CVE-2026-96270 Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formid' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and...

Apache HTTP Server <=2.4.39 - HTML Injection/Partial Cross-Site Scripting

Apache HTTP Server versions 2.4.0 through 2.4.39 are vulnerable to a limited cross-site scripting issue affecting the modproxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server...

NETGEAR ProSAFE Plus - Unauthenticated Remote Code Execution

NETGEAR ProSAFE Plus before 2.6.0.43 is susceptible to unauthenticated remote code execution. Any HTML page is allowed as a valid endpoint to submit POST requests, allowing debug action via the submitId and debugCmd parameters. The problem is publicly exposed in the login.html webpage, which has ...

Intelbras WIN 300/WRN 342 - Credentials Disclosure

Intelbras WIN 300 and WRN 342 devices through 2021-01-04 allows remote attackers to discover credentials by reading the defwirelesspassword line in the HTML source code. id: CVE-2021-3017 info: name: Intelbras WIN 300/WRN 342 - Credentials Disclosure author: pikpikcu severity: high description:...

CVE-2026-104477

A flaw was found in showdown. The link and image parsers fail to properly sanitize or escape double quotation marks in destination URLs when rendering HTML attributes. A remote attacker could exploit this flaw by supplying crafted Markdown input containing malicious event handlers, leading to...

[SECURITY] Fedora 45 Update: xhtml1-dtds-1.0-20020801.26.fc45

This provides the DTDs of the Second Edition of XHTML 1.0, a reformulation of HTML 4 as an XML 1.0 application, and three DTDs corresponding to the ones defined by HTML 4. The semantics of the elements and their attributes are defined in the W3C Recommendation for HTML 4. These semantics provide...

[SECURITY] Fedora 45 Update: libxml2-2.15.4-1.fc45

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...

Linux Distros Unpatched Vulnerability : CVE-2026-103626

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engineering to potential...

PT-2026-104528

Name of the Vulnerable Software and Affected Versions Kubio AI Page Builder WordPress plugin versions prior to 2.9.3 Description The plugin fails to restrict the expansion of allowed HTML elements to the editor context. Consequently, this expanded set of allowed elements is applied to content...

nahsra__antisamy_CVE-2022-29577_1-6-6-1

AntiSamy Una biblioteca para realizar una limpieza rápida y configurable de HTML proveniente de fuentes no confiables. Compatible con Java 7+. Otra forma de decirlo podría ser: es una API que te ayuda a asegurarte de que los clientes no proporcionen código malicioso en el HTML que envían para su...

nahsra__antisamy_CVE-2017-14735_1-5-6

AntiSamy Una librería para realizar una limpieza rápida y configurable de HTML proveniente de fuentes no confiables. Compatible con Java 8+. Otra forma de decirlo podría ser: es una API que te ayuda a asegurarte de que los clientes no suministren código malicioso en el HTML que proporcionan para ...

tryhackme-moniker-link

tryhackme-moniker-link Documentación de mi laboratorio práctico Moniker Link CVE-2024-21413 completado en TryHackMe. Moniker Link CVE-2024-21413 — Laboratorio de TryHackMe Resumen Este repositorio documenta mi estudio práctico en una sala de TryHackMe. El objetivo de este ejercicio era comprender...

Yordam-Kutuphane-Otomasyonunda-Coklu-HTML-Enjeksiyonu

Múltiple Inyección de HTML en Yordam-Kütüphane-Otomasyonunda CVE-2026-77818 · CVSS 3.1 6.1 Media · Presidencia de Ciberseguridad · Publicado 2026-09-04 · TR-26-1011 Estado: Las vulnerabilidades se han corregido en la versión v22.2. Las instalaciones afectadas deben actualizarse a v22.2 o superior...

CVE-2025-51591-Pandoc-SSRF-POC

CVE-2025-51591 POC de SSRF en Pandoc Una vulnerabilidad de Server-Side Request Forgery SSRF en JGM Pandoc v3.6.4 permite a los atacantes obtener acceso y comprometer toda la infraestructura mediante la inyección de un iframe manipulado. Instalar Pandoc https://pandoc.org/installing.html Ejemplo d...

CVE-2026-79294

CVE-2026-79294 CVE-2026-79294 — Stored XSS in Moonshot AI Kimi's HTML artifact Preview, delivered through the public Share view, leading to session token exfiltration and demonstrated account takeover. Responsible disclosure advisory. Vulnerability Details Vulnerability Type: Stored/Stored-like...

CVE-2022-44311

Descripción de CVE-2022-44311 Se descubrió que html2xhtml v1.3 contiene una lectura fuera de los límites en la función static void elmclosetreenodet nodo en procesador.c. Esta vulnerabilidad permite a los atacantes acceder a archivos sensibles o provocar una denegación de servicio DoS mediante un...

CVE-2026-104871 Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows

The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containi...

cve-disclosures

Divulgaciones de CVE — Aman Bahiniya Tres CVE asignados por MITRE en diciembre de 2024. Los registros fueron reservados pero nunca publicados, por lo que aún no hay nada indexado. Este repositorio publica los avisos para que los CVE sean buscables y acreditados. CVE| Producto| Tipo ---|---|---...

DEBIAN-CVE-2026-103625

Type confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

DEBIAN-CVE-2026-103627

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...