CVE-2023-49973

CVE-2023-49973 Customer Support System 1.0 - ثغرة البرمجة النصية عبر المواقع XSS في حقل/معامل "email" في صفحة "customerlist" الوصف : يُعد Customer Support System 1.0 عرضة لثغرة XSS مخزنة. توجد ثغرة XSS في الإصدار 1 من Customer Support System. يمكن لمهاجم خبيث إدراج كود JavaScript من خلال حقل/معام...

CVE-2019-13051

Pi-Hole 4.3.2 Injection de commandes et élévation de privilèges CVE-2019-13051 Pi-Hole version 4.3.2 contient un correctif pour cette vulnérabilité :https://github.com/pi-hole/AdminLTE/pull/974 Un grand merci à l'équipe de développement de Pi-Hole pour leur projet génial et pour avoir rendu le...

Kirby CMS 5.3.0-5.4.0 - Path Traversal

Kirby CMS versions 5.3.0 through 5.4.0 are vulnerable to a path traversal vulnerability via the /api/auth/login endpoint. An unauthenticated attacker may supply a specially crafted email value in the request body containing traversal sequences such as "../..", which the application concatenates...

CVE-2025-29471

ثغرة XSS مخزنة في Nagios Log Server تصعيد الامتيازات إلى مدير ▶️ عرض توضيحي PoC التاريخ: 2025-04-02 مؤلف الاستغلال: Seth Kraft الصفحة الرئيسية للبائع: https://www.nagios.com/ سجل التغييرات للبائع: https://www.nagios.com/changelog/log-server رابط البرنامج:...

CVE-2023-28467

MyBB 1.8.33 User CP email persistent XSS root@kitploit: - MyBB 1.8.33 User CP email persistent XSS - Mybb version "@cve.com الحل قم بترقية MyBB إلى الإصدار 1.8.34 أو أحدث...

CVE-2024-25412

CVE-2024-25412 Une vulnérabilité de cross-site scripting XSS dans Flatpress v1.3 permet à des attaquants d'exécuter des scripts web ou du HTML arbitraires via une charge utile conçue injectée dans le champ email Type de vulnérabilité : Cross Site Scripting XSS Fournisseur du produit :...

CVE-2026-11113-SMTP-Header-Injection-in-Contact-Form

CVE-2026-11113 – Injection d'en-tête SMTP dans le formulaire de contact Code du programme Python root@kitploit: contactformserver.py - Mails feedback without sanitizing headers from flask import Flask, request import smtplib app = Flaskname @app.route'/contact', methods='POST' def contact: sender...

CVE-2023-7028

POC GitLab CVE-2023-7028 root@kitploit: [email protected]&[email protected] 科研机构base成都-招聘网络安全研究人员（私）...

EUVD-2026-55636

Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. When an authenticated user follows another account, getfollowing includes the followed user's email field in the API response alongside their name, user ID, and follow date. Becaus...

CVE-2026-16143

The VikRentItems – Flexible Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer email field of the booking checkout form in versions up to, and including, 1.2.1. This is due to insufficient input sanitization and output escaping in the...

CVE-2026-16143

Vulnerability: CVE-2026-16143 affects VikRentItems Flexible Rental Management System

EUVD-2026-53036

The VikRentItems – Flexible Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer email field of the booking checkout form in versions up to, and including, 1.2.1. This is due to insufficient input sanitization and output escaping in the...

CVE-2026-16143

The VikRentItems – Flexible Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer email field of the booking checkout form in versions up to, and including, 1.2.1. This is due to insufficient input sanitization and output escaping in the...

CVE-2026-16143 VikRentItems Flexible Rental Management System <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting

The VikRentItems – Flexible Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer email field of the booking checkout form in versions up to, and including, 1.2.1. This is due to insufficient input sanitization and output escaping in the...

CVE-2026-12761 miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.7.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Profile Completion OTP Flow

The miniOrange Social Login and Register Discord, Google, Twitter, LinkedIn plugin for WordPress is vulnerable to authentication bypass leading to account takeover in versions up to and including 7.7.0. This is due to the Profile Completion flow accepting an arbitrary email address via the...

CVE-2026-6820

CVE-2026-6820: The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the email parameter in all versions up to 1.8.8 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts in ...

CVE-2026-13567

A security flaw has been discovered in code-projects Online Music Site 1.0. This affects an unknown part of the file /Frontend/Feedback.php of the component POST Request Handler. The manipulation of the argument fname/femail/faddress/fmessage results in cross site scripting. The attack may be...

EUVD-2026-40082

A security flaw has been discovered in code-projects Online Music Site 1.0. This affects an unknown part of the file /Frontend/Feedback.php of the component POST Request Handler. The manipulation of the argument fname/femail/faddress/fmessage results in cross site scripting. The attack may be...

GO-2026-5626 Ech0 comment model's Email field returned on public /api/comments endpoints in github.com/lin-snow/ech0

Ech0 comment model's Email field returned on public /api/comments endpoints in github.com/lin-snow/ech0...

EUVD-2026-38634

FlatPress versions prior to commit 10be83c, contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are rendered without proper output encoding in Smarty templates. Attackers can inject arbitrary HTML and JavaScript through these fields ...