CVE-2026-59076

Edito CMS is vulnerable to Stored Cross-Site Scripting (XSS) due to improper input validation. An authenticated attacker can inject malicious scripts into the givenName and surname parameters via the /api/auth/profile endpoint. These scripts execute automatically in an administrator's browser whe...

M&T Bank Vulnerability Disclosure: HTML Injection in Emails on login.mtb.com via givenName parameter leads to phishing attacks

A vulnerability was found that allowed HTML injection in emails on login.mtb.com via the givenName parameter. This vulnerability could have enabled phishing attacks...