CVE-2026-119156

The Download Manager plugin for WordPress (versions

EUVD-2026-119213

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdmregfirstname, wpdmreglastname, wpdmreguserlogin' parameter in all versions up to, and including, 7.5.9 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-119156 Download Manager <= 7.5.9 - Unauthenticated Stored Cross-Site Scripting via Registration Form (WP_Error-as-ID) via Spotlight Template [author_name]

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdmregfirstname, wpdmreglastname, wpdmreguserlogin' parameter in all versions up to, and including, 7.5.9 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-116385

A security vulnerability has been detected in Bdtask Garage 24 Garage Management Software 1.0. This issue affects some unknown processing of the file /editprofile of the component Profile. The manipulation of the argument firstname/lastname leads to cross site scripting. The attack may be initiat...

CVE-2026-116385

A cross-site scripting (XSS) vulnerability exists in Bdtask Garage 24 Garage Management Software version 1.0 . The flaw is located within the Profile component, specifically affecting the processing of the /edit_profile file. By manipulating the first_name and last_name arguments, an attacker can...

CVE-2026-116385 Bdtask Garage 24 Garage Management Software Profile edit_profile cross site scripting

A security vulnerability has been detected in Bdtask Garage 24 Garage Management Software 1.0. This issue affects some unknown processing of the file /editprofile of the component Profile. The manipulation of the argument firstname/lastname leads to cross site scripting. The attack may be initiat...

EUVD-2026-110034

A security vulnerability has been detected in Bdtask Garage 24 Garage Management Software 1.0. This issue affects some unknown processing of the file /editprofile of the component Profile. The manipulation of the argument firstname/lastname leads to cross site scripting. The attack may be initiat...

CVE-2026-116385 Bdtask Garage 24 Garage Management Software Profile edit_profile cross site scripting

A security vulnerability has been detected in Bdtask Garage 24 Garage Management Software 1.0. This issue affects some unknown processing of the file /editprofile of the component Profile. The manipulation of the argument firstname/lastname leads to cross site scripting. The attack may be initiat...

Bdtask Garage 24 Garage Management Software Cross-site Scripting Vulnerability

Version 1.0 of Bdtask Garage 24 Garage Management Software contains a security vulnerability. This vulnerability stems from improper handling of the firstname and lastname parameters in the /editprofile endpoint, potentially enabling cross-site scripting attacks...

CSV Injection

Overview Affected versions of this package are vulnerable to CSV Injection via the member export process. An attacker can cause the execution of arbitrary spreadsheet formulas by injecting malicious input into the firstname or lastname fields, which may lead to data exfiltration or code execution...

CVE-2026-86257

wger before 2.6 fails to sanitize firstname and lastname fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or...

CVE-2026-82625

A vulnerability has been found in code-projects Simple Inventory System 1.0. This affects an unknown part of the file /register.php of the component User Registration. Such manipulation of the argument lastname leads to cross site scripting. The attack may be launched remotely. The exploit has be...

CVE-2026-82625 code-projects Simple Inventory System User Registration register.php cross site scripting

A vulnerability has been found in code-projects Simple Inventory System 1.0. This affects an unknown part of the file /register.php of the component User Registration. Such manipulation of the argument lastname leads to cross site scripting. The attack may be launched remotely. The exploit has be...

CVE-2026-82625

code-projects Simple Inventory System 1.0 contains a stored cross-site scripting (XSS) vulnerability in the /register.php file, specifically in the User Registration component. An attacker can manipulate the last_name argument to inject malicious scripts, with the attack launchable remotely and r...

EUVD-2026-68375

A vulnerability has been found in code-projects Simple Inventory System 1.0. This affects an unknown part of the file /register.php of the component User Registration. Such manipulation of the argument lastname leads to cross site scripting. The attack may be launched remotely. The exploit has be...

CVE-2026-82625 code-projects Simple Inventory System User Registration register.php cross site scripting

A vulnerability has been found in code-projects Simple Inventory System 1.0. This affects an unknown part of the file /register.php of the component User Registration. Such manipulation of the argument lastname leads to cross site scripting. The attack may be launched remotely. The exploit has be...

CVE-2026-82625: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in code-projects Simple Inventory System 1.0. This affects an unknown part of the file /register.php of the component User Registration. Such manipulation of the argument lastname leads to cross site scripting. The attack may be launched remotely. The exploit has be...

CVE-2026-75082

A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument firstname/lastname causes basic cross site scripting. It is possible to...

CVE-2026-75082

A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument firstname/lastname causes basic cross site scripting. It is possible to...

CVE-2026-75082: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument firstname/lastname causes basic cross site scripting. It is possible to...