CVE-2026-88782 Kubio AI Page Builder < 2.9.3 - Contributor+ Stored XSS via Image Gallery Item URL Attribute

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an...

Volumiser

Volumiser Introducción Volumiser es una herramienta de línea de comandos y una GUI de consola interactiva para listar, explorar y extraer archivos de formatos comunes de imágenes de discos duros de máquinas virtuales. La herramienta fue escrita para combatir un problema habitual: las imágenes de...

CVE-2026-92826

The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...

CVE-2026-92826 EWWW Image Optimizer <= 8.7.7 - Reflected Cross-Site Scripting via REQUEST_URI Parameter Key

The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...

EUVD-2026-91894

The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...

CVE-2026-92826 EWWW Image Optimizer <= 8.7.7 - Reflected Cross-Site Scripting via REQUEST_URI Parameter Key

The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...

CVE-2026-92826

The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 8.7.7 . The root cause is insufficient input sanitization and output escaping within the REQUEST_URI Parameter Key . An unauthenticated attacker can inject arbit...

CVE-2019-11447

CVE-2019-11447 - PoC Explota CuteNews 2.1.2 mediante comprobaciones deficientes de carga de archivos utilizadas al subir una imagen de avatar, lo que conduce a RCE. Instalación Clona el repositorio e instala los requisitos. pip install -r requirements.txt Uso Para subir un avatar necesitarás una...

CVE-2026-104477

A flaw was found in showdown. The link and image parsers fail to properly sanitize or escape double quotation marks in destination URLs when rendering HTML attributes. A remote attacker could exploit this flaw by supplying crafted Markdown input containing malicious event handlers, leading to...

EUVD-2026-91853

Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or...

[SECURITY] Fedora 45 Update: GraphicsMagick-1.3.45-11.fc45

GraphicsMagick is a comprehensive image processing package which is initially based on ImageMagick 5.5.2, but which has undergone significant re-work by the GraphicsMagick Group to significantly improve the quality and performance of the software...

[SECURITY] Fedora 45 Update: dcmtk-3.6.9-9.fc45

DCMTK is a collection of libraries and applications implementing large parts the DICOM standard. It includes software for examining, constructing and converting DICOM image files, handling offline media, sending and receiving images over a network connection, as well as demonstrative image storag...

CVE-2026-104477

Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or...

CVE-2019-11447-POC

sadnews CuteNews 2.1.2 - CVE-2019-11447 Prueba de Concepto POC por CRFSlick, descubierto por AkkuS Se descubrió un problema en CutePHP CuteNews 2.1.2. Un atacante puede infiltrarse en el servidor mediante el proceso de carga de avatar en el área de perfil a través del campo avatarfile hacia...

PT-2026-104553

Name of the Vulnerable Software and Affected Versions Twenty20 Image Before-After versions prior to 2.0.6 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved ...

PT-2026-104500

Name of the Vulnerable Software and Affected Versions Photo Reviews for WooCommerce versions prior to 1.2.31 Description An issue allows unauthenticated attackers to permanently delete arbitrary posts, pages, products, or media attachments. The flaw occurs because the plugin stores...

PT-2026-104492

The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST URI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-92826: Improper Neutralization of Input During Web Page Generation

The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...

PT-2026-104514

Name of the Vulnerable Software and Affected Versions Wp Social Login and Register Social Counter versions prior to 3.2.2 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. An...

CVE-2026-92767: Improper Neutralization of Input During Web Page Generation

The Twenty20 Image Before-After plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'offset' Shortcode Attribute in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...