CVE-2026-93899 Better Messages <= 3.0.4 - Authenticated (Subscriber+) SQL Injection via 'group_id' Message Meta Parameter

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to generic SQL Injection via 'groupid' Message Meta Parameter in all versions up to, and including, 3.0.4 due to insufficient escaping on the user supplied parameter and lack of...

IceWarp Server 10.2.1 - Cross-Site Scripting Detection

IceWarp Server 10.2.1 is vulnerable to Cross Site Scripting XSS via the meta parameter. !/usr/bin/env python3 -- coding: utf-8 -- """IceWarp Server 10.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'IceWarp Server...

CVE-2026-58000 luci-proto-openvpn - Command Injection via cl_meta Parameter in generateKey

luci-proto-openvpn through 0.11.1, fixed in commit e4ff45e, contains a command injection vulnerability in the generateKey ubus method where the clmeta parameter is interpolated into a shell command without proper escaping or quoting. An authenticated LuCI user with OpenVPN protocol configuration...

EUVD-2025-26072

Malicious code in bioql PyPI...

EUVD-2024-52754

Malicious code in bioql PyPI...

CVE-2024-55218

IceWarp Server 10.2.1 is vulnerable to Cross Site Scripting XSS via the meta parameter...

CVE-2010-3742

Multiple PHP remote file inclusion vulnerabilities in themes/default/index.php in Free Simple CMS 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the 1 meta or 2 phpincdir parameter, a different issue than CVE-2010-3307...

CVE-2024-55218

IceWarp Server 10.2.1 is vulnerable to Cross Site Scripting XSS via the meta parameter...

CVE-2024-55218

IceWarp Server 10.2.1 is vulnerable to Cross Site Scripting XSS via the meta parameter...

PT-2025-3101

Name of the Vulnerable Software and Affected Versions IceWarp Server version 10.2.1 Description The issue is related to Cross Site Scripting XSS and can be exploited via the meta parameter. This allows for malicious scripts to be injected into websites, potentially leading to unauthorized access ...

CVE-2024-55218: Improper Neutralization of Input During Web Page Generation

IceWarp Server 10.2.1 is vulnerable to Cross Site Scripting XSS via the meta parameter...

WordPress Plugin Custom Field Suite Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

Code injection

Symphony 2 2.6.11 has XSS in the metanavigationgroup parameter to content/content.blueprintssections.php...

CVE-2017-8876

Symphony 2 2.6.11 has XSS in the metanavigationgroup parameter to content/content.blueprintssections.php...

CVE-2017-8876

CVE-2017-8876 affects Symphony CMS v2.6.11, where an XSS flaw exists in the user-controlled input of the meta[navigation_group] parameter handled by content/content.blueprintssections.php. The vulnerability enables injection of script/HTML in affected pages, consistent with cross-site scripting d...

CVE-2017-8876

Symphony 2 2.6.11 has XSS in the metanavigationgroup parameter to content/content.blueprintssections.php...

PT-2010-5036

Name of the Vulnerable Software and Affected Versions Free Simple CMS version 1.0 Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the meta or phpincdir parameter in the themes/default/index.php file. Recommendations For Free Simple CMS version 1.0, conside...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in index.php in TomatoCMS before 2.0.5 allow remote authenticated users, with certain creation privileges, to inject arbitrary web script or HTML via the 1 content parameter in conjunction with a /admin/poll/add PATHINFO, the 2 meta parameter in...

CVE-2010-1996

Multiple cross-site scripting XSS vulnerabilities in index.php in TomatoCMS before 2.0.5 allow remote authenticated users, with certain creation privileges, to inject arbitrary web script or HTML via the 1 content parameter in conjunction with a /admin/poll/add PATHINFO, the 2 meta parameter in...

CVE-2010-1996: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in index.php in TomatoCMS before 2.0.5 allow remote authenticated users, with certain creation privileges, to inject arbitrary web script or HTML via the 1 content parameter in conjunction with a /admin/poll/add PATHINFO, the 2 meta parameter in...