CVE-2026-1434

CVE-2026-1434: Omega-PSIR is vulnerable to Reflected XSS via the lang parameter. An attacker can craft a... Overview Field| Details ---|--- CVE ID| CVE-2026-1434 Severity| MEDIUM Advisory| N/A Discovered by| Lukasz Rybak Affected Products See advisory for details. CWE Classification CWE-79:...

CVE-2026-124424

WWBN AVideo contains a path traversal vulnerability in plugin/AI/receiveAsync.json.php that allows holders of any valid AI token to write arbitrary .vtt files by injecting traversal sequences into the unsanitized responselang parameter. Attackers can send a type=translation request with a crafted...

CVE-2026-124424

WWBN AVideo is vulnerable to a path traversal flaw within the plugin/AI/receiveAsync.json.php component. This vulnerability allows users possessing a valid AI token to write arbitrary .vtt files by injecting traversal sequences into the unsanitized response[lang] parameter. An attacker can trigge...

EUVD-2026-119576

WWBN AVideo contains a path traversal vulnerability in plugin/AI/receiveAsync.json.php that allows holders of any valid AI token to write arbitrary .vtt files by injecting traversal sequences into the unsanitized responselang parameter. Attackers can send a type=translation request with a crafted...

CVE-2026-124424 WWBN AVideo Path Traversal Arbitrary VTT File Write via receiveAsync.json.php

WWBN AVideo contains a path traversal vulnerability in plugin/AI/receiveAsync.json.php that allows holders of any valid AI token to write arbitrary .vtt files by injecting traversal sequences into the unsanitized responselang parameter. Attackers can send a type=translation request with a crafted...

CVE-2026-124424 WWBN AVideo Path Traversal Arbitrary VTT File Write via receiveAsync.json.php

WWBN AVideo contains a path traversal vulnerability in plugin/AI/receiveAsync.json.php that allows holders of any valid AI token to write arbitrary .vtt files by injecting traversal sequences into the unsanitized responselang parameter. Attackers can send a type=translation request with a crafted...

CVE-2026-124424 WWBN AVideo Path Traversal Arbitrary VTT File Write via receiveAsync.json.php

WWBN AVideo contains a path traversal vulnerability in plugin/AI/receiveAsync.json.php that allows holders of any valid AI token to write arbitrary .vtt files by injecting traversal sequences into the unsanitized responselang parameter. Attackers can send a type=translation request with a crafted...

PT-2026-139940

WWBN AVideo contains a path traversal vulnerability in plugin/AI/receiveAsync.json.php that allows holders of any valid AI token to write arbitrary .vtt files by injecting traversal sequences into the unsanitized responselang parameter. Attackers can send a type=translation request with a crafted...

CVE-2026-124424: WWBN AVideo: WWBN AVideo contains a path traversal vulnerability in plugin/AI/receiveAsync.json.php that allows holders of any valid…

WWBN AVideo contains a path traversal vulnerability in plugin/AI/receiveAsync.json.php that allows holders of any valid AI token to write arbitrary .vtt files by injecting traversal sequences into the unsanitized responselang parameter. Attackers can send a type=translation request with a crafted...

CVE-2026-84925

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to, and including, 7.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-84925 Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to, and including, 7.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

EUVD-2026-91174

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to, and including, 7.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-84925

The Avada | Website Builder For WordPress & WooCommerce theme is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 7.16.1 . The root cause is insufficient input sanitization and output escaping of the 'lang' parameter . Specifically, the injected value is prop...

PT-2026-104080

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to, and including, 7.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

Avada | Website Builder For WordPress & WooCommerce < 7.16.2 - Reflected Cross-Site Scripting via 'lang' Parameter

Description The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to, and including, 7.16.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-78187 Piwigo Public Authentication cross site scripting

A vulnerability has been found in Piwigo 16.3.0. This impacts an unknown function of the component Public Authentication Page. Such manipulation of the argument lang leads to cross site scripting. The attack may be performed from remote. A high complexity level is associated with this attack. The...

CVE-2026-78187

CVE-2026-78187 is a reflected cross-site scripting (XSS) vulnerability in Piwigo 16.3.0 , affecting the Public Authentication Page component. Manipulation of the lang argument allows a remote, unauthenticated attacker to inject script that executes in a victim's browser upon user interaction. The...

CVE-2026-78187 Piwigo Public Authentication cross site scripting

A vulnerability has been found in Piwigo 16.3.0. This impacts an unknown function of the component Public Authentication Page. Such manipulation of the argument lang leads to cross site scripting. The attack may be performed from remote. A high complexity level is associated with this attack. The...

CVE-2026-78187 Piwigo Public Authentication cross site scripting

A vulnerability has been found in Piwigo 16.3.0. This impacts an unknown function of the component Public Authentication Page. Such manipulation of the argument lang leads to cross site scripting. The attack may be performed from remote. A high complexity level is associated with this attack. The...

PT-2026-79823

A vulnerability has been found in Piwigo 16.3.0. This impacts an unknown function of the component Public Authentication Page. Such manipulation of the argument lang leads to cross site scripting. The attack may be performed from remote. A high complexity level is associated with this attack. The...