CVE-2025-44148

CVE-2025-44148 - Cross-Site Scripting riflesso XSS riflesso Cross-Site Scripting riflesso XSS in MailEnable Fornitore: MailEnable Pty. Ltd. Versioni interessate: 10 Descrizione Esiste una vulnerabilità di cross-site scripting riflesso XSS in MailEnable Webmail dovuta a una scorretta sanitizzazion...

CVE-2025-68723

CVE-2025-68723: Axigen WebAdmin Stored XSS Zusammenfassung der Sicherheitslücke Mehrere Eingabefelder in der Axigen WebAdmin-Oberfläche weisen keine ordnungsgemäße Bereinigung auf, was die Ausführung von schädlichem JavaScript ermöglicht. Diese Sicherheitslücken erlauben es einem Administrator mi...

EITS-Portal-Exploit-CVE-2026-31367-PoC

💥 CVE-2026-31367: EITS Admin Dashboard v2.4.0 - RCE PoC Dieses Repository enthält den Proof of Concept PoC für die nicht authentifizierte Remote-Code-Ausführung RCE im EITS Admin Dashboard v2.4.0 CVE-2026-31367. Die Schwachstelle entsteht durch eine fehlerhafte Eingabebereinigung im Endpunkt...

CVE-2018-7600-Drupalgeddon2-RCE

CVE-2018-7600 Drupalgeddon2 — Progetto Red Team Dipartimento Cybersecurity ITSOLERA | Tirocinio Offensive Security 2026 Panoramica Questo progetto analizza, replica e documenta CVE-2018-7600 Drupalgeddon2 — una vulnerabilità critica CVSS 9.8 di Remote Code Execution non autenticata nel CMS Drupal...

CVE-2026-6176

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the aggregated review form submission in versions up to and including 5.106.0. This is due to insufficient input sanitization and output escaping on user-supplied review comment text. The...

CVE-2026-3423

The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to, and including, 1.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

Optimum

Optimum Optimum – Writeup di Hack The Box Panoramica In questa macchina, l'obiettivo è ottenere un accesso iniziale a un host Windows sfruttando un servizio web vulnerabile e successivamente elevare i privilegi per ottenere la flag dell'amministratore. Il percorso di attacco ha previsto:...

CVE-2025-56772

विवरण वेबसाइट ecodotempo.com.br के विश्लेषण के दौरान, एक स्टोर्ड क्रॉस-साइट स्क्रिप्टिंग XSS भेद्यता पाई गई। यह भेद्यता एक हमलावर को फ़ील्ड में दुर्भावनापूर्ण स्क्रिप्ट इंजेक्ट करने की अनुमति देती है जो बाद में बिना उचित स्वच्छता के अन्य उपयोगकर्ताओं को प्रस्तुत की जाती हैं, विशेष रूप से अप्रमाणि...

CVE-2026-6128

The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wmbackupspath' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on user-supplied attributes combine...

CVE-2026-6176 Customer Reviews for WooCommerce <= 5.106.0 - Unauthenticated Stored Cross-Site Scripting via Aggregated Review Form

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the aggregated review form submission in versions up to and including 5.106.0. This is due to insufficient input sanitization and output escaping on user-supplied review comment text. The...

CVE-2026-6176

The Customer Reviews for WooCommerce WordPress plugin is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 5.106.0 . The root cause is insufficient input sanitization and output escaping: review comment text submitted via the cr_local_forms_submit AJAX acti...

CVE-2026-5934 WP Rocket <= 3.21.0.1 - Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket_beacon Endpoint

The WP Rocket plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.21.0.1. This is due to insufficient input sanitization and output escaping of user-supplied data via the rocketbeacon AJAX endpoint. This makes it possible for unauthenticated...

CVE-2026-5934

CVE-2026-5934 affects the WP Rocket WordPress plugin in versions up to and including 3.21.0.1 . The vulnerability is a Stored Cross-Site Scripting (XSS) caused by insufficient input sanitization and output escaping of user-supplied data via the rocket_beacon AJAX endpoint. Unauthenticated attacke...

EUVD-2026-67708

The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to, and including, 1.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2021-38602

CVE-2021-38602 Una vulnerabilità di cross site scripting persistente è presente nella pagina di modifica degli articoli nella versione 5.8.7 di PluXML. L'input utente non viene adeguatamente sanificato in più campi. Campi vulnerabili: Titolo opzionale: Contenuto: Una volta inserito, l'XSS può...

CVE-2025-57819

CVE-2025-57819 - FreePBX Execução Remota de Código RCE não Autenticada CVE-2025-57819 é uma vulnerabilidade crítica de Execução Remota de Código RCE que afeta Sangoma FreePBX nas versões 15, 16 e 17. A vulnerabilidade decorre de saneamento insuficiente da entrada controlada pelo usuário em...

EUVD-2026-67649

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'giveform' shortcode in all versions up to, and including, 4.14.4. This is due to insufficient input sanitization and output escaping on the continuebuttontitle and...

CVE-2026-6128 All-in-One WP Migration Unlimited Extension <= 2.84 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ai1wm_backups_path' Parameter

The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wmbackupspath' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on user-supplied attributes combine...

CVE-2021-36563

CVE-2021-36563 – Múltiplos XSS Armazenados e Refletidos Aplicação: CheckMK Management Web Console Revisão do Software: De 1.5.0 a 2.0.0p9 Tipo de ataque: XSS Armazenado e Refletido Solução: Atualizar para a Revisão de Software 2.0.0p10 ou posterior Resumo: A console web de gestão do CheckMK versõ...

CVE-2024-46879-TikiCMS-XSS

CVE-2024-46879 - Vulnerabilità di Cross-Site Scripting XSS Riflessa in Tiki CMS Tiki CMS - Vulnerabilità di Cross-Site Scripting XSS Riflessa nel Parametro 'zipPath' Disclaimer Destinato solo a scopi educativi, di ricerca e difensivi. L'uso non autorizzato contro sistemi senza autorizzazione è...