CVE-2026-88782 Kubio AI Page Builder < 2.9.3 - Contributor+ Stored XSS via Image Gallery Item URL Attribute

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an...

Volumiser

Volumiser Introduction Volumiser is a command line tool and interactive console GUI for listing, browsing and extracting files from common virtual machine hard disk image formats. The tool was written to combat a regular problem where massive 100G+ disk images are often hard to work with or...

CVE-2026-92826

The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...

CVE-2026-92826

The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 8.7.7 . The root cause is insufficient input sanitization and output escaping within the REQUEST_URI Parameter Key . An unauthenticated attacker can inject arbit...

CVE-2026-92826 EWWW Image Optimizer <= 8.7.7 - Reflected Cross-Site Scripting via REQUEST_URI Parameter Key

The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...

EUVD-2026-91894

The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...

CVE-2019-11447

CVE-2019-11447 - PoC Exploits CuteNews 2.1.2 via poor file upload checks used when uploading an avatar image leading to RCE. Installation Clone the repository and install the requirements. pip install -r requirements.txt Usage In order to upload an avatar you will require a CuteNews user account,...

CVE-2026-104477

A flaw was found in showdown. The link and image parsers fail to properly sanitize or escape double quotation marks in destination URLs when rendering HTML attributes. A remote attacker could exploit this flaw by supplying crafted Markdown input containing malicious event handlers, leading to...

EUVD-2026-91853

Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or...

[SECURITY] Fedora 45 Update: GraphicsMagick-1.3.45-11.fc45

GraphicsMagick is a comprehensive image processing package which is initially based on ImageMagick 5.5.2, but which has undergone significant re-work by the GraphicsMagick Group to significantly improve the quality and performance of the software...

[SECURITY] Fedora 45 Update: dcmtk-3.6.9-9.fc45

DCMTK is a collection of libraries and applications implementing large parts the DICOM standard. It includes software for examining, constructing and converting DICOM image files, handling offline media, sending and receiving images over a network connection, as well as demonstrative image storag...

CVE-2026-104477

Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or...

CVE-2019-11447-POC

sadnews CuteNews 2.1.2 - CVE-2019-11447 Proof-Of-Concept POC by CRFSlick, discovered by AkkuS An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile area via the avatarfile field to index.php?mod=main&opt=personal...

CVE-2026-104477: Improper Neutralization of Input During Web Page Generation

Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or...

CVE-2026-92767: Improper Neutralization of Input During Web Page Generation

The Twenty20 Image Before-After plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'offset' Shortcode Attribute in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-92826: Improper Neutralization of Input During Web Page Generation

The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...

ImgBackdoor

| | | \ | | | | | | | | | | | | | | | | ' \ / | / |/ | |/ / |/ \ / | '| | || | | | | | | | | | | | | | | | | | ||| || ||, |/ ,|||\,|/ /|| / | |/ Версия релиза: v1.0 Стабильная Автор: Ferdi S Kennedy kennedy69 Поддерживаемые дистрибутивы: Linux Ubuntu, Kali, Mint, Parrot OS Отказ от...

KeyDecoder

KeyDecoder KeyDecoder is a mobile app created for pentesters and security enthusiasts. From the picture of a key, one can measure its bitting easily. Developped by Maxime BEASSE and Quentin CLEMENT. In partnership with FrenchKey and CNS from ESIEA. Powered by Flutter 3.13.6 and OpenCV 4.3.0 Summa...

CVE-2026-104477

The Showdown library (versions through 2.1.0 ) is vulnerable to Cross-Site Scripting (XSS) due to a flaw in the makehtml link and image subparsers. The root cause is the failure to properly sanitize or escape double quotes in destination URLs when rendering HTML attributes like href and src. A re...

CVE-2026-104477 Showdown through 2.1.0 XSS via unescaped quote in href and src attributes

Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or...