CVE-2021-47906 BloofoxCMS 0.5.2.1 - 'text' Stored Cross Site Scripting

BloofoxCMS 0.5.2.1 contains a stored cross-site scripting vulnerability in the articles text parameter that allows authenticated attackers to inject malicious scripts. Attackers can insert malicious javascript payloads in the text field to execute scripts and potentially steal authenticated users...

CVE-2021-47897

CVE-2021-47897 affects PEEL Shopping 9.3.0. A stored cross-site scripting vulnerability exists in the address parameter of the change_params.php script, allowing injected JavaScript that runs in the user’s browser on interaction with the address box. CVSS metrics show a high/severe impact under d...

CVE-2021-47894 Managed Switch Port Mapping Tool 2.85.2 - Denial of Service

Managed Switch Port Mapping Tool 2.85.2 contains a denial of service vulnerability that allows attackers to crash the application by creating an oversized buffer. Attackers can generate a 10,000-character buffer and paste it into the IP Address and SNMP Community Name fields to trigger the...

CVE-2021-47894

CVE-2021-47894 affects Managed Switch Port Mapping Tool 2.85.2. A DoS allows an attacker to crash the application by pasting a 10,000-character buffer into the IP Address and SNMP Community Name fields, exploiting an oversized-buffer condition. The vulnerability impacts availability and is local ...

CVE-2018-25116

The CVE-2018-25116 entry pertains to MyBB Thread Redirect Plugin version 0.2.1, which is documented to contain a cross-site scripting (XSS) vulnerability in the custom text input field for thread redirects. Attackers can inject SVG scripts that execute when other users view the thread, enabling a...

CVE-2025-14069 Schema & Structured Data for WP & AMP <= 1.54 - Authenticated (Contributor+) Stored Cross-Site Scripting via User Custom Schema

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswpcustomschemafield' profile field in all versions up to, and including, 1.54 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

CVE-2025-14069

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswpcustomschemafield' profile field in all versions up to, and including, 1.54 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

CVE-2025-14069 Schema & Structured Data for WP & AMP <= 1.54 - Authenticated (Contributor+) Stored Cross-Site Scripting via User Custom Schema

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswpcustomschemafield' profile field in all versions up to, and including, 1.54 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

CVE-2025-14069

This CVE (CVE-2025-14069) affects Schema & Structured Data for WP & AMP (WordPress) up to version 1.54, via Stored Cross-Site Scripting in the saswp_custom_schema_field. Affected actor must have Contributor+ rights; exploitation would run scripts on pages when viewed by users. The Wordfence entry...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Email template field. An attacker can execute arbitrary HTML or script code in the context of the user by injecting malicious content into this field. Details Cross-site scripting or XSS is a code...

CVE-2026-23873

hustoj is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. All versions are vulnerable to CSV Injection Formula Injection through the contest rank export functionality contestrank.xls.php and admin/ranklistexport.php. The application fails to sanitize...

PT-2026-4501

MyBB Thread Redirect Plugin 0.2.1 contains a cross-site scripting vulnerability in the custom text input field for thread redirects. Attackers can inject malicious SVG scripts that will execute when other users view the thread, allowing arbitrary script execution...

Linux Kernel Security Vulnerabilities

The Linux kernel is the kernel used by the Linux operating system developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from writing data into the msggetinq field, potentially leading to null pointer dereferencing...

PT-2026-4510

Name of the Vulnerable Software and Affected Versions Managed Switch Port Mapping Tool version 2.85.2 Description The software contains a denial of service issue that allows attackers to crash the application. This is achieved by creating an oversized buffer. Specifically, attackers can generate ...

PT-2026-4518

Name of the Vulnerable Software and Affected Versions MyBB Delete Account Plugin version 1.4 Description The MyBB Delete Account Plugin contains a cross-site scripting issue in the account deletion reason input field. An attacker can inject malicious scripts that will execute in the admin interfa...

PT-2026-4323

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp custom schema field' profile field in all versions up to, and including, 1.54 due to insufficient input sanitization and output escaping. This makes it possible for...

PEEL Shopping Cross-site Scripting Vulnerability

PEEL Shopping is an e-commerce platform operated by the French company PEEL. Version 9.3.0 of PEEL Shopping contains a cross-site scripting vulnerability. This vulnerability stems from improper cleaning of the Comments/Special Instructions parameter, which may lead to storage-based cross-site...

MyBB_Plugin-Delete_Account security vulnerability

MyBBPlugin-DeleteAccount is a MyBB plugin developed by Vintagedaddyo. Version 1.4 of MyBBPlugin-DeleteAccount contains a security vulnerability. This vulnerability stems from the input field used for specifying the reason for account deletion, which has a cross-site scripting vulnerability,...

PT-2026-4511

Name of the Vulnerable Software and Affected Versions Nsauditor version 3.2.2.0 Description The software contains a denial of service issue that allows attackers to crash the application. This is achieved by overwriting the Event Description field with a large buffer. Specifically, a...

CVE-2026-24038

Horilla HRMS has a 2FA bypass in version 1.4.0 due to a flawed OTP equality check: when OTP expires, the server returns None and omitting the otp field makes user_otp == otp pass, bypassing 2FA. Administrative accounts risk data compromise; fixed in version 1.5.0. Remediation: upgrade to 1.5.0 or...