WordPress QuickCal plugin <= 1.0.20 - Unauthenticated Stored Cross-Site Scripting via Custom Field Parameters vulnerability

Unauthenticated Stored Cross-Site Scripting via Custom Field Parameters vulnerability discovered by adhikara13 in WordPress Plugin QuickCal - Appointment Booking Calendar for WordPress versions = 1.0.20...

CVE-2026-15984

The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...

EUVD-2026-71885

The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...

CVE-2026-15984 QuickCal <= 1.0.20 - Unauthenticated Stored Cross-Site Scripting via Custom Field Parameters

The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...

CVE-2026-15984: Improper Neutralization of Input During Web Page Generation

The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...

CVE-2025-14855: Improper Neutralization of Input During Web Page Generation

The SureForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form field parameters in all versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

CVE-2025-10383: Improper Neutralization of Input During Web Page Generation

The Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple form field parameters in all versions up to, and including, 27.0.2. This is due to insufficient input sanitization and output escaping on user-supplied...

Visitor Management System query_data.php File SQL Injection Vulnerability

Visitor Management System is a visitor access management system. Visitor Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally-entered SQL statements in the parameter dateF/dateP in the file /querydata.php. An attacker can exploit...

CVE-2025-8947

CVE-2025-8947 concerns the projectworlds Visitor Management System 1.0. The vulnerability lies in the /query_data.php processing of the dateF/dateP parameters, where unsafely built SQL queries allow an attacker to perform SQL injection. Public disclosure indicates remote exploitation and potentia...

Projectworlds Visitor Management System 注入漏洞

Visitor Management System is a visitor access management system. Visitor Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally-entered SQL statements in the parameter dateF/dateP in the file /querydata.php. An attacker can exploit...

Low-level invalid GF(2^m) parameters lead to OOB memory access

...

CVE-2024-46082

Scriptcase v.9.10.023 and before is vulnerable to Cross Site Scripting XSS in nmcor.php via the form and field parameters...

CVE-2024-46082: Improper Neutralization of Input During Web Page Generation

Scriptcase v.9.10.023 and before is vulnerable to Cross Site Scripting XSS in nmcor.php via the form and field parameters...

org.bouncycastle: Importing an EC certificate with crafted F2m parameters may lead to Denial of Service

A vulnerability was found in Bouncy Castle. An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java BC Java. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters...

org.bouncycastle: Importing an EC certificate with crafted F2m parameters may lead to Denial of Service

A vulnerability was found in Bouncy Castle. An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java BC Java. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters...

GHSA-8XFC-GM6G-VGPV Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.

An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java BC Java before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of th...

CVE-2023-41593

Multiple cross-site scripting XSS vulnerabilities in Dairy Farm Shop Management System Using PHP and MySQL v1.1 allow attackers to execute arbitrary web scripts and HTML via a crafted payload injected into the Category and Category Field parameters...