cve-2026-22732-demo

CVE-2026-22732 デモ CVE-2026-22732 の最小再現 — コントローラコードがサーブレットレスポンスに直接書き込む際に、Spring Security の HTTP レスポンスヘッダーが静かに破棄される問題。 脆弱性 Spring Security はデフォルトで「遅延」ヘッダー書き込みを使用します。コントローラが response.getOutputStream に書き込む、response.flushBuffer を呼び出す、または setIntHeader で Content-Length を設定すると、Spring Security...

CVE-2026-1560-Authenticated-Remote-Code-Execution-in-Lazy-Blocks-4.2.0

CVE-2026-1560 – Custom Block Builder – Lazy Blocks ≤ 4.2.0 における認証済みリモートコード実行 研究者 : ZeYrOXxx プラグイン : Custom Block Builder – Lazy Blocks 影響を受けるバージョン : ≤ 4.2.0 深刻度 : 高 CVSS : 8.8 脆弱性タイプ : 認証済みリモートコード実行（RCE） 攻撃ベクトル : REST API 必要な権限 : editposts（Contributor以上） 参考情報 Wordfence アドバイザリ:...

BJ Lazy Load (Timthumb) <= 0.7.5 - Remote File Inclusion

The BJ Lazy Load plugin v0.7.5 for WordPress has a Remote File Inclusion vulnerability via TimThumb. id: CVE-2015-9415 info: name: BJ Lazy Load Timthumb = 0.7.5 - Remote File Inclusion author: s4e-io severity: high description: | The BJ Lazy Load plugin v0.7.5 for WordPress has a Remote File...

CVE-2026-105884

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Media Rocket Lazy Load rocket-lazy-load allows Stored XSS.This issue affects Rocket Lazy Load: from n/a through 2.4.0...

EUVD-2026-94250

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Media Rocket Lazy Load rocket-lazy-load allows Stored XSS.This issue affects Rocket Lazy Load: from n/a through 2.4.0...

CVE-2026-105884

The WP Media Rocket Lazy Load plugin (versions up to and including 2.4.0 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the Improper Neutralization of Input During Web Page Generation , which allows an attacker to inject malicious scripts into the web page. This vu...

CVE-2026-105884 WordPress Rocket Lazy Load plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Media Rocket Lazy Load rocket-lazy-load allows Stored XSS.This issue affects Rocket Lazy Load: from n/a through 2.4.0...

CVE-2026-105884 WordPress Rocket Lazy Load plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Media Rocket Lazy Load rocket-lazy-load allows Stored XSS.This issue affects Rocket Lazy Load: from n/a through 2.4.0...

WordPress Rocket Lazy Load plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin Rocket Lazy Load versions = 2.4.0...

PT-2026-107463

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Media Rocket Lazy Load rocket-lazy-load allows Stored XSS.This issue affects Rocket Lazy Load: from n/a through 2.4.0...

CVE-2026-78471

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...

EUVD-2026-91179

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...

lscript

게으른 스크립트는 제가 생활이 너무 바빠서 한동안 업데이트되지 않았습니다. 시간이 나면 업데이트를 올리도록 최선을 다하겠습니다 LAZY 스크립트 v2.1.4에 오신 것을 환영합니다 Hackersploit가 만든 동영상 : https://www.youtube.com/watch?v=oBpo5sElrMY sstec가 만든 동영상: https://www.youtube.com/watch?v=gSO7c2MN7TY 기능 제안은 "Issues" 탭에 추가하세요. 지금 당장! 이 도구를 어떻게 사용하는지에 대해 저는 책임지지 않습니다. 합법적...

BIT-DISCOURSE-2026-91120 Discourse: Stored HTML injection in video notification emails

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could creat...

PT-2026-105077

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could creat...

PT-2026-98421

Name of the Vulnerable Software and Affected Versions lazy html versions 0.1.0 through 0.1.12 Description An issue exists where improper neutralization of input during web page generation allows mutation Cross-site Scripting XSS. This occurs during a parse and serialize round-trip of...

CVE-2026-91120

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could creat...

CVE-2026-91120 Discourse: Stored HTML injection in video notification emails

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could creat...

CVE-2026-91120 Discourse: Stored HTML injection in video notification emails

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could creat...

CVE-2026-91120

The open-source discussion platform Discourse contains a stored HTML injection vulnerability in its video notification email and chat summary generation. Prior to versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0 , provider-controlled video titles from lazy video embeds (YouTube, Vimeo, or TikT...