CVE-2025-14069 Schema & Structured Data for WP & AMP <= 1.54 - Authenticated (Contributor+) Stored Cross-Site Scripting via User Custom Schema

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswpcustomschemafield' profile field in all versions up to, and including, 1.54 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

CVE-2025-14069

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswpcustomschemafield' profile field in all versions up to, and including, 1.54 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Email template field. An attacker can execute arbitrary HTML or script code in the context of the user by injecting malicious content into this field. Details Cross-site scripting or XSS is a code...

CVE-2026-23873

hustoj is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. All versions are vulnerable to CSV Injection Formula Injection through the contest rank export functionality contestrank.xls.php and admin/ranklistexport.php. The application fails to sanitize...

MyBB_Plugin-Delete_Account security vulnerability

MyBBPlugin-DeleteAccount is a MyBB plugin developed by Vintagedaddyo. Version 1.4 of MyBBPlugin-DeleteAccount contains a security vulnerability. This vulnerability stems from the input field used for specifying the reason for account deletion, which has a cross-site scripting vulnerability,...

PT-2026-4501

MyBB Thread Redirect Plugin 0.2.1 contains a cross-site scripting vulnerability in the custom text input field for thread redirects. Attackers can inject malicious SVG scripts that will execute when other users view the thread, allowing arbitrary script execution...

CVE-2021-47893: Allocation of Resources Without Limits or Throttling

AgataSoft PingMaster Pro 2.1 contains a denial of service vulnerability in the Trace Route feature that allows attackers to crash the application by overflowing the host name input field. Attackers can generate a 10,000-character buffer and paste it into the host name field to trigger an...

Linux Kernel Security Vulnerabilities

The Linux kernel is the kernel used by the Linux operating system developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from writing data into the msggetinq field, potentially leading to null pointer dereferencing...

NFC Android Privilege Escalation

The vulnerability of the NFC operating system in Android is related to insufficient validation of input data. Exploiting this vulnerability can allow attackers to enhance their privileges...

PT-2026-4511

Name of the Vulnerable Software and Affected Versions Nsauditor version 3.2.2.0 Description The software contains a denial of service issue that allows attackers to crash the application. This is achieved by overwriting the Event Description field with a large buffer. Specifically, a...

PEEL Shopping Cross-site Scripting Vulnerability

PEEL Shopping is an e-commerce platform operated by the French company PEEL. Version 9.3.0 of PEEL Shopping contains a cross-site scripting vulnerability. This vulnerability stems from improper cleaning of the Comments/Special Instructions parameter, which may lead to storage-based cross-site...

PT-2026-4518

Name of the Vulnerable Software and Affected Versions MyBB Delete Account Plugin version 1.4 Description The MyBB Delete Account Plugin contains a cross-site scripting issue in the account deletion reason input field. An attacker can inject malicious scripts that will execute in the admin interfa...

PT-2026-4323

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp custom schema field' profile field in all versions up to, and including, 1.54 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-4510

Name of the Vulnerable Software and Affected Versions Managed Switch Port Mapping Tool version 2.85.2 Description The software contains a denial of service issue that allows attackers to crash the application. This is achieved by creating an oversized buffer. Specifically, attackers can generate ...

CVE-2026-24038

Horilla HRMS has a 2FA bypass in version 1.4.0 due to a flawed OTP equality check: when OTP expires, the server returns None and omitting the otp field makes user_otp == otp pass, bypassing 2FA. Administrative accounts risk data compromise; fixed in version 1.5.0. Remediation: upgrade to 1.5.0 or...

CVE-2025-27379

A stored cross-site scripting XSS vulnerability in the BOM Viewer in Altium AES 7.0.3 allows an authenticated attacker to inject arbitrary JavaScript into the Description field of a schematic, which is executed when the BOM Viewer renders the affected content...

CVE-2025-27379

A stored cross-site scripting XSS vulnerability in the BOM Viewer in Altium AES 7.0.3 allows an authenticated attacker to inject arbitrary JavaScript into the Description field of a schematic, which is executed when the BOM Viewer renders the affected content...

CVE-2025-27379

CVE-2025-27379 affects the BOM Viewer in Altium AES 7.0.3. A stored XSS vulnerability allows an authenticated attacker to inject arbitrary JavaScript into the Description field of a schematic, which is executed when the BOM Viewer renders the affected content. The issue is tied to the Description...

CVE-2026-23873

hustoj is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. All versions are vulnerable to CSV Injection Formula Injection through the contest rank export functionality contestrank.xls.php and admin/ranklistexport.php. The application fails to sanitize...

PT-2026-3895

Name of the Vulnerable Software and Affected Versions Altium AES version 7.0.3 Description A stored cross-site scripting XSS issue exists in the BOM Viewer component. An authenticated attacker can inject arbitrary JavaScript into the Description field of a schematic. This JavaScript is then...