EUVD-2026-118396

Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated user can store a crafted waypoint.icon value that createMarkerFromWaypoint passes into FontawesomeMarker, where insertAdjacentHTML inserts the unvalidated value into map marker markup...

CVE-2026-62345

The Wanderer self-hosted trail database is vulnerable to Stored XSS in versions prior to 0.19.3 . An authenticated user can provide a crafted waypoint.icon value which is then passed into createMarkerFromWaypoint() and subsequently injected into the map marker markup via insertAdjacentHTML withou...

CVE-2026-115452

Joomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9, 2.0.0-2.1.6 - A user who could edit a Map marker label, like an article author, could add a script that ran for anyone who opened the marker...

EUVD-2026-117625

Joomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9, 2.0.0-2.1.6 - A user who could edit a Map marker label, like an article author, could add a script that ran for anyone who opened the marker...

CVE-2026-115452

The Joomla Extension - tassos.gr is vulnerable to a privileged stored XSS flaw in Advanced Custom Fields (versions 2.8.2-2.8.15, 3.0.0-3.1.8) and Smile Pack (versions 1.1.2-1.2.9, 2.0.0-2.1.6). The root cause allows a privileged user, such as an article author with permissions to edit a Map marke...

CVE-2026-115452 Joomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9, 2.0.0-2.1.6

Joomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9, 2.0.0-2.1.6 - A user who could edit a Map marker label, like an article author, could add a script that ran for anyone who opened the marker...

CVE-2026-16988

The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public pending or draft listings...

EUVD-2026-54890

The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public pending or draft listings...

CVE-2026-16988: Exposure of Sensitive Information to an Unauthorized Actor

The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public pending or draft listings...

CVE-2024-13021

A vulnerability, which was classified as problematic, has been found in SourceCodester Road Accident Map Marker 1.0. Affected by this issue is some unknown functionality of the file /endpoint/add-mark.php. The manipulation of the argument markname/details leads to cross site scripting. The attack...

CVE-2024-13021

A vulnerability, which was classified as problematic, has been found in SourceCodester Road Accident Map Marker 1.0. Affected by this issue is some unknown functionality of the file /endpoint/add-mark.php. The manipulation of the argument markname/details leads to cross site scripting. The attack...

SourceCodester Road Accident Map Marker: Code Injection Vulnerability

SourceCodester Road Accident Map Marker is a SourceCodester open source road accident map marker project. A code injection vulnerability exists in SourceCodester Road Accident Map Marker version 1.0, which stems from a cross-site scripting attack due to incorrect manipulation of the markname...

CVE-2024-13021: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, has been found in SourceCodester Road Accident Map Marker 1.0. Affected by this issue is some unknown functionality of the file /endpoint/add-mark.php. The manipulation of the argument markname/details leads to cross site scripting. The attack...