CVE-2021-24545

CVE-2021-24545 目前该插件已停止分发，是在该插件中发现的XSS漏洞。 WordPress Plugin HTML Author Bio description XSS 该漏洞是由于 /wp-admin/profile.php 中 description 参数的不当验证引起的。 远程攻击者可以通过发送恶意构造的HTTP请求进行攻击。 安装及运行步骤 1. WordPress 安装 进行安装时，请在 docker-compose.yml 文件中进行端口转发。 $ docker-compose up 2. WordPress initial & Plugin...

CVE-2026-75731

creationtimestamp| type| source ---|---|--- 2026-09-10 21:19:07+00:00| seen| https://bsky.app/profile/experiencedigest.bsky.social/post/3mv6y4cqaxs2k...

WordPress User Profile Builder plugin <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field vulnerability

Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field vulnerability discovered by daroo in WordPress Plugin Profile Builder versions = 3.15.7...

CVE-2026-6431

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and...

CVE-2026-6431 User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and...

GHSA-P9R8-2Q67-FP86

creationtimestamp| type| source ---|---|--- 2026-08-20 14:00:04+00:00| published-proof-of-concept| Telegram/s3A4zS-xINsQCOFnw3lncQJfAtm8MI1VEo1sscCDdPigg 2026-08-20 16:00:50+00:00| seen| https://thehackernews.com/2026/08/nasa-ait-gui-flaws-could-let.html 2026-08-21 00:00:09+00:00|...

CVE-2026-66772

creationtimestamp| type| source ---|---|--- 2026-08-13 08:48:23+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0998...

CVE-2026-12047 pgAdmin 4: HTML injection in cloud verify_credentials / deploy endpoints via unsanitised SDK exception text

HTML injection in pgAdmin 4's cloud deployment module. The verifycredentials, deploy, regions, and update-server endpoints under /rds/, /azure/, /google/, and the top-level /cloud/ blueprint propagated AWS / Azure / Google SDK exception text — and the related file-resolution and database-commit...

CVE-2022-50586

Nagios XI versions prior to 5.8.9 are vulnerable to cross-site scripting XSS in the BPI component via the info URL field. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser...

CVE-2022-50586

Nagios XI versions prior to 5.8.9 are vulnerable to cross-site scripting XSS in the BPI component via the info URL field. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser...

PT-2025-44483

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 5.8.9 Description The software is susceptible to cross-site scripting XSS within the BPI component through manipulation of the info URL field. A lack of proper input validation or escaping could enable an attacker t...

CVE-2023-27652

An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges cause a denial of service via the updateinfo field of the default.xml file...

CVE-2023-27651

An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges via the updateinfo field of the default.xml file...

PT-2023-21285

Name of the Vulnerable Software and Affected Versions Ego Studio SuperClean versions 1.1.5 through 1.1.9 Description An issue in Ego Studio SuperClean allows an attacker to gain privileges via the update info field of the default .xml file. Recommendations For versions 1.1.5 through 1.1.9, consid...

SUSE CVE-2004-0007

Buffer overflow in the Extract Info Field Function for 1 MSN and 2 YMSG protocol handlers in Gaim 0.74 and earlier, and Ultramagnetic before 0.81, allows remote attackers to cause a denial of service and possibly execute arbitrary code...

Scoutnet Kalender <= 1.1.0 - Stored Cross-Site Scripting (XSS)

The plugin does not sanitise the 'Info' field from embedded calendars which are retrieved from Scoutnet and are not necessarily owned/managed by the administrator of the blog...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in TBDev.NET 01-01-08 allow remote attackers to inject arbitrary web script or HTML via 1 the returnto parameter to makepoll.php, 2 the returnto parameter in a delete action to polls.php, or the 3 Info or 4 Avatar field to my.php...

CVE-2004-0007: Undefined Security Weakness

Buffer overflow in the Extract Info Field Function for 1 MSN and 2 YMSG protocol handlers in Gaim 0.74 and earlier, and Ultramagnetic before 0.81, allows remote attackers to cause a denial of service and possibly execute arbitrary code...