CVE-2026-104477: Improper Neutralization of Input During Web Page Generation

Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or...

PT-2026-104514

Name of the Vulnerable Software and Affected Versions Wp Social Login and Register Social Counter versions prior to 3.2.2 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. An...

PT-2026-104553

Name of the Vulnerable Software and Affected Versions Twenty20 Image Before-After versions prior to 2.0.6 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved ...

PT-2026-104492

The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST URI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

PT-2026-104500

Name of the Vulnerable Software and Affected Versions Photo Reviews for WooCommerce versions prior to 1.2.31 Description An issue allows unauthenticated attackers to permanently delete arbitrary posts, pages, products, or media attachments. The flaw occurs because the plugin stores...

ImgBackdoor

| | | \ | | | | | | | | | | | | | | | | ' \ / | / |/ | |/ / |/ \ / | '| | || | | | | | | | | | | | | | | | | | ||| || ||, |/ ,|||\,|/ /|| / | |/ Version release: v1.0 Stable Author: Ferdi S Kennedy kennedy69 Distros Supported : Linux Ubuntu, Kali, Mint, Parrot OS Legal Disclamer: The author...

KeyDecoder

KeyDecoder KeyDecoder is a mobile app created for pentesters and security enthusiasts. From the picture of a key, one can measure its bitting easily. Developped by Maxime BEASSE and Quentin CLEMENT. In partnership with FrenchKey and CNS from ESIEA. Powered by Flutter 3.13.6 and OpenCV 4.3.0 Summa...

CVE-2026-104477 Showdown through 2.1.0 XSS via unescaped quote in href and src attributes

Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or...

CVE-2026-104477 Showdown through 2.1.0 XSS via unescaped quote in href and src attributes

Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or...

CVE-2026-104477 Showdown through 2.1.0 XSS via unescaped quote in href and src attributes

Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or...

CVE-2026-104477

The Showdown library (versions through 2.1.0 ) is vulnerable to Cross-Site Scripting (XSS) due to a flaw in the makehtml link and image subparsers. The root cause is the failure to properly sanitize or escape double quotes in destination URLs when rendering HTML attributes like href and src. A re...

@ampproject/eleventy-plugin-amp (>=0.5.6, <=0.5.8), @ampproject/toolbox-cli (>=2.0.0-alpha.0, <=3.0.0-canary.2) +37 more potentially affected by CVE-2026-104861 via probe-image-size (>=7.0.0, <=7.3.0)

probe-image-size NPM version =7.0.0, =0.5.6, =2.0.0-alpha.0, =2.8.0-canary.6, =2.8.8, =0.1.0, =0.19.44, =0.1.0, =0.1.0, =0.1.0, =14.9.23-prev, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.11.0, =7.0.0 and more Source cves: CVE-2026-104861 Source advisory: OSV:GHSA-GJJ5-9665-RWRC...

GHSA-GJJ5-9665-RWRC probe-image-size: Quadratic-time Denial of Service in the SVG Parser

Overview probe-image-size scans the SVG header with a searching regular expression, //. On input that contains many , the engine restarts the ^ scan at every position and runs to end of input each time, giving quadratic time complexity. Both the synchronous and the streaming parser are affected...

NPM: probe-image-size: Quadratic-time Denial of Service in the SVG Parser

NPM: probe-image-size: Quadratic-time Denial of Service in the SVG Parser vulnerability discovered by ? in WordPress Npm probe-image-size versions = 7.3.0...

probe-image-size: Quadratic-time Denial of Service in the SVG Parser

Overview probe-image-size scans the SVG header with a searching regular expression, //. On input that contains many , the engine restarts the ^ scan at every position and runs to end of input each time, giving quadratic time complexity. Both the synchronous and the streaming parser are affected...

CVE-2022-45472

CVE-2022-45472 DOM Based XSS Software: CAE Learning Space Enterprise with Intuity License Image Version: 267r Patch Level: 639 Vulnerability: DOM Based XSS Description The CAE Learning Space Enterprise management software is vulnerable to a DOM Based XSS attack. A DOM Based XSS attack is when a...

D1rkSleep

D1rkSleep Improved version of EKKO by @5pider that Encrypts only Image Sections. Sleep obfuscation technique that uses CreateTimerQueueTimer Win32 API. Credits: https://github.com/Cracked5pider/Ekko...

REpsych

REpsych : Psychological Warfare in Reverse Engineering github.com/xoreaxeaxeax/repsych // domas // @xoreaxeaxeax Overview The REpsych toolset is a proof-of-concept illustrating the generation of images through a program's control flow graph CFG. A typical function's CFG| A REpsych generated CFG...

REpsych

REpsych : Psychological Warfare in Reverse Engineering github.com/xoreaxeaxeax/repsych // domas // @xoreaxeaxeax Overview The REpsych toolset is a proof-of-concept illustrating the generation of images through a program's control flow graph CFG. A typical function's CFG| A REpsych generated CFG...

screenscrub

screenscrub Find credentials in screenshots, extract them to a secret manager, and irreversibly redact them from the images — so secrets don't rot in your notes, screenshots, and /Desktop. Local. Offline. Silent. No network, no telemetry by default. screenscrub bridges two existing tool categorie...