CVE-2023-29808

익스플로잇 제목: 반사형 XSS Reflected Cross Site Scripting Google Dork: 날짜: 27.04.2023 익스플로잇 작성자: Lucas Noki 0xPrototype 공급업체 홈페이지: https://github.com/vogtmh 소프트웨어 링크: https://github.com/vogtmh/cmaps 버전: 8.0 테스트 환경: Mac, Windows, Linux CVE : CVE-2023-29808 설명: 발견된 취약점은 반사형 XSSReflected Cross Site...

CVE-2025-57298

Kotaemon의 안전하지 않은 Markdown 렌더링을 통한 저장형 XSS 요약 Kotaemon은 PDF, Word, Excel 파일과 같은 업로드된 문서를 질의할 수 있는 웹 인터페이스를 제공하는 오픈소스 RAGRetrieval-Augmented Generation 기반 문서 QA 시스템입니다. Kotaemon의 문서 렌더링 파이프라인에는 저장형 교차 사이트 스크립팅XSS 취약점이 존재합니다. 사용자 제어 콘텐츠는 LLM에 의해 처리되고, 적절한 살균 없이 markdown-to-HTML 변환 후 웹 인터페이스에서 렌더링되므...

CVE-2026-57440

The EmbedVideo Extension is a MediaWiki extension which adds a parser function called ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with $wgEmbedVideoRequireConsent disabled not the default, the urls for videos are passed into an iframe...

CVE-2026-85129 Hoo Companion 1.0.2 - Unauthenticated Stored XSS via Theme Settings Import

The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated attackers to inject arbitrary web scripts which wi...

CVE-2026-81429 Export & Import WPBakery Page Builder <= 1.0.2 - Stored XSS via CSRF

The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 does not perform any CSRF check on its template-import feature and does not sanitise the imported data before storing it and echoing it back, allowing attackers to make a logged-in administrator import a crafted template via...

PT-2026-89268

Name of the Vulnerable Software and Affected Versions Easy Google Fonts versions prior to 2.0.5 Description Stored Cross-Site Scripting occurs because the plugin registers the control selectors meta field with show in rest enabled but lacks a sanitize callback. Consequently, unsanitized data is...

CVE-2026-78545

The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The unsanitized value is interpolated into an nginx server block directive, resulting in execution of injected directives...

CVE-2026-86712

SiYuan before 3.8.2 is an Electron-based note-taking application vulnerable to Remote Code Execution via its clipboard paste handler. The root cause is that SiYuan trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler (app/src/protyle/util/paste....

PT-2026-88176

Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or...

EUVD-2026-71856

The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

EUVD-2026-69858

The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape content submitted by unauthenticated visitors before storing it and outputting it in an admin area page, and the escaping it does apply is undone by a subsequent decoding step, leading to Stored XSS which will execute i...

CVE-2026-84189 LibreNMS before 26.7.0 Stored XSS via Oxidized API

LibreNMS through 26.4.0 renders JSON fields name, ip, model, author, commit message returned by the admin-configurable Oxidized integration URL oxidized.url into the device showconfig page without applying htmlspecialchars. An administrator who points the Oxidized URL at an attacker-controlled...

CVE-2026-81524

A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have...

Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver

A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have...

EUVD-2026-66804

yx-image-recognition v1.0 is vulnerable to Path Traversal. Parameters such as dir, filePath are directly passed to new File for file system operations without any path sanitization or whitelist validation...

GHSA-W2X5-GV52-9CCV Sakai Conversations has a Stored XSS Issue

Summary The Sakai Conversations tool stores topic and post messages without HTML sanitization, and the frontend renders them using LitElement's unsafeHTML directive, resulting in stored cross-site scripting XSS. Any authenticated user with access to a site that has the Conversations tool enabled...

PT-2026-81116

Name of the Vulnerable Software and Affected Versions Sakai versions 23.0 through 23.4 Sakai versions 25.0 through 25.2 Description The Sakai Conversations tool allows authenticated users to inject arbitrary HTML and JavaScript into topic and post messages. This occurs because the service layer...

CVE-2026-65611

nnn does not sanitize the path variable. An attacker can create a directory on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim enters that directory in nnn and uses the batch copy or move workflow, the...

PT-2026-78482

Name of the Vulnerable Software and Affected Versions Grav API Plugin versions prior to 1.0.2 Description The plugin fails to invoke the Security::sanitizeSVG function within the HandlesMediaUploads::processUploadedFile function when processing the 'POST /api/v1/media' endpoint. While the SVG...

GHSA-M283-3H24-438V VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE

Affected: vm2 = 3.11.3 CVSS 3.1: 9.9 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CWE: CWE-693 Protection Mechanism Failure Prerequisite: Embedder exposes a host function that throws an Error with .cause referencing a powerful host object e.g., process Summary I found that handleException in...