQL Injection in Amelia = 2.4.9 versions...
EUVD-2026-76208
Editor SQL Injection in Amelia = 2.4.9 versions...
CVE-2026-62112 WordPress Amelia plugin <= 2.4.9 - SQL Injection vulnerability
Editor SQL Injection in Amelia = 2.4.9 versions...
CVE-2026-62112
CVE-2026-62112 affects the Amelia WordPress plugin in versions ≤ 2.4.9 , containing an Editor-level SQL Injection vulnerability discovered by Ananda Dhakal (Patchstack). The vulnerability requires high privileges (editor role) to exploit but carries a CVSS 3.1 score of 7.6 (HIGH) with high confid...