promptmap

O O o.-. Humans, Do Not Resist! |/ ,-'-. / /, / /|.-.| / --O-- .--""" /\ /\ | o.o / Utku Sen's /|\ -'--' / /| | - | / | | | \ /| | | ' \ '/ \ ' | ' \ | ' / | ' \ | / | | | ./| /||| ./|||,| .// / / |-----| || || || || promptmap2 is a an automated prompt injection scanner for custom LLM...

Rank Math SEO < 1.0.229 - Unauthenticated User and Term Metadata Insert/Update/Deletion

Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress contains a missing capability check on 'updatemetadata' in all versions up to 1.0.228, letting unauthenticated attackers insert, update, or delete metadata, including user and term metadata, potentially causing loss of...

Rank Math SEO <= 1.0.40.2 - Redirect Creation via Unprotected REST API Endpoint

The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs that redirect to an external web site via the unsecured rankmath/v1/updateRedirection REST API endpoint. In other words, this is not an "Open Redirect" issue; instead, it allows the...

Contact Form 7 Math Captcha <= 2.0.1 - Cross-site Scripting

The Contact Form 7 Math Captcha WordPress plugin through 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users. id: CVE-2024-6517 info: name: Contact Form 7 Math Captcha =...

CVE-2024-24136

CVE-2024-24136 : Math Game Cross-Site-Scripting Proof of ConceptPoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-24136.md Proof of ConceptPoC : https://github.com/BurakSevben/CVE-2024-24136/blob/main/CVE-2024-24136.md...

CVE-2026-116169

SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerability that allows users with edit permission to inject script by placing javascript: URLs in math block content rendered with KaTeX trust enabled. Attackers can store \href, \url, or \includegraphics payloads that...

CVE-2026-116169

The SiYuan note-taking application (versions 2.10.0 before 3.8.7 ) is vulnerable to a stored cross-site scripting (XSS) flaw. The issue occurs when KaTeX trust is enabled, allowing users with edit permissions to inject javascript: URLs into math block content. Specifically, the mathRender functio...

EUVD-2026-109430

SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerability that allows users with edit permission to inject script by placing javascript: URLs in math block content rendered with KaTeX trust enabled. Attackers can store \href, \url, or \includegraphics payloads that...

CVE-2026-116169 SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks

SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerability that allows users with edit permission to inject script by placing javascript: URLs in math block content rendered with KaTeX trust enabled. Attackers can store \href, \url, or \includegraphics payloads that...

EUVD-2026-102241

ammonia: mXSS via MathML annotation-xml encoding strip...

CVE-2026-111862

Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected plugin files contained malware that could compromise a...

EUVD-2026-104460

Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected plugin files contained malware that could compromise a...

CVE-2026-111862

A supply-chain compromise affected Rank Math SEO PRO version 3.0.123 , specifically for packages downloaded or updated between October 15, 2026, and October 16, 2026. The embedded malware can establish persistent access, communicate with rank1cdn[.]com , recreate hidden backdoors, and expose sens...

CVE-2026-111862 Rank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious Code

Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected plugin files contained malware that could compromise a...

Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor

Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware, Rank Math said in a security notice published on October 16. Any site...

CVE-2026-111862: Embedded Malicious Code

Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected plugin files contained malware that could compromise a...

WordPress Rank Math SEO PRO plugin 3.0.123 - Unauthenticated Embedded Malicious Code vulnerability

Unauthenticated Embedded Malicious Code vulnerability discovered by ? in WordPress Plugin Rank Math SEO PRO versions 3.0.123...

PSA: Malware Found in Some Rank Math SEO PRO 3.0.123 Downloads

Rank Math has disclosed that some copies of Rank Math SEO PRO version 3.0.123 contained malware. According to Rank Math, the affected version was downloaded or installed through an update between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. If an affected copy of Rank Math SEO...

SUSE CVE-2026-63430

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.2, 4.0.2, and 4.1.3, applications that explicitly allow the math tag, annotation-xml, and at least one raw-text HTML element while disallowing the encoding attribute can permit mutation cross-site scripting. ammonia...

PT-2026-116378

Name of the Vulnerable Software and Affected Versions Rank Math SEO PRO version 3.0.123 Description A supply-chain compromise occurred where a subset of packages distributed between October 15, 2026, and October 16, 2026, contained embedded malware. This issue has been actively exploited in the...