PT-2026-91841

It was discovered that libinput did not properly escape device properties. A local attacker could possibly use this issue to inject arbitrary udev properties and execute arbitrary code as root...

CSRF-via-stored-XSS-for-PrivEsc

Chamilo LMS addLabelgetlang'Thread', $threadEntity-getTitle; 2. /public/main/forum/viewforum.php - 369行目 root@kitploit: .$thread-getTitle.''; 3. 他にもあります！ 根本原因: フォーラムのスレッドタイトルが適切なサニタイズなしに保存される スレッドタイトルが複数の場所で HTML エスケープされずに表示される XSS の実行を防ぐ Content Security Policy CSP がない 権限昇格のステップバイステップガイド フェーズ 1:...

apache__sling-org-apache-sling-xss_CVE-2016-5394_1-0-8

Apache Sling XSS Bundle Apache Sling XSS Bundle 提供了两项服务，用于转义和过滤易受 XSS 攻击的用户提交内容： 1. org.apache.sling.xss.XSSAPI 2. org.apache.sling.xss.XSSFilter 请查看每项服务的 JavaDoc，了解它们提供了哪些方法。...

rcno-reviews

Recencio Book Reviews WordPressプラグインで、書籍レビューの管理・表示を行います。カスタム投稿タイプ、7つのタクソノミー、13のショートコード、7つのウィジェット、6つのテンプレート、5つの拡張機能を備えています。すべてのデータは標準のWordPress投稿メタに保存され、カスタムテーブルは使用しません。 背景 Recencio Book Reviews は Kemory Grubb w33zy によって作成され、WordPressプラグインディレクトリに公開されました。Kemory は2024年に亡くなりました。このプラグインは、既知の保存型XSS脆弱性...

cve-2026-42945

CVE-2026-42945 — NGINX 重写堆溢出：分析、DoS 与署名 RCE 移植 针对 CVE-2026-42945 （CVSS 4.0 9.2 严重 ）的安全研究：NGINX 脚本引擎中的堆缓冲区溢出，其中替换部分带参数的 rewrite（例如 rewrite ^. /new?c=1;）会使引擎的 isargs 标志保持置位且从未清除——因此之后在 set/if 中求值的任何捕获（$1）都会带 URI 转义 被复制到按未转义 长度分配的缓冲区中。任何请求 URI 携带 %XX 转义或 + 的客户端均可在认证前触达。 结果（阶段 1）： 一个安全的差分检测器 （易受攻击的...

EUVD-2026-76874

The Booking for Appointments and Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Elementor widgets in versions up to and including 2.4.9. This is due to insufficient input sanitization and output escaping on the 'loadmanually' parameter in the render...

cve-2020-7247

cve-2020-7247 エクスプロイトタイトル: OpenSMTPD 6.6.2 - リモートコード実行. 新しい日付: 2020-01-29. エクスプロイト作者: 1F98D. 原作者: Qualys Security Advisory. ベンダーホームページ: https://www.opensmtpd.org/. ソフトウェアリンク: https://github.com/OpenSMTPD/OpenSMTPD/releases/tag/6.6.1p1. バージョン: OpenSMTPD 6.6.2. テスト済み: OpenBSD 6.6, OpenBSD 6.5,...

CVE-2026-12243-NLTK-PoC

CVE-2026-12243 — NLTK 路径遍历实验环境 一个小型、可复现的 Docker 实验环境，用于对比 NLTK 3.9.4 中百分号编码路径遍历行为与 NLTK 3.10.0 中修正后的行为。 存在漏洞的版本在 URL 解码之前验证资源名称。固定载荷 %2e%2e/%2e%2e/outside/lab-secret.txt 通过检查，随后被解码为 ../../outside/lab-secret.txt，并逃逸了配置的 NLTK 数据目录和进程工作目录。已修补的版本会拒绝相同的输入。 !CAUTION...

CVE-2026-81917

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block...

EUVD-2026-76689

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block...

CVE-2026-81917 Concrete CMS below 9.5.3 is vulnerable to Stored XSS in the Document Library block file description and tags

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block...

CVE-2026-81917

Concrete CMS versions below 9.5.3 contain a Stored XSS vulnerability in the Document Library block . The block controller returned the file description and tags values without applying the h() HTML-escaping function (already used for the title column), and the block view template wrote those valu...

CVE-2026-81917 Concrete CMS below 9.5.3 is vulnerable to Stored XSS in the Document Library block file description and tags

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block...

CVE-2026-68528

Concrete CMS RSS Displayer block below version 9.5.3 rendered remote feed item titles without HTML escaping, resulting in stored cross-site scripting. An attacker able to control a title in a syndicated feed could execute script in the site origin for any visitor to the affected page, including...

EUVD-2026-76164

Concrete CMS RSS Displayer block below version 9.5.3 rendered remote feed item titles without HTML escaping, resulting in stored cross-site scripting. An attacker able to control a title in a syndicated feed could execute script in the site origin for any visitor to the affected page, including...

CVE-2026-72708

SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows unauthenticated attackers to inject arbitrary SQL by supplying a crafted annee parameter value matching a word character followed by an open parenthesis, which bypasses escaping...

CVE-2026-34197-Apache-ActiveMQ-RCE

commandに対してXMLエスケープを行っていなかったことに起因するreverseshell失敗の問題を修正...

EUVD-2026-76061

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the YPTWallet plugin where user-supplied CryptoWallet values are base64-encoded but not HTML-escaped before storage in walletlog.information. Administrators viewing pending...

CVE-2026-17037

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘comment’ parameter in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-87123

hbs is an Express view engine wrapper for Handlebars. In version 4.3.0 , an unhandled TypeError is thrown during output escaping when an async helper (registered via registerAsyncHelper) resolves to an object whose toHTML property is truthy but not callable. Because the async substitution execute...