73140 matches found
CVE-2026-104646
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject...
CVE-2026-104646
The Image Photo Gallery Final Tiles Grid WordPress plugin, versions prior to 3.6.14 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the insufficient sanitization of gallery configuration values that can be overridden via the plugin's gallery shortcode . These values...
CVE-2026-104646 Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Stored XSS via Gallery Shortcode Attributes
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject...
external_v8_AOSP10_r33_CVE-2021-0393
V8 JavaScriptエンジン V8はGoogleのオープンソースJavaScriptエンジンです。 V8はECMA-262で規定されたECMAScriptを実装しています。 V8はC++で書かれており、GoogleのオープンソースブラウザであるGoogle Chromeで使用されています。 V8はスタンドアロンで実行することも、任意のC++アプリケーションに組み込むこともできます。 V8 Project page: https://github.com/v8/v8/wiki コードの入手 depot tools をチェックアウトし、次のコマンドを実行します。 fetch v8...
CVE-2025-50866
CloudClassroom-PHP-Project 1.0 には、postquerypublic エンドポイントの email パラメータに反映型クロスサイトスクリプティング XSS の脆弱性があります。不適切なサニタイズにより、攻撃者は任意の JavaScript コードを注入でき、ユーザーのブラウザのコンテキストで実行され、セッションハイジャックやフィッシング攻撃につながる可能性があります。 脆弱性の種類 : クロスサイトスクリプティング XSS ベンダー製品 : https://github.com/mathurvishal/CloudClassroom-PHP-Project...
NestJS DevTools Integration - Remote Code Execution
Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution RCE vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API...
Mongo-Express - Remote Code Execution
Mongo-Express before 1.0.0 is susceptible to remote code execution because it uses safer-eval to validate user supplied javascript. Unfortunately safer-eval sandboxing capabilities are easily bypassed leading to remote code execution in the context of the node server. id: CVE-2020-24391 info: nam...
Jenkins build-metrics 1.3 - Cross-Site Scripting
Jenkins build-metrics 1.3 is vulnerable to a reflected cross-site scripting vulnerability that allows attackers to inject arbitrary HTML and JavaScript into the web pages the plugin provides. id: CVE-2019-10475 info: name: Jenkins build-metrics 1.3 - Cross-Site Scripting author: madrobot severity...
Adobe ColdFusion - Cross-Site Scripting
Adobe Coldfusion versions 2016 update 16 and earlier, 2018 update 10 and earlier and 2021.0.0.323925 are affected by an Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability. An attacker could abuse this vulnerability to execute arbitrary JavaScript code...
Grafana 8.0.0 <= v.8.2.2 - Angularjs Rendering Cross-Site Scripting
Grafana is an open-source platform for monitoring and observability. In affected versions if an attacker is able to convince a victim to visit a URL referencing a vulnerable page, arbitrary JavaScript content may be executed within the context of the victim's browser. The user visiting the...
Atlassian Jira WallboardServlet <7.13.1 - Cross-Site Scripting
The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross-site scripting vulnerability in the cyclePeriod parameter. id: CVE-2018-20824 info: name: Atlassian Jira WallboardServlet 7.13.1 - Cross-Site Scripting author:...
Lodash Template - Server-Side Template Injection (RCE)
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. id: CVE-2021-23337 info: name: Lodash Template - Server-Side Template Injection RCE author: DhiyaneshDk severity: high description: | Lodash versions prior to 4.17.21 are vulnerable to Command Injectio...
Adobe Coldfusion - Cross-Site Scripting
Adobe ColdFusion versions 2023.5 and earlier and 2021.11 and earlier are affected by a reflected Cross-Site Scripting XSS vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within th...
CLEANSTART-2026-EF09079 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
CVE-2026-101912 affects multiple packages. ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. See references for individual vulnerability details...
PT-2026-107831
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject...
PT-2026-108001
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended...
PT-2026-108319
Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A flaw exists where the context tracking state is not properly reset when a JavaScript template literal contains consecutive expressions. This failure to reset...
CVE-2024-42009
CVE-2024-42009 – Roundcube 保存型XSS Docker PoC 📌 概要 このリポジトリは、Roundcube Webmail の CVE-2024-42009 （保存型クロスサイトスクリプティング（XSS）の脆弱性）に対する実証コード（PoC）を示しています。 この脆弱性は、不適切なHTMLサニタイズとその後の安全でない属性の再処理に起因し、攻撃者が細工したHTMLメールを介して悪意のあるイベントハンドラを注入することを可能にします。 ⚠️ 影響を受けるバージョン Roundcube ≤ 1.5.7 Roundcube ≤ 1.6.7 🧠 脆弱性の概要...
CVE-2026-82090-18-Years-All-Versions-CVSS-9.2-CRITICAL-The-Pocket-Forever-Day
XSS 0-Click / 0-Day Vulnerability Report Cross-Site Scripting 0-Click Leading to JavaScript Bridge Abuse in Pocket Android & iOS — CVSS 9.2 CRITICAL CVE-2026-82090 — Published by MITRE Corporation 2026-08-28 Author: Ing. Zampier Zago FUNFACTOR1 Division: Section 1 — Department of Cyber Security, ...