CVE-2026-22101 Sensitive information leak through hidden menu

The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serial numbers, MAC addresses, and WiFi network and password...

CVE-2026-22101 Sensitive information leak through hidden menu

The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serial numbers, MAC addresses, and WiFi network and password...

CVE-2023-43878-RiteCMS-Stored-XSS---MainMenu

Rite CMS v3.0 Múltiples XSS Almacenado Autor: Sergio Descripción: Rite CMS 3.0 está afectado por una vulnerabilidad de Cross-Site Scripting XSS almacenado que permite a los atacantes ejecutar código arbitrario mediante un payload manipulado en Menú Principal - Elementos del Menú de Administración...

CVE-2023-43358-CMSmadesimple-Stored-XSS---News

CMSmadesimple Stored XSS v2.2.18 Autor: Sergio Descripción: Vulnerabilidad de Cross Site Scripting en CMSmadesimple v.2.2.18 que permite a un atacante local ejecutar código arbitrario mediante un script manipulado en el campo Título del menú Contenido - Noticias. Vectores de ataque: Una...

vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries

A flaw in Vim's netrw plugin fails to sanitize special characters in directory paths when creating GUI menu entries. Browsing or bookmarking a maliciously crafted path in GUI Vim allows attackers to execute arbitrary OS commands as the running user...

vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries

A flaw in Vim's netrw plugin fails to sanitize special characters in directory paths when creating GUI menu entries. Browsing or bookmarking a maliciously crafted path in GUI Vim allows attackers to execute arbitrary OS commands as the running user...

CVE-2023-43353-CMSmadesimple-Stored-XSS---News---Extra

CMSmadesimple XSS Almacenado v2.2.18 Autor: Sergio Descripción: La vulnerabilidad de Cross Site Scripting en CMSmadesimple v.2.2.18 permite a un atacante local ejecutar código arbitrario mediante un script manipulado en el campo Extra del menú Content - News. Vectores de ataque: Una vulnerabilida...

CVE-2023-43873-e107-CMS-Stored-XSS---Manage

e107 CMS XSS Almacenado v2.3.2 Autor: Sergio Descripción: Vulnerabilidad de Cross Site Scripting XSS en e017 CMS v.2.3.2 permite a un atacante local ejecutar código arbitrario mediante un script manipulado en el campo Name del Menú de Administración. Vectores de ataque: Scripting Una vulnerabilid...

CVE-2023-43879-RiteCMS-Stored-XSS---GlobalContent

Rite CMS v3.0 Múltiples XSS Almacenados Autor: Sergio Descripción: Rite CMS 3.0 está afectado por una vulnerabilidad de Cross-Site Scripting XSS almacenado que permite a los atacantes ejecutar código arbitrario mediante un payload manipulado en los Global Content Blocks del Administration Menu...

CVE-2023-43345-Quick-CMS-Stored-XSS---Pages-Content

Quick CMS XSS Almacenado v6.7 Autor: Sergio Descripción: Una vulnerabilidad de Cross-Site Scripting XSS en Quick CMS v6.7 permite a un atacante local ejecutar código arbitrario mediante un script manipulado en el campo Content - Name del menú Pages. Vectores de ataque: Scripting: una vulnerabilid...

WordPress Restaurant Menu and Food Ordering plugin <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by 刀 妖 in WordPress Plugin Restaurant Menu by MotoPress versions = 2.4.14...

CVE-2026-96568

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phonenumber' parameter in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-96568 Restaurant Menu and Food Ordering <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting via 'phone_number' Parameter

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phonenumber' parameter in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-96568 Restaurant Menu and Food Ordering <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting via 'phone_number' Parameter

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phonenumber' parameter in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-96568

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.4.14 . The flaw stems from insufficient input sanitization and output escaping specifically involving the 'phone_number' parameter. This allows unaut...

EUVD-2026-86597

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phonenumber' parameter in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries

A flaw in Vim's netrw plugin fails to sanitize special characters in directory paths when creating GUI menu entries. Browsing or bookmarking a maliciously crafted path in GUI Vim allows attackers to execute arbitrary OS commands as the running user...

CVE-2026-79079

A flaw was found in CrossWire Xiphos. A local attacker could exploit this vulnerability by manipulating specific components related to URL handling and menu popups. This could lead to arbitrary code execution on the affected system...

CVE-2026-79315

A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request URI into a client-side template binding expression used for sidebar menu highlighting. Server-side HTML entity escaping is ineffective in this context: the browser decodes the...

EUVD-2026-84465

A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request URI into a client-side template binding expression used for sidebar menu highlighting. Server-side HTML entity escaping is ineffective in this context: the browser decodes the...