EUVD-2026-78169

Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked,...

CVE-2024-25293

PoC de Ejecución de Código Local en MJML Una Prueba de Concepto para la vulnerabilidad CVE-2024-25293. Se descubrió que mjml-app v3.0.4 y 3.1.0-beta contienen una vulnerabilidad de ejecución remota de código RCE. En este repositorio hay una aplicación vulnerable de ejemplo y un exploit de prueba ...

CVE-2022-46364-Poc

CVE-2022-46364 利用工具 Apache CXF 通过 MTOM XOP:Include 的 SSRF | CVSS 9.8 严重 漏洞 Apache CXF -s -d -t, --target - 易受攻击的 CXF SOAP 端点（必需） -s, --ssrf-url - 要窃取的内部 URL（必需） -d, --domain - 目标域名（默认：localhost） --plain-soap - 使用纯 SOAP 而非 MTOM 示例 root@kitploit: Read /etc/passwd python3 exploit.py -t...

CVE-2022-44666

Microsoft Windows Contacts VCF/Contact/LDAP syslink コントロールの href 属性エスケープ脆弱性 CVE-2022-44666 0day. これは、John Page aka hyp3rlinxR.1 によって 4 年以上前に完全に開示された、別の忘れ去られた 0day の話です。このレポートを理解するには、私が愚かであることを考慮する必要があります :-...

Mailcow < 2026-03b - Href Link Injection

mailcow 2026-03b reflects raw REQUESTURI into JavaScript and href links on the login page, allowing attackers to inject parameters that break JS logic and enable phishing. id: CVE-2026-40878 info: name: Mailcow 2026-03b - Href Link Injection author: ritikchaddha severity: low description: | mailc...

CVE-2025-58179-Check

CVE-2025-58179-Check CVE-2025-58179-Check は、Astroフレームワークの/imageエンドポイントにおけるSSRF（Server-Side Request Forgery）/コンテンツスプーフィングの脆弱性を検証するためのシンプルなPythonスクリプトです。 この脆弱性は GHSA-qpr4-c339-7vq8 および CVE-2025-58179 として追跡されています。 脆弱性の背景 この脆弱性は、output: 'server' 設定で @astrojs/cloudflare...

CVE-2022-46364

CVE-2022-46364 — Apache CXF MTOM/XOP SSRF（ファイル読み取り） CVE-2022-46364 の概念実証エクスプロイト — Apache CXFのMTOM/XOPリクエスト処理におけるサーバーサイドリクエストフォージェリ（SSRF）脆弱性。 脆弱性の概要 CVE-2022-46364 は、Apache CXF バージョン 3.4.10 および 3.5.5 より前のバージョンに影響します。SOAP サービスで MTOM（Message Transmission Optimization Mechanism）が有効になっている場合、CXF...

CVE-2026-89253

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile field. User::setDonationLink objects/user.php stores the value and save validates it only with filtervar..., FILTERVALIDATEURL, which accepts...

CVE-2026-89244 WWBN AVideo Reflected XSS via Gallery Category getBackURL

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Gallery/view/Category.php when SubCategorys is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing attackers to inje...

EUVD-2026-76056

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Gallery/view/Category.php when SubCategorys is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing attackers to inje...

UBUNTU-CVE-2026-61909

CalDAV/CardDAV multiget bypasses per-href ACL: An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT...

CVE-2026-61909

An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or...

CVE-2026-82659

nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw message...

EUVD-2026-63686

LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API endpoint POST /api/v2/bulk/links accepts URLs without any format validation, allowing an authenticated user to store a javascript: URI. The stored URI is later rendered verbatim as an href in Blad...

CVE-2026-16079 Fullscreen Galleria <= 1.6.12 - Authenticated (Contributor+) SQL Injection via 'href' Attribute in Post Content

The Fullscreen Galleria plugin for WordPress is vulnerable to generic SQL Injection via 'href' Attribute in Post Content in all versions up to, and including, 1.6.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...

PT-2026-73094

The Fullscreen Galleria plugin for WordPress is vulnerable to generic SQL Injection via 'href' Attribute in Post Content in all versions up to, and including, 1.6.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...

SUSE CVE-2026-73648

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVGALLOWLOCALHREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applicatio...

SUSE CVE-2026-73490

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept...

CVE-2026-73648

A flaw was found in rails-html-sanitizer, a component responsible for sanitizing HTML fragments in Rails applications. This vulnerability allows a remote attacker to perform Cross-Site Scripting XSS by exploiting improper sanitization of SVG Scalable Vector Graphics reference elements. The...

CVE-2026-73648 rails-html-sanitizer: Possible XSS vulnerability with certain configurations

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVGALLOWLOCALHREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applicatio...