562 matches found
CVE-2026-129156
DjangoBlog commit d186b1c through commit 6134ed6 contains a stored cross-site scripting vulnerability that allows authenticated OAuth users to inject script via an unescaped nickname in comment reactions. Attackers can set their OAuth display name to a payload closing the single-quoted...
CVE-2025-51403
Exploit Title: LiveHelperChat 4. Save the changes. 5. Revist the Department Assignment settings page and edit the Alias Nick field, the...
EUVD-2026-125610
DjangoBlog commit d186b1c through commit 6134ed6 contains a stored cross-site scripting vulnerability that allows authenticated OAuth users to inject script via an unescaped nickname in comment reactions. Attackers can set their OAuth display name to a payload closing the single-quoted...
CVE-2026-129156 DjangoBlog commit d186b1c through 6134ed6 Stored XSS via Comment Reactions
DjangoBlog commit d186b1c through commit 6134ed6 contains a stored cross-site scripting vulnerability that allows authenticated OAuth users to inject script via an unescaped nickname in comment reactions. Attackers can set their OAuth display name to a payload closing the single-quoted...
CVE-2026-129156 DjangoBlog commit d186b1c through 6134ed6 Stored XSS via Comment Reactions
DjangoBlog commit d186b1c through commit 6134ed6 contains a stored cross-site scripting vulnerability that allows authenticated OAuth users to inject script via an unescaped nickname in comment reactions. Attackers can set their OAuth display name to a payload closing the single-quoted...
CVE-2026-129156
The DjangoBlog application (commits d186b1c through 6134ed6 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw within the comment reactions feature. The root cause is an unescaped nickname used by authenticated OAuth users. An attacker can set their OAuth display name to a malicious payl...
CVE-2026-119165
The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname / nickname' parameter in all versions up to, and including, 9.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-119165
The WPBakery Page Builder plugin for WordPress (versions up to and including 9.0.1 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is insufficient input sanitization and output escaping of the 'display_name / nickname' parameter. An authenticated attacker with Subscrib...
CVE-2026-119165 WPBakery Page Builder <= 9.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Post Author Display Name
The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname / nickname' parameter in all versions up to, and including, 9.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
EUVD-2026-118564
The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname / nickname' parameter in all versions up to, and including, 9.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CLEANSTART-2026-PK63384 Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer
CVE-2026-56851 affects multiple packages. The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer. See references for individual vulnerability details...
SUSE CVE-2026-56851
The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer...
EUVD-2026-112618
The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator...
CVE-2026-108685 WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields
The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator...
CLEANSTART-2026-II79171 Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer
CVE-2026-56851 affects multiple packages. The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer. See references for individual vulnerability details...
CLEANSTART-2026-DB41831 Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer
CVE-2026-56851 affects multiple packages. The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer. See references for individual vulnerability details...
CLEANSTART-2026-EI53048 Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer
Security vulnerability affects the rclone package. The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer...
PT-2026-134710
Security vulnerability affects the rclone package. The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer...
CLEANSTART-2026-CY51593 Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer
CVE-2026-56851 affects multiple packages. The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer. See references for individual vulnerability details...
CVE-2026-56851
A flaw was found in golang.org/x/text. An attacker can cause a Denial of Service DoS by submitting specially crafted input to an application utilizing the Nickname profile. When transforming this input into an undersized destination buffer, an out-of-bounds slice indexing error occurs, causing th...