WordPress MF Gig Calendar <=1.1 - Cross-Site Scripting

WordPress MF Gig Calendar plugin 1.1 and prior contains a reflected cross-site scripting vulnerability. It does not sanitize or escape the id GET parameter before outputting back in the admin dashboard when editing an event. id: CVE-2021-24510 info: name: WordPress MF Gig Calendar =1.2 which...

GamiPress <= 2.8.9 - SQL Injection

GamiPress WordPress plugin version 2.8.9 and below suffers from an SQL injection vulnerability due to insufficient sanitization of user input, allowing attackers to execute arbitrary SQL commands. id: CVE-2024-13496 info: name: GamiPress = 2.8.9 - SQL Injection author: ritikchaddha severity: high...

Gutenverse Plugin <= 3.4.6 - Cross-Site Scripting

The Gutenverse plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to and including 3.4.6. The issue arises due to insufficient input sanitization and output escaping in the rendercontent method of class-search-result-title.php, which outputs...

CVE-2021-37787

CVE-2021-37787: SQL Injection in ABOCMS via TinyMCE Module Vulnerability Details CVE ID : CVE-2021-37787 Product : ABOCMS Affected Versions : 5.8.x, ≤5.9.3 Vulnerability Type : SQL Injection CVSS Score : 9.8 Description A critical SQL injection vulnerability exists in ABOCMS within the TinyMCE...

CVE-2025-28074

CVE-2025-28074 Suggested description phpList prior to 3.6.3 is vulnerable to Cross-Site Scripting XSS due to improper input sanitization in lt.php. The vulnerability is exploitable when the application dynamically references internal paths and processes untrusted input without escaping, allowing ...

PT-2026-121756

The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user email' parameter in all versions up to, and including, 6.89.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-55270

Student Management System 1.0 CVE-2024-55270 Overview The Student Management System SMS is a web application developed using PHP and MySQL for managing student information. This repository contains the source code and details of the system, along with a security vulnerability report. Auditor:...

CVE-2018-7600-Drupalgeddon2-RCE

CVE-2018-7600 Drupalgeddon2 — Red Team Project ITSOLERA Cybersecurity Department | Offensive Security Internship 2026 Overview This project researches, replicates, and documents CVE-2018-7600 Drupalgeddon2 — a Critical CVSS 9.8 unauthenticated Remote Code Execution vulnerability in Drupal CMS,...

CVE-2023-34632

CVE-2023-34632 Reflected XSS in 1000projects Book Management System 1.0 CVE-2023-34632 Reflected Cross-Site Scripting XSS in 1000projects Book Management System 1.0 Description A Reflected Cross-Site Scripting XSS vulnerability was discovered in 1000projects Book Management System version 1.0. Th...

CVE-2024-46878-TikiCMS-XSS

CVE-2024-46878 - Tiki CMS Reflected Cross-Site Scripting XSS Vulnerability Tiki CMS - 'page' Parameter Reflected Cross-Site Scripting XSS Vulnerability Disclaimer Intended only for educational, research, and defensive purposes. Unauthorized use against systems without permission is illegal. Summa...

https-nj.gov---CVE-2019-8331

https-nj.gov---CVE-2019-8331 Vulnearability Report of the New Jersey official site Bootstrap 4.0.0 Found in https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js Vulnerability info: Medium 28236 XSS in data-template, data-content and data-title properties of tooltip/popover...

CVE-2024-46879-TikiCMS-XSS

CVE-2024-46879 - Tiki CMS Reflected Cross-Site Scripting XSS Vulnerability Tiki CMS - 'zipPath' Parameter Reflected Cross-Site Scripting XSS Vulnerability Disclaimer Intended only for educational, research, and defensive purposes. Unauthorized use against systems without permission is illegal...

reproducing-CVE-2025-1489

Reproducing CVE-2025-1489 This repository simulates a reproduction of a web-related CVE CVE-2025-1489 in a safe environment to demonstrate and practice my forensic/vulnerability analysis skills. The vulnerability identified and reproduced is a stored cross-site scripting XSS vulnerability in the...

CVE-2025-9816

CVE-2025-9816 Stored XSS On WP-Statistics Plugin Scanner Detection & PoC "The WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User-Agent Header in all versions up to, and including, 14.5.4 due to...

CVE-2025-55888

CVE-2025-55888 Description Cross-Site Scripting XSS vulnerability was discovered in the Ajax transaction manager endpoint of ARD. An attacker can intercept the Ajax response and inject malicious JavaScript into the accountName field. This input is not properly sanitized or encoded when rendered,...

EUVD-2026-107677

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any...

CVE-2025-68723

CVE-2025-68723: Axigen WebAdmin Stored XSS Vulnerability Summary Multiple input fields within the Axigen WebAdmin interface lack proper sanitization, allowing for the execution of malicious JavaScript. These vulnerabilities enable a low-privileged administrator or an attacker leveraging Broken...

Optimum

Optimum Optimum – Hack The Box Writeup Overview In this machine, the objective is to gain initial access to a Windows host by exploiting a vulnerable web service and then escalate privileges to obtain the administrator flag. The attack path involved: Service enumeration Exploitation of Rejetto HT...

GLPI < 10.0.17 - Pre-Auth SQL Injection

A pre-authentication SQL injection vulnerability exists in the Inventory feature of GLPI. The vulnerability is caused by insufficient sanitization of user input in the handleAgent function when processing XML requests. The issue occurs because SimpleXMLElement objects can bypass the...

Grafana Post-Auth DuckDB - SQL Injection To File Read

The SQL Expressions experimental feature of Grafana allows for the evaluation of duckdb queries containing user input. These queries are insufficiently sanitized before being passed to duckdb, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or highe...