CVE-2026-116875 SemanticMediaWiki 3.0.0 before 7.3.1 Reflected XSS via Special:Ask Separator Parameters

SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in Special:Ask, which outputs separator parameters sep, propsep, valuesep, delim, separator without HTML escaping in list, category, DSV, and CSV result printers. Unauthenticated attackers can send...

CVE-2026-116875

SemanticMediaWiki versions 3.0.0 before 7.3.1 are vulnerable to a reflected cross-site scripting (XSS) flaw within the Special:Ask functionality. The root cause is the lack of HTML escaping for separator parameters, specifically sep , propsep , valuesep , delim , and separator , when processed by...

CVE-2024-0399

CVE-2024-0399 - WooCommerce Customers Manager 29.4 - Post-Authenticated SQL Injection Exploit Title: WooCommerce Customers Manager 29.4 - Post-Authenticated SQL Injection Date: 2024-03-25 Exploit Author: Ivan Spiridonov - xbz0n Software Link:...

Modified-CVE-2019-15107

CVE-2019-15107 Make sure to manually change shellperl LHOST and LPORT on line 29 before execution. Modified from: https://github.com/ketlerd/CVE-2019-15107...

CLEANSTART-2026-UK88446 ReverseProxy can forward queries containing parameters not visible to Rewrite functions

CVE-2026-39825 affects multiple packages. ReverseProxy can forward queries containing parameters not visible to Rewrite functions. See references for individual vulnerability details...

CVE-2022-32988

CVE-2022-32988 Affected products We have not yet tested Asus models other than those listed. However we suspect it may also work on other models with the same firmware version. DSL-N14UB1 V.1.1.2.3805 Overview In router Asus DSL-N14U-B1 1.1.2.3805 was discovered to contain a stored cross-site...

PT-2026-126419

ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp that allows attackers to execute shell commands through unsanitized MCP tool parameters. Attackers can plant instructions in email or SMS content to inject $ or backtick substitutions into parameters...

CVE-2026-93328

Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases googleapis/mcp-toolbox versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local...

CVE-2026-93328

Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases googleapis/mcp-toolbox versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local...

EUVD-2026-109936

Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases googleapis/mcp-toolbox versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local...

Security Bulletin:Multiple vulnerabilities in bcpkix-jdk18on may affect IBM Infosphere Change Data Capture (CVE-2026-17508, CVE-2026-18036)

Summary Multiple security vulnerabilities have been identified in bcpkix-jdk18on, the Bouncy Castle Java APIs for CMS, PKCS, EAC, TSP, CMP, CRMF, OCSP, and certificate generation. bcpkix-jdk18on is used by IBM Infosphere Change Data Capture. IBM has addressed these vulnerabilities. Refer to the...

Linux Distros Unpatched Vulnerability : CVE-2026-110879

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Jackson project reports: Type parameters of generic type ids, and element types of array type ids, were not passed to the configured PolymorphicTypeValidato...

CVE-2026-116203 YesWiki before 4.7.0 Stored XSS via filtertags Action Parameters

YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in the filtertags action, which echoes attacker-controlled token values without output encoding. Anonymous attackers can inject markup via action-attribute parameters that bypasses the allowrawhtml gate, executing JavaScrip...

CVE-2026-116203

The YesWiki software, in versions prior to 4.7.0 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw within the filtertags action. The root cause is the lack of output encoding when the application echoes attacker-controlled token values. Specifically, anonymous attackers can inject marku...

CVE-2026-116203 YesWiki before 4.7.0 Stored XSS via filtertags Action Parameters

YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in the filtertags action, which echoes attacker-controlled token values without output encoding. Anonymous attackers can inject markup via action-attribute parameters that bypasses the allowrawhtml gate, executing JavaScrip...

Gxss

Project is now Deprecated as Dalfox has discovery option which can be used to identify reflecting params dalfox file urls.txt --skip-xss-scanning -o reflecting.txt Gxss v4.0 A Light Weight Tool for checking reflecting Parameters in a URL. Inspired by kxss by @tomnomnom. Installation go install...

Security Bulletin: IBM MQ Appliance is affected by an improper validation vulnerability (CVE-2026-12550)

Summary IBM MQ Appliance has addressed an improper validation vulnerability that could allow an authenticated attacker to obtain sensitive information or cause a denial of service. Vulnerability Details CVEID:CVE-2026-12550 DESCRIPTION: IBM MQ could allow an authenticated attacker to obtain...

CVE-2026-114621

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, list and detail actions in the Admin and Api/Admin prefixes pass request query parameters, including contain, conditions, fields, finder, and order, directly to the ORM as options. A user able to l...

EUVD-2026-108991

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, list and detail actions in the Admin and Api/Admin prefixes pass request query parameters, including contain, conditions, fields, finder, and order, directly to the ORM as options. A user able to l...

CVE-2026-50053

The Zimbra Collaboration Suite (ZCS) contains a request attribute override vulnerability where unauthenticated requests to /h/* can populate servlet attributes used for trusted internal dispatch. The RestFilter component improperly copies URL parameters—including authentication tokens , target ac...