CVE-2026-104450: Improper Neutralization of Input During Web Page Generation

YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action tools/attach/actions/pointimage.php, which saves content to an attacker-chosen page with write ACL checks bypassed. Unauthenticated attackers can POST pagetag, title, and description fields to any page rendering...

CVE-2026-1661: Improper Neutralization of Input During Web Page Generation

The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an...

PT-2026-104280

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.6.7 Description A server-side request forgery SSRF issue exists in the Bazar valeur action. Page editors can force the server to fetch arbitrary URLs by manipulating the url parameter. By embedding this action with ...

CVE-2025-52204

CVE-2025-52204 – Reflected XSS / HTML Injection in Znuny customer.pl endpoint Summary A Reflected Cross-Site Scripting XSS and HTML Injection vulnerability exists in Znuny, allowing attackers to inject arbitrary JavaScript or HTML via the parameter defined by the system configuration...

CVE-2026-56662

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the UpdateCE update form contained no anti-CSRF token, and the POST handler performed no token or request-origin verification. A remote attacker can host a page that...

CVE-2009-3036

CVE-2009-3036 SpeeDr00t@Black Falcon bid38241 Symantec IM Manager Console HTML Injection Vulnerability info discussion exploit solution references Bugtraq ID: | 38241 ---|--- Class: | Input Validation Error CVE: | CVE-2009-3036 Remote: | Yes Local: | No Published: | Feb 18 2010 12:00AM Updated: |...

CVE-2026-56662 GetSimple CMS: Missing CSRF protection in UpdateCE allows forging a privileged server-side update request

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the UpdateCE update form contained no anti-CSRF token, and the POST handler performed no token or request-origin verification. A remote attacker can host a page that...

CVE-2026-56662 GetSimple CMS: Missing CSRF protection in UpdateCE allows forging a privileged server-side update request

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the UpdateCE update form contained no anti-CSRF token, and the POST handler performed no token or request-origin verification. A remote attacker can host a page that...

EUVD-2026-91018

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the UpdateCE update form contained no anti-CSRF token, and the POST handler performed no token or request-origin verification. A remote attacker can host a page that...

CVE-2026-56662

GetSimple CMS CE versions prior to 1.5 are vulnerable to a Cross-Site Request Forgery (CSRF) attack due to a lack of anti-CSRF tokens and missing request-origin verification in the UpdateCE update form. A remote attacker can trick an authenticated administrator into visiting a malicious page that...

CVE-2026-48060

CVE-2026-48060 - HTML-инъекция в Litestar через CSRF-токен Этот репозиторий содержит proof of concept эксплойт и уязвимое приложение для демонстрации уязвимости HTML-инъекции, присутствующей в версии 2.21.0 фреймворка Litestar. Как запустить git clone https://github.com/Blinky-Keys/CVE-2026-48060...

cve-2026-64638-banner-poc

CVE-2026-64638 — Универсальный PoC-баннер Одностраничный генератор PoC без зависимостей для отражённой HTML-инъекции в WordPress CVE-2026-64638 на wp-login.php расхождение между striptags и парсером KSES. Он создаёт страницу-триггер с автоматической отправкой формы: когда жертва открывает файл,...

CVE-2026-31281

CVE-2026-31281 Описание Totara LMS уязвим к HTLM-инъекции. Злоумышленник может внедрить вредоносный HTLM-код в сообщение и отправить его всем пользователям приложения, что приведет к выполнению кода и может привести к перехвату сеанса и выполнению команд в браузере жертвы CVSS 3 Score: 7.3 High Т...

CVE-2026-36341

Cross-Site Scripting XSS vulnerability exists in Webkul Krayin CRM HTML Injection CVE: CVE-2026-36341 Summary The vulnerability is particularly critical because it affects the Admin Panel. In many CRM workflows, managers or higher-level admins review activities logged by staff. By injecting a...

CVE-2025-60378

CVE-2025-60378: Хранимая HTML-инъекция в RISE Ultimate Project Manager & CRM ⚠️ Уведомление о безопасности Критическая уязвимость хранимой HTML-инъекции, затрагивающая счета, обмен сообщениями и автоматические уведомления -ff6600 📋 Обзор Критическая уязвимость хранимой HTML-инъекции обнаружена в...

CVE-2025-55903

CVE-2025-55903: PerfexCRM 저장형 HTML 인젝션Stored HTML Injection ⚠️ 보안 권고 인보이스, 청구 및 자동 커뮤니케이션에 영향을 미치는 치명적인 저장형 HTML 인젝션 취약점 -ff6600 📋 개요 PerfexCRM에서 인증된 사용자가 인보이스 설명, 청구 주소 및 고객 메모에 악성 HTML을 주입할 수 있는 저장형 HTML 인젝션 취약점이 발견되었습니다. 주입된 콘텐츠는 데이터베이스에 영구 저장되며 고객 대상 이메일 및 PDF 첨부 파일에 자동으로 렌더링되어 대규모 피싱 공격, 비즈니스...

CVE-2026-33657

CVE-2026-33657 - EspoCRM 9.3.3 Stored HTML Injection in Email Notifications Authenticated proof-of-concept for stored HTML injection in EspoCRM 9.3.3 email notifications. Summary EspoCRM 9.3.3 renders stream-note notification emails by transforming the note body with Markdown and inserting the...

CVE-2023-48104

CVE-2023-48104 HTML Injection in Alinto/SOGo Web Client Vendor of Product Alinto Vulnerability Type HTML Injection Affected Versions SOGo Web Mail https://github.com/Alinto/sogo/commit/7481ccf37087c3f456d7e5a844da01d0f8883098 Discoverer Spiridonov Ivan/E1tex PoC For demonstration purposes only. P...

CVE-2021-45416

CVE-2021-45416 Reflected Cross-site scripting XSS vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the searchterm parameter in the modules/Scheduling/Courses.php script. Vendor: francoisjacquet Vendor Website: https://www.rosariosis.org/ Affected Product: RosarioSIS...

CVE-2025-63419

CVE-2025-63419 CrushFTP before 11.3.760 is vulnerable to HTML Injection. The Web-Based Server has a feature where users can share files, the feature reflects the filename to an emailbody field with no sanitzations leading to HTML Injection. CWE CWE-79 — Improper Neutralization of Input During Web...