31 matches found
CVE-2026-75872 HTML Injection in MailerUp double opt-in verification email
HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the firstname field of t...
CVE-2026-75872
In maalfer MailerUp before 1.1.3, the unauthenticated public subscription form interpolates the first_name field unescaped into the double opt-in verification email, letting remote attackers send arbitrary HTML from the form owner's configured sending identity to an attacker-chosen address. The v...
CVE-2026-75872 HTML Injection in MailerUp double opt-in verification email
HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the firstname field of t...
EUVD-2026-60820
HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the firstname field of t...
CVE-2026-75082
A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument firstname/lastname causes basic cross site scripting. It is possible to...
WordPress Hydra Booking plugin <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter vulnerability
Authenticated Host+ Stored Cross-Site Scripting via 'firstname' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Hydra Booking versions = 1.2.2...
CVE-2026-15948
The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...
EUVD-2026-58861
The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-15948 Hydra Booking <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter
The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-15948
The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-9471 yashpokharna2555 StudentManagementSystem student.php cross site scripting
A vulnerability was detected in yashpokharna2555 StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203. This impacts an unknown function of the file /student.php. Performing a manipulation of the argument FIRSTNAME results in cross site scripting. The attack can be initiated remotely...
EUVD-2026-31700
A security vulnerability has been detected in yashpokharna2555 StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203. This affects the function confirmloggedin of the file studenttrans.php. Such manipulation of the argument FIRSTNAME/LastName/EMAIL leads to sql injection. It is possibl...
CVE-2026-7448
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 5.5.0 due to insufficient input sanitization and output escaping. This makes it possible for...
EUVD-2026-27201
The Zingaya Click-to-Call plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'email', 'firstname', 'lastname', and 'phone' parameters on the plugin's sign-up admin page in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output...
CVE-2026-7296 SourceCodester Pizzafy Ecommerce System ajax.php save_order cross site scripting
A vulnerability was found in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function saveorder of the file /admin/ajax.php?action=saveorder. Performing a manipulation of the argument firstname results in cross site scripting. Remote exploitation of the attack is possible. The explo...
Projectworlds Online Lawyer Management System 代码注入漏洞
Projectworlds Online Lawyer Management System is an online lawyer management system developed by Projectworlds Company in India. Version 1.0 of the Projectworlds Online Lawyer Management System has a code injection vulnerability. This vulnerability arises from incorrect handling of the parameter...
itsourcecode Online Frozen Foods Ordering System SQL注入漏洞
itsourcecode Online Frozen Foods Ordering System is an open-source online frozen food ordering system developed by itsourcecode. Version 1.0 of the system has a SQL injection vulnerability, which stems from incorrect handling of the parameter FirstName in the file admin/admin/editemployee.php. Th...
EUVD-2022-37889
Malicious code in bioql PyPI...
CVE-2024-54994
MonicaHQ v4.1.2 is affected by multiple client-side injection vulnerabilities in the Add a new relationship feature, exploitable via the first_name and last_name parameters. The CVE entry (CVE-2024-54994) lists a CVSS v3.1 base score of 6.5 (Medium) with network attack vector, low complexity, no ...