EmailXpose

EmailXpose Specification AI-Powered Email Clarity HTML Mirror: https://roxanneardary.com/emailxpose-specification/ Specification Overview EmailXpose is an open source, modular AI email security and intelligence system designed to analyze email content, sender identity, links, attachments, images,...

anamorpher

Anamorpher Anamorpher named after anamorphosis is a tool for crafting and visualizing image scaling attacks against multi-modal AI systems. It provides a frontend interface and Python API for generating images that only reveal multi-modal prompt injections when downscaled. Refer to "Weaponizing...

Feedback Modal for Website <= 1.0.1 - Unauthenticated Feedback Export

The Feedback Modal for Website plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handleexport' function in all versions up to, and including, 1.0.1. This makes it possible for unauthenticated attackers to export all feedback data in CSV or...

CVE-2026-120687

The Lightbox & Modal Popup WordPress Plugin (FooBox) is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) in versions up to and including 2.8.7 . The flaw stems from insufficient input sanitization and output escaping of the img alt attribute within .wp-caption containers . This allows un...

CVE-2023-29439

CVE-2023-29439 This repository is about XSS vulnerability in Wordpress Foogallery Plugin. Vulenerability details Description In Foogallery 2.2.35 and earlier, the function foogalleryimageeditormodal in foogallery/includes/admin/class-gallery-attachment-modal.php is vulnerable to XSS attack...

stego_provenance_defense

Decode-Time Provenance Binding for MCP Agents A reproducible proof-of-concept for a steganographic prompt-injection vector that defeats text content scanners, and a defense that contains it at the decode boundary — decode-time provenance binding. Educational / defensive security research only. Al...

CVE-2026-126744

This module renders Layout Builder forms inside an iframe in a modal dialog, using the admin theme. The module provides its own Ajax command to open the iframe dialog. This command does not sanitize the dialog options the same way Drupal core does since "SA-CORE-2026-001"...

DRUPAL-CONTRIB-2026-335

This module renders Layout Builder forms inside an iframe in a modal dialog, using the admin theme. The module provides its own Ajax command to open the iframe dialog. This command does not sanitize the dialog options the same way Drupal core does since SA-CORE-2026-001, which can lead to a...

PT-2026-145659

This module renders Layout Builder forms inside an iframe in a modal dialog, using the admin theme. The module provides its own Ajax command to open the iframe dialog. This command does not sanitize the dialog options the same way Drupal core does since SA-CORE-2026-001, which can lead to a...

vLLM deserialization injection vulnerability

Versions of vLLM prior to 0.32.0 contain a deserialization injection vulnerability. This vulnerability arises because authenticated callers can place forged shared memory addresses and monotonicid values within the public multi-modal features.kwargsdata. In deployments where shared memory-based...

CVE-2017-20289

Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can supply directory traversal sequences in...

EUVD-2017-19026

Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can supply directory traversal sequences in...

CVE-2017-20289

The Broadstreet Ad Widget plugin for WordPress (versions 2.2.0 before 2.12.0 ) contains a local file inclusion vulnerability. The root cause is the passing of unsanitized input to a require statement in views/modal/index.php. Authenticated users can execute attacker-chosen PHP files by supplying ...

CVE-2017-20289 Broadstreet Ad Widget WordPress Plugin < 2.12.0 Local File Inclusion via step parameter

Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can supply directory traversal sequences in...

CVE-2017-20289 Broadstreet Ad Widget WordPress Plugin < 2.12.0 Local File Inclusion via step parameter

Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can supply directory traversal sequences in...

CVE-2026-84919

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 5.0.9...

CVE-2026-84919 PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-131

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 5.0.9...

EUVD-2026-107868

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 5.0.9...

CVE-2026-84919

The Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery module (versions 0.0.0 to 5.0.9 ) is vulnerable to Stored Cross-site Scripting (XSS) . The root cause is the insufficient sanitization of user-supplied input, specifically image alt tags , within the module's dynamic caption script...

CVE-2026-84919 PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-131

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 5.0.9...