CVE-2026-107270 Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints

Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/,...

PT-2026-68158

Name of the Vulnerable Software and Affected Versions Uptime Kuma affected versions not specified Description The Matomo analytics integration in the server/analytics/matomo-analytics.js file allows the injection of the admin-configurable siteId value as an unquoted JavaScript expression within a...

EUVD-2025-8595

Malicious code in bioql PyPI...

CVE-2025-31470

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in FancyThemes Page Takeover page-takeover allows Stored XSS.This issue affects Page Takeover: from n/a through = 1.1.6...

WordPress Page Takeover plugin <= 1.1.6 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nabil Irawan in WordPress Plugin Page Takeover versions = 1.1.6...

CVE-2025-31470

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in FancyThemes Page Takeover page-takeover allows Stored XSS.This issue affects Page Takeover: from n/a through = 1.1.6...

CVE-2025-31470

CVE-2025-31470 describes a Stored XSS in the WordPress plugin Page Takeover (affected: Page Takeover

CVE-2025-31470 WordPress Page Takeover plugin <= 1.1.6 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in FancyThemes Page Takeover page-takeover allows Stored XSS.This issue affects Page Takeover: from n/a through = 1.1.6...

WordPress plugin Page Takeover 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-31470: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in FancyThemes Page Takeover page-takeover allows Stored XSS.This issue affects Page Takeover: from n/a through = 1.1.6...

PT-2025-13504

Name of the Vulnerable Software and Affected Versions FancyThemes Page Takeover versions 1.1.6 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

MSEdgeRedirect 安全漏洞

MSEdgeRedirect is a tool to redirect news, search, widgets, weather, etc. to the default browser. A security vulnerability exists in MSEdgeRedirect that stems from the fact that versions of MSEdgeRedirect prior to 0.5.0.1 are prone to remote code execution via a specially crafted url. The...

Facebook Fixes Vulnerability That Led to Account Takeover, Pays Researcher $16K

Facebook quickly resolved a vulnerability in its Business Manager tool late last month that could have let an attacker take over any Facebook page. Arun Sureshkumar, a security researcher in India, disclosed the vulnerability Aug. 29; a member of Facebook’s security team, Neal Poole, informed him...