PT-2026-104501

Name of the Vulnerable Software and Affected Versions Magic Tooltips For Contact Form 7 versions prior to 1.0.35 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that...

PT-2026-104528

Name of the Vulnerable Software and Affected Versions Kubio AI Page Builder WordPress plugin versions prior to 2.9.3 Description The plugin fails to restrict the expansion of allowed HTML elements to the editor context. Consequently, this expanded set of allowed elements is applied to content...

Linux Distros Unpatched Vulnerability : CVE-2026-103626

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engineering to potential...

PT-2026-104487

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form id' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and...

CVE-2026-96270: Improper Neutralization of Input During Web Page Generation

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formid' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and...

CVE-2026-95294

An ui misrepresentation flaw was found in the Browser component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/513992281...

nahsra__antisamy_CVE-2022-29577_1-6-6-1

AntiSamy 신뢰할 수 없는 출처에서 오는 HTML을 빠르고 설정 가능하게 정리하는 라이브러리입니다. Java 7+를 지원합니다. 다른 방식으로 말하자면: 클라이언트가 프로필, 댓글 등에 제공하는 HTML에 악성 코드를 포함하지 않도록 하고, 이것이 서버에 저장되는 것을 방지하는 API입니다. 웹 애플리케이션에서 '악성 코드'라는 용어는 일반적으로 'JavaScript'를 의미합니다. 대부분의 경우, CSSCascading Stylesheets는 JavaScript를 호출할 때만 악성으로 간주됩니다. 그러나 '정상적인'...

nahsra__antisamy_CVE-2017-14735_1-5-6

AntiSamy 신뢰할 수 없는 소스에서 들어오는 HTML을 빠르고 설정 가능하게 정리하는 라이브러리입니다. Java 8 이상을 지원합니다. 다른 말로 표현하자면: 클라이언트가 프로필, 댓글 등에 제공하는 HTML에 악성 코드를 포함하지 않도록 서버에 저장되기 전에 검증하는 API입니다. 웹 애플리케이션에서 '악성 코드'는 일반적으로 'JavaScript'를 의미합니다. 대부분의 경우, CSSCascading Stylesheets는 JavaScript를 호출할 때만 악성으로 간주됩니다. 하지만 '정상적인' HTML과 CSS도...

tryhackme-moniker-link

tryhackme-moniker-link TryHackMe で完了したハンズオンラボ Moniker Link CVE-2024-21413 のドキュメントです。 Moniker Link CVE-2024-21413 — TryHackMe ラボ 概要 このリポジトリは、TryHackMe のルームでのハンズオン学習の記録です。 この演習の目的は、脆弱性がどのように機能するかを理解し、意図的に脆弱なマシンに対してテストすることでした。 注: このラボで使用された元の Proof of Concept は、TryHackMe の学習教材の一部として提供され、CMNatic...

Yordam-Kutuphane-Otomasyonunda-Coklu-HTML-Enjeksiyonu

Yordam-图书馆自动化系统中的多重HTML注入 CVE-2026-77818 · CVSS 3.1 6.1（中危）· 网络安全局 · 发布日期 2026-09-04 · TR-26-1011 状态： 漏洞已在 v22.2 版本中修复。受影响的安装必须升级到 v22.2 或更高版本。 概述 Yordam 图书馆自动化系统是土耳其大学、公共和机构图书馆中广泛使用的商业图书馆自动化与在线目录（OPAC）软件。安装方式为本地部署（on-premise）；每个客户机构运行独立的副本。 在该产品的 v22.1 版本中，存在三个相互独立的 反射型 HTML...

CVE-2025-51591-Pandoc-SSRF-POC

CVE-2025-51591 Pandoc SSRF 概念验证 JGM Pandoc v3.6.4 中存在服务器端请求伪造（SSRF）漏洞，攻击者可通过注入精心构造的 iframe 来获取访问权限并入侵整个基础设施。 安装 Pandoc https://pandoc.org/installing.html 载荷示例 ⚠️ 请将 iframe 的 URL 替换为你自己的 OAST URL。⚠️ CVE-2025-51591 Proof Of Concept CVE-2025-51591 Proof Of Concept 使用 Pandoc 将载荷转换为 PDF pandoc...

CVE-2026-79294

CVE-2026-79294 CVE-2026-79294 — Stored XSS in Moonshot AI Kimi's HTML artifact Preview, delivered through the public Share view, leading to session token exfiltration and demonstrated account takeover. Responsible disclosure advisory. Vulnerability Details Vulnerability Type: Stored/Stored-like...

CVE-2022-44311

CVE-2022-44311 の説明 html2xhtml v1.3 には、procesador.c の関数 static void elmclosetreenodet nodo に Out-Of-Bounds 読み取り 領域外読み取り が存在することが判明しました。この脆弱性により、攻撃者は巧妙に細工された HTML ファイルを介して機密ファイルにアクセスしたり、サービス拒否 DoS を引き起こしたりできます。 再現方法 この脆弱性を再現するには、影響を受けるバージョンの html2xhtml v1.3 をダウンロードしてプロジェクトをコンパイルします: wget...

CVE-2026-104871 Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows

The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containi...

cve-disclosures

CVE 開示 — Aman Bahiniya 2024年12月にMITREから割り当てられた3件のCVE。レコードは予約されたものの公開されていないため、まだ何もインデックスされていません。このリポジトリはアドバイザリを公開し、CVEが検索可能でクレジット付きになるようにします。 CVE| 製品| 種別 ---|---|--- CVE-2024-57551| Online Food Ordering System v2.0| 任意ファイルアップロード → RCE CVE-2024-57552| Online Food Ordering System v2.0| 格納型XSS...

DEBIAN-CVE-2026-103627

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

DEBIAN-CVE-2026-103625

Type confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-103625

Type confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-103627

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-103627

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...