CVE-2023-51800

CVE-2023-51800 School Fees Management System v1.0 - 多个跨站脚本（XSS）漏洞 描述 ：School Fees Management System v1.0 存在多个跨站脚本（XSS）漏洞。 受影响的产品版本 ：School Fees Management System v1.0 CVE 作者 ：Geraldo Alcântara 日期 ：28/11/2023 确认日期 ：10/12/2023 CVE ：CVE-2023-51800 CVE 链接 ：https://vulners.com/cve/CVE-2023-51800 NVD 链...

CVE-2026-19089-WooCommerce-Tyche

CVE-2026-19089 — WooCommerce Tyche Product Input Fields Estado: incompleto / trabajo en curso. Este repositorio es un esqueleto. El script no es un PoC terminado, no está empaquetado para su uso y no debe tratarse como una demostración completa o fiable. Notas de investigación de Abraxas Labs par...

CVE-2020-15051

CVE-2020-15051 : Artica Proxy 4.28.030418 社区版之前版本存在存储型跨站脚本 产品描述： Artica Tech 提供了一款强大但易于使用的解决方案，这通常是大型和跨国公司的专属。起价仅 99 欧元，拥有超过 62,000 个活跃服务器，Artica Proxy 作为开源项目在过去 10 年中不断发展，帮助中小企业和公共机构以低成本保护其组织和员工免受互联网威胁。 描述： Artica Proxy 4.28.030418 社区版之前版本存在跨站脚本漏洞，涉及输入字段：服务器域名、您的电子邮件地址、组名称、MySQL 服务器、数据库、MySQL...

CVE-2020-15052

CVE-2020-15052 : Artica Proxy before 4.28.030418 Community Edition 允许 SQL 注入 产品描述： Artica Tech 提供了一个功能强大但易于使用的解决方案，这通常是大型和跨国公司的专利。Artica Proxy 起价仅为 99 欧元，拥有超过 62000 台活跃服务器，在过去 10 年中作为开源项目开发，旨在帮助中小企业和公共机构以低成本保护其组织和员工免受互联网威胁。 漏洞描述： Artica Proxy 4.28.030418 Community Edition 之前版本允许通过输入字段...

Exploit for CVE-2026-19089

CVE-2026-19089 — WooCommerce Tyche Product Input Fields S...

WordPress Product Input Fields for WooCommerce plugin < 2.0.2 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Farid Narimanov in WordPress Plugin Product Input Fields for WooCommerce versions 2.0.2...

EUVD-2026-67583

SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-controlled path names. Attackers can manipulate the deletion path to remove methods on the prototype, potentially disabling application...

CVE-2026-19089 Product Input Fields for WooCommerce < 2.0.2 - Unauthenticated Arbitrary File Upload

The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remot...

EUVD-2026-55001

The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remot...

CVE-2026-19089 Product Input Fields for WooCommerce < 2.0.2 - Unauthenticated Arbitrary File Upload

The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remot...

CVE-2026-19089: Unrestricted Upload of File with Dangerous Type

The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remot...

PT-2026-69383

Name of the Vulnerable Software and Affected Versions Product Input Fields for WooCommerce versions prior to 2.0.2 Description An issue exists where the plugin fails to validate uploaded file types when the accepted-types setting is left empty. This configuration, which is advertised in the...

CVE-2026-13425

The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

PT-2026-65787

A Blind SQL injection vulnerability has been identified in Quick.CMS. Improper neutralization of input provided by a high-privileged user into multiple fields in administration panel allows for Blind SQL Injection attacks. The vendor states that this administration panel already allows for...

CVE-2026-66009: Generation of Error Message Containing Sensitive Information

Parse Server versions = 9.0.0 before 9.10.0-alpha.5 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id ...

CVE-2026-7517

The Custom Payment Gateways for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'algwccpginputfields' parameter in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-7517

The CVE-2026-7517 entry concerns the Custom Payment Gateways for WooCommerce WordPress plugin. It is vulnerable to Stored Cross-Site Scripting via the alg_wc_cpg_input_fields parameter in all versions up to 2.1.0 due to insufficient input sanitization and output escaping. Exploitation is possible...

CVE-2026-7517 Custom Payment Gateways for WooCommerce <= 2.1.0 - Unauthenticated Stored Cross-Site Scripting via 'alg_wc_cpg_input_fields' Parameter

The Custom Payment Gateways for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'algwccpginputfields' parameter in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-7517 Custom Payment Gateways for WooCommerce <= 2.1.0 - Unauthenticated Stored Cross-Site Scripting via 'alg_wc_cpg_input_fields' Parameter

The Custom Payment Gateways for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'algwccpginputfields' parameter in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-7517

The Custom Payment Gateways for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'algwccpginputfields' parameter in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...