CVE-2026-104413

Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or...

CVE-2025-66470

NiceGUI XSS Scanner - CVE-2025-66470 📸 Скриншот Быстрый, простой сканер для обнаружения CVE-2025-66470 - XSS-уязвимости в компоненте ui.interactiveimage фреймворка NiceGUI. 🔍 Детали уязвимости Поле| Значение ---|--- CVE| CVE-2025-66470 GHSA| GHSA-2m4f-cg75-76w2 Компонент| ui.interactiveimage...

EUVD-2026-91481

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in the Bazar valeur action that allows page editors to make the server fetch arbitrary URLs. Attackers can supply loopback or internal URLs in the url parameter to probe internal services and inject unescaped remote HTML th...

CVE-2026-104470

Versions of YesWiki before 4.6.7 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability within the Bazar valeur action . This flaw allows authenticated page editors to force the server to fetch arbitrary URLs by providing them via the url parameter . By embedding this action with a ...

EUVD-2026-91424

Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or...

CVE-2026-104413 Ghost 5.94.0 before 6.64.0 Stored XSS via Bookmark Card Images

Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or...

CVE-2020-11022

Donc voilà Donc voilà les gars, CVE-2020-11022 est une vulnérabilité dans jQuery pour les versions inférieures à 3.5.0, cette vulnérabilité CVE-2020-11022 déclenche un XSS en exploitant la manipulation du DOM comme par exemple .html, .append, etc., pour exécuter du code XSS malveillant. 1...

CVE-2026-64638

CVE-2026-64638 CVE-2026-64638 быстрая проверка import requests target = "http://127.0.0.1:9000/wp-login.php" payload = 'X' response = requests.posttarget, data="log": payload, "pwd": "x", timeout=5 printresponse.statuscode printresponse.text или POST /wp-login.php HTTP/1.1 Host: 127.0.0.1:9000...

CVE-2026-93756

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output...

sunsetscan

SunsetScan Network security auditing for humans — powered by nmap, built for everyone. Website: sunsetscan.com SunsetScan is a local-network security auditing tool for home network owners and IT staff who want the depth of nmap without learning nmap syntax. Point it at your network and it finds...

CVE-2026-93756 Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output...

CVE-2026-93756

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin (all versions up to and including 4.13.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping when handling Facebook Comment Messages via v-html in...

EUVD-2026-91253

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output...

CVE-2026-1661

The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an...

CVE-2026-1661

The WP Mail Logging WordPress plugin, in versions prior to 1.17.0 , is vulnerable to HTML injection because it fails to properly restrict the HTML and CSS of logged emails before rendering them in admin log screens. This allows unauthenticated users to inject styled content and links—for instance...

CVE-2026-1661 WP Mail Logging < 1.17.0 - Unauthenticated HTML Injection

The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an...

CVE-2025-70849

CVE-2025-70849 : XSS stocké dans Podinfo Résumé Une vulnérabilité de sécurité CWE-79 a été identifiée dans Podinfo , une application web pour démontrer les microservices Kubernetes. La fonctionnalité /store permet à des utilisateurs non authentifiés de télécharger du contenu HTML/JS arbitraire,...

wwwgrep

WWWGrep OWASP Foundation Web Respository Author: Mark Deen & Aditi Mohan Introduction WWWGrep is a rapid search “grepping” mechanism that examines HTML elements by type and permits focused single, multiple file based URLs and recursive with respect to root domain or not searches to be performed...

VUL4J-59

jsoup: Java HTML-парсер, который разбирается в реальном HTML-супе. jsoup — это Java-библиотека для работы с реальным HTML. Она предоставляет очень удобный API для извлечения и манипулирования данными, используя лучшее из DOM, CSS и jQuery-подобных методов. jsoup реализует спецификацию WHATWG HTML...

VUL4J-60

antisamy Une bibliothèque pour effectuer un nettoyage rapide et configurable du HTML provenant de sources non fiables. Une autre façon de le dire : c'est une API qui vous aide à vous assurer que les clients ne fournissent pas de code cargo malveillant dans le HTML qu'ils fournissent pour leur...