82 matches found
CVE-2026-87928 MaxSite CMS 0.94 through 109.6 HTML Upload XSS via admin_page
MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the adminpage upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/pages/ directory, which executes in visitors' browsers wh...
CVE-2026-52684 Prefetch Feature Allows Persistent Ghost Domain Cache Poisoning Attack
If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the child records are used immediately if not expired and thus valid, or the records are expired, and in that case not use...
CVE-2026-29905
Kirby CMS through 5.1.4 allows an authenticated user with 'Editor' permissions to cause a persistent Denial of Service DoS via a malformed image upload. The application fails to properly validate the return value of the PHP getimagesize function. When the system attempts to process this file for...
CVE-2025-14740
Docker Desktop for Windows contains multiple incorrect permission assignment vulnerabilities in the installer's handling of the C:\ProgramData\DockerDesktop directory. The installer creates this directory without proper ownership verification, creating two exploitation scenarios: Scenario 1...
EUVD-2025-206791
Docker Desktop for Windows contains multiple incorrect permission assignment vulnerabilities in the installer's handling of the C:\ProgramData\DockerDesktop directory. The installer creates this directory without proper ownership verification, creating two exploitation scenarios: Scenario 1...
PT-2026-5035
Name of the Vulnerable Software and Affected Versions Meshtastic versions prior to 2.7.6.834c3c5 Description Meshtastic is a mesh networking solution where nodes are identified by their NodeID, derived from the MAC address, rather than their public key. This design flaw allows an attacker to forg...
CVE-2022-35251
A cross-site scripting vulnerability exists in Rocket.chat...
CVE-2017-18563
The rsvp plugin before 2.3.8 for WordPress has persistent XSS via the note field on the attendee-list screen...
CVE-2023-53903
WebsiteBaker 2.13.3 contains a stored cross-site scripting vulnerability that allows authenticated users to upload malicious SVG files with embedded JavaScript. Attackers can upload crafted SVG files with script tags that execute when the file is viewed, enabling persistent cross-site scripting...
CVE-2025-66308: Improper Neutralization of Input During Web Page Generation
This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting XSS vulnerability was identified in the /admin/config/site endpoint of the Grav application. This...
EUVD-2021-25148
Malware in sbrugna...
EUVD-2017-7823
Malware in sbrugna...
EUVD-2018-10235
Malware in sbrugna...
EUVD-2017-11105
Malware in sbrugna...
EUVD-2018-2387
Malware in sbrugna...
EUVD-2017-11826
Malware in sbrugna...
EUVD-2020-7192
Malware in sbrugna...
EUVD-2022-33760
Malicious code in bioql PyPI...