CVE-2026-3516: Improper Neutralization of Input During Web Page Generation

The Contact List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'clmapiframe' parameter in all versions up to, and including, 3.0.18. This is due to insufficient input sanitization and output escaping when handling the Google Maps iframe custom field. The saveCustomFiel...

CVE-2026-2707: Improper Neutralization of Input During Web Page Generation

The weForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API entry submission endpoint in all versions up to, and including, 1.6.27. This is due to inconsistent input sanitization between the frontend AJAX handler and the REST API endpoint. When entries are...

CVE-2026-25498: Use of Externally-Controlled Input to Select Classes or Code

Craft is a platform for creating digital experiences. In versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, a Remote Code Execution RCE vulnerability exists in Craft CMS where the assembleLayoutFromPost function in src/services/Fields.php fails to sanitize user-supplied configuratio...

PT-2024-5687

Name of the Vulnerable Software and Affected Versions Netcat CMS affected versions not specified Description The issue is related to the lack of protection measures for the SQL query structure in the netcat/message fields.php file of the Netcat CMS system. This could allow a remote attacker to ga...

Cross-Site Scripting (XSS)

intelliants/subrion is vulnerable to cross-site scripting. The vulnerability exists due to lack of sanitization in admin-controllable input caused by the assignValues function of fields.php, which allows an attacker to inject and execute malicious HTML and script code into the web site via the...

PT-2020-14231

Name of the Vulnerable Software and Affected Versions baserCMS versions 4.0.0 through 4.3.6 Description The issue is related to Cross Site Scripting XSS via arbitrary script execution, requiring admin access to exploit. The affected components include content fields.php, content info.php, content...

CVE-2020-10424

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/manage-fields.php by adding a question mark ? followed by the payload...

Cross site scripting

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/manage-fields.php by adding a question mark ? followed by the payload...

CVE-2020-10470

The CVE-2020-10470 issue affects Chadha PHPKB Standard Multi-Language version 9, where a Reflected XSS exists in admin/manage-fields.php through the GET parameter sort. Attackers can inject arbitrary web script or HTML. The primary affected component is the sort parameter in the admin/manage-fiel...

CVE-2020-10470: Improper Neutralization of Input During Web Page Generation

Reflected XSS in admin/manage-fields.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort...

CVE-2020-10424: Improper Neutralization of Input During Web Page Generation

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/manage-fields.php by adding a question mark ? followed by the payload...

Joomla! 3.7.x < 3.7.1 fields.php getListQuery() Method SQLi

According to its self-reported version number, the detected Joomla! application is affected by a SQL injection vulnerability in the fields.php script due to improper sanitization of user-supplied input. An unauthenticated, remote attacker can exploit this to inject or manipulate SQL queries in th...

Joomla! 3.7.0 < 3.7.1 fields.php getListQuery() Method SQLi

The Joomla! installation running on the remote web server is affected by a SQL injection vulnerability in the fields.php script due to improper sanitization of user-supplied input. An unauthenticated, remote attacker can exploit this to inject or manipulate SQL queries in the back-end database,...

Joomla! 3.7.x < 3.7.1 fields.php getListQuery() Method SQLi

According to its self-reported version number, the Joomla! installation running on the remote web server is 3.7.x prior to 3.7.1. It is, therefore, affected by a SQL injection vulnerability in the fields.php script due to improper sanitization of user-supplied input. An unauthenticated, remote...

PT-2014-2498

Name of the Vulnerable Software and Affected Versions PHP-Fusion versions prior to 7.02.06 Description The issue allows remote authenticated users to include and execute arbitrary files via a .. dot dot in the user theme parameter to "maincore.php". Additionally, remote authenticated administrato...