Ghost-CMS-Code-Injection-Audit-CVE-2026-26980

Ghost CMS Code Injection Cleaner Removes injected code from every post and page on a Ghost CMS website via the Admin API. Use this to clean up a compromised Ghost site — for example, one affected by the code injection vulnerability CVE-2026-26980 — by stripping attacker-supplied tags and other...

A-potential-Denial-of-Service-issue-in-protobuf-java

A-potential-Denial-of-Service-issue-in-protobuf-java A potential Denial of Service issue in protobuf-java high severity GitHub Reviewed Published 5 days ago in protocolbuffers/protobuf • Updated yesterday Vulnerability details Dependabot alerts 2 Package com.google.protobuf:protobuf-java maven...

Flexible Checkout Fields for WooCommerce <= 2.3.1 - Unauthenticated Arbitrary Plugin Settings Update

The Flexible Checkout Fields for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Plugin Settings update, in addition to Stored Cross-Site Scripting in versions up to, and including, 2.3.1. This is due to missing authorization checks on the updateSettingsAction function...

Discourse - Private User Field Disclosure via Directory Items IDOR

Discourse prior to 2025.12.2, 2026.1.1, and 2026.2.0 contains an IDOR vulnerability caused by lack of authorization checks on userfieldids parameter in DirectoryItemsControllerindex, letting any user retrieve private user field values, exploit requires no authentication. id: CVE-2026-26265 info:...

VidShop for WooCommerce <= 1.1.4 - SQL Injection

VidShop – Shoppable Videos for WooCommerce plugin for WordPress = 1.1.4 contains a time-based SQL injection caused by insufficient escaping of the 'fields' parameter, letting unauthenticated attackers extract sensitive database information. id: CVE-2026-0702 info: name: VidShop for WooCommerce =...

Product Input Fields for WooCommerce < 2.0.2 - Arbitrary File Upload to RCE

WooCommerce WordPress plugin 2.0.2 contains an unrestricted file upload vulnerability caused by lack of validation on uploaded file types when accepted-types setting is empty, letting unauthenticated attackers upload arbitrary files and achieve remote code execution on servers ignoring directory...

WordPress IWS Geo Form Fields <=1.0 - SQL Injection

WordPress IWS Geo Form Fields plugin through 1.0 contains a SQL injection vulnerability. The plugin does not properly escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users. An attacker can possibly obtain sensitive information, modify data,...

WooCommerce Checkout Field Manager < 18.0 - Arbitrary File Upload

The WooCommerce Checkout Field Manager WordPress plugin before 18.0 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server. id: CVE-2022-4328 info: name: WooCommerce Checkout Field Manager 18.0 - Arbitrary File Uploa...

CVE-2020-25270

CVE-2020-25270 PHPGurukul hostel-management-system 2.1 allows XSS via Guardian Name, Guardian Relation, Guardian Contact no, Address, City Vendor - PHPGurukul Product -https://phpgurukul.com/hostel-management-system V2.1 Vulnerability Type - Cross Site Scripting XSS Addition Information - XSS wil...

CVE-2026-19089-WooCommerce-Tyche

CVE-2026-19089 Write-up: https://abraxaslabs.tech/research/CVE-2026-19089 Product Input Fields for WooCommerce 2.0.2 - unauthenticated arbitrary file upload The Tyche Softwares Product Input Fields for WooCommerce plugin does not validate uploaded file types when the field's accepted-types settin...

cs440-langgraph-nosql-demo

CS440 · NoSQL Injection in LangGraph's MongoDBSaver A small, local, browser-based demonstration of a real, published security advisory: unvalidated checkpoint identifiers in the LangGraph MongoDBSaver integration let an attacker smuggle a MongoDB query operator into an identifier field and read...

CVE-2023-30777

CVE-2023-30777 Proof of Concept PoC URL generator for a reflected XSS vulnerability in the Advanced Custom Fields WordPress plugin. PoC Generate by : Alucard0x1 Credit of Exploit : https://patchstack.com/articles/reflected-xss-in-advanced-custom-fields-plugins-affecting-2-million-sites/...

liferay-xss-7.2.1GA2-poc-report-CVE-2020-7934

Authenticated Stored XSS in LifeRay 7.2.1 GA2 via MyAccountPortlet executed by Search Results In LifeRay version 7.1.0 through 7.2.1 GA2 the First Name, Middle Name, and Last Name fields for user accounts are all vulnerable to a Stored XSS issue. Any user can modify these fields with a particular...

CVE-2023-36159

CVE-2023-36159 Cross Site Scripting XSS vulnerability in sourcecodester Lost and Found Information System 1.0 allows remote attackers to run arbitrary code via the First Name, Middle Name and Last Name fields on the Create User page...

CVE-2026-126818

The Ruby object-document mapper Mongoid (version 9.1.1) fails to apply automatic field-level encryption to specific fields when the data model utilizes class inheritance . This flaw allows values designated for encryption to be stored in the database in readable plaintext without errors or warnin...

CVE-2026-126817

A flaw in the Mongoid ODM automatic client-side encryption schema generation may cause values intended for encryption to be stored as cleartext . This occurs specifically when more than one model is mapped onto the same storage location . The system fails to raise any errors or warnings during th...

CVE-2026-125783

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in madalin.ungureanu Custom Post Types and Custom Fields creator – WCK wck-custom-fields-and-custom-post-types-creator allows Reflected XSS.This issue affects Custom Post Types and Custom Fields creat...

CVE-2023-36158

CVE-2023-36158 Cross Site Scripting XSS vulnerability in sourcecodester Toll Tax Management System 1.0 allows remote attackers to run arbitrary code via the First Name and Last Name fields on the My Account page...

EUVD-2026-125417

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in madalin.ungureanu Custom Post Types and Custom Fields creator – WCK wck-custom-fields-and-custom-post-types-creator allows Reflected XSS.This issue affects Custom Post Types and Custom Fields creat...

CVE-2026-125783

The madalin.ungureanu Custom Post Types and Custom Fields creator – WCK (wck-custom-fields-and-custom-post-types-creator) WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) . This flaw occurs due to the Improper Neutralization of Input During Web Page Generation (CWE-79). The ...