678 matches found
CVE-2026-3300
CVE-2026-3300 - Wordpress ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments Example setup: git clone cd Project use python follow below Create a virtual...
CVE-2026-34621_PDF_SAMPLE
Technical Analysis of a Multi-Stage Adobe Acrobat PDF JavaScript Sample Overview This repository publishes a code-centric reverse-engineering write-up on a malicious PDF sample that embeds staged Adobe Acrobat JavaScript. The analyzed sample uses a hidden form field as its initial loader,...
CVE-2026-106648
The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails, allowing unauthenticated attackers to replace the recipient list and relay attacker-composed email from...
EUVD-2026-111971
The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails, allowing unauthenticated attackers to replace the recipient list and relay attacker-composed email from...
CVE-2026-106648
The Royal Elementor Addons WordPress plugin (versions prior to 1.7.1070 ) is vulnerable to Unauthenticated Arbitrary Email Recipient Injection . The root cause is the failure to validate submitted form field values before substituting them into the recipient addresses of form notification emails....
CVE-2026-106648 Royal Elementor Addons < 1.7.1070 - Unauthenticated Arbitrary Email Recipient Injection via Form Field ID Shortcodes
The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails, allowing unauthenticated attackers to replace the recipient list and relay attacker-composed email from...
CVE-2026-106648 Royal Elementor Addons < 1.7.1070 - Unauthenticated Arbitrary Email Recipient Injection via Form Field ID Shortcodes
The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails, allowing unauthenticated attackers to replace the recipient list and relay attacker-composed email from...
PT-2026-128088
The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails, allowing unauthenticated attackers to replace the recipient list and relay attacker-composed email from...
CVE-2026-90821
An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input...
CVE-2026-90821 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller
An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input...
EUVD-2026-102872
An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input...
CVE-2026-90821
An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input...
WordPress Visual Form Builder plugin <= 3.1 - Subscriber+ Arbitrary Form Field Reordering vulnerability
Subscriber+ Arbitrary Form Field Reordering vulnerability discovered by Chamseddine Bouzaiene in WordPress Plugin Visual Form Builder versions = 3.1...
CVE-2026-105973 Visual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing Authorization
The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user Subscriber and above to alter the field structure of any form on the site, persistently breaking its public rendering...
CVE-2026-105973
The Visual Form Builder WordPress plugin (versions
PT-2026-115611
Name of the Vulnerable Software and Affected Versions Crafty Controller affected versions not specified Description An input neutralization issue in the Webhook URL form field component allows a remote, authenticated attacker to execute stored Cross-Site Scripting XSS by providing malicious input...
Astra Linux – Vulnerability in Python-Django
A issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. A lack of enforcement of an upper-bound limit on strings passed during IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions cleanipv6address and...
CVE-2026-83592
The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form Field Values in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
CVE-2026-83592 Contact Form DB for Enfold <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form Field Values
The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form Field Values in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
EUVD-2026-100795
The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form Field Values in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...