14181 matches found
CVE-2026-96813: Improper Neutralization of Input During Web Page Generation
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields in all versions up to, and including, 1.15.47 due to insufficient input sanitization and output escaping. This mak...
CVE-2026-102998
A flaw was found in pypdf. A remote attacker can exploit this issue by submitting a specially crafted PDF document with specific form field values. When an application updates these fields with flattening enabled, redundant computational operations are repeated inside a loop during appearance...
WordPress Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting vulnerability
Reflected DOM-Based Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin Calculated Fields Form versions = 5.5.1.3...
EUVD-2026-89726
A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure...
CVE-2026-102587 Moodle: user list filters bypass profile field visibility
A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure...
CVE-2026-93460
A stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser...
EUVD-2026-89662
Stored Cross-site scripting via appended strings in email form fields vulnerability exists in baserCMS . If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser may be caused...
CVE-2026-93460
A Stored Cross-site scripting (XSS) vulnerability (CWE-79) exists in baserCMS due to the handling of appended strings in email form fields. If exploited, an attacker can execute arbitrary scripts within a user's web browser. To remediate this issue, users should update the software to the latest ...
CVE-2026-93460
A stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser...
CVE-2026-93460
A stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser...
CVE-2026-82127 Schema & Structured Data for WP & AMP < 1.67 - Editor+ Stored XSS via Taxonomy Term Fields
The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher...
CVE-2026-82127 Schema & Structured Data for WP & AMP < 1.67 - Editor+ Stored XSS via Taxonomy Term Fields
The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher...
CVE-2026-82127
The Schema & Structured Data for WP & AMP WordPress plugin (versions before 1.67 ) is vulnerable to a stored cross-site scripting (XSS) flaw. The vulnerability exists because the plugin fails to perform proper capability checks when saving specific fields and lacks sufficient output escaping . Th...
CVE-2026-93460: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser...
PT-2026-103066
Name of the Vulnerable Software and Affected Versions baserCMS affected versions not specified Description A stored cross-site scripting issue exists where arbitrary scripts can be executed in a user's web browser. This occurs through the use of appended strings within email form fields...
PT-2026-103054
The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'data fields list' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...
Linux Distros Unpatched Vulnerability : CVE-2026-55214
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website field...
xss-methodology
XSS Methodology Not a payload list. This covers how to find X...
CVE-2026-77762
A flaw was found in Apache Tomcat. This vulnerability, caused by a race condition during concurrent execution, allows an attacker to inject unauthorized data, known as trailer fields, into another user's HTTP/2 request. This could lead to the manipulation of web traffic or unintended information...
