71 matches found
CVE-2026-121768
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Markus Wiesenhofer Contact Form 7 Post Fields cf7-post-fields allows Stored XSS.This issue affects Contact Form 7 Post Fields: from n/a through 2.6.0...
CVE-2026-121768
The Markus Wiesenhofer Contact Form 7 – Post Fields (cf7-post-fields) plugin for WordPress is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. This issue arises from improper neutralization of input during web page generation , affecting versions from n/a through 2.6.0 . Successful exploit...
CVE-2026-121768 WordPress Contact Form 7 – Post Fields plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Markus Wiesenhofer Contact Form 7 Post Fields cf7-post-fields allows Stored XSS.This issue affects Contact Form 7 Post Fields: from n/a through 2.6.0...
EUVD-2026-119016
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Markus Wiesenhofer Contact Form 7 Post Fields cf7-post-fields allows Stored XSS.This issue affects Contact Form 7 Post Fields: from n/a through 2.6.0...
WordPress Contact Form 7 – Post Fields plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by cazy in WordPress Plugin Contact Form 7 Post Fields versions = 2.6.0...
Astra Linux – Vulnerability in curl
There is an information disclosure vulnerability in curl v8.1.0 when performing HTTPS transfers. libcurl may incorrectly use the read callback CURLOPTREADFUNCTION to request data to be sent, even when the CURLOPTPOSTFIELDS option is set. This occurs if the same handle was previously used to issue...
CVE-2026-103681 Frontend Dashboard < 3.0.0 - Subscriber+ Profile and Post Field Deletion via fed_user_profile_delete
The Frontend Dashboard WordPress plugin before 3.0.0 does not perform a capability check in one of its AJAX actions, allowing authenticated users with low privileges, such as subscribers, to delete the Frontend Dashboard WordPress plugin before 3.0.0's configured profile and post form fields...
CVE-2026-103681
The Frontend Dashboard WordPress plugin (versions before 3.0.0 ) is vulnerable to an improper access control issue (CWE-284) in one of its AJAX actions . Specifically, the plugin fails to perform a necessary capability check , allowing authenticated users with low privileges, such as subscribers ...
Cross-site Scripting (XSS)
Appium is vulnerable to Cross-site Scripting XSS. The vulnerability is due to unsanitized reflection of user-controlled query parameters, POST fields, and HTTP headers into HTML, which allows an attacker to execute arbitrary JavaScript on the server origin...
CVE-2026-71249 299Ko - Unauthenticated Reflected XSS in Public Contact Form
299Ko's public contact form plugin/contact/controllers/ContactController.php, home sets raw POST field values name, firstname, email, message into the page template with no sanitization. The template engine's variable output function common/Template.php, showvar echoes values with no...
CVE-2026-71249
299Ko's public contact form plugin/contact/controllers/ContactController.php, home sets raw POST field values name, firstname, email, message into the page template with no sanitization. The template engine's variable output function common/Template.php, showvar echoes values with no...
CVE-2026-71249
CVE-2026-71249 affects 299Ko’s public contact form. The vulnerability arises in the plugin/contact/controllers/ContactController.php (home()) where raw POST fields (name, firstname, email, message) are inserted into the page template without sanitization. The template engine’s _show_var() echoes ...
CVE-2026-54219
UBB.threads is vulnerable to Stored XSS via user posts and user profile fields. The application fails to properly sanitize user input, allowing low privileged attackers to inject arbitrary JavaScript that executes in a victim's browser upon viewing. Because vendor contact attempts were...
CVE-2026-48230 Open ISES Tickets < 3.44.2 Reflected XSS via ticketsmdb_import.php Multiple POST Parameters
Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ticketsmdbimport.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the multiple POST parameters mdbhost, mdbdb, mdbuser, mdbpassword, mdbprefix,...
CVE-2026-4053
Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13 fail to enforce the PostEditTimeLimit on non-message post fields which allows an authenticated user to modify post file attachments, props, and pin status after the edit window has expired via the post patch and update API endpoints...
CVE-2026-4053: Operation on a Resource after Expiration or Release
Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13 fail to enforce the PostEditTimeLimit on non-message post fields which allows an authenticated user to modify post file attachments, props, and pin status after the edit window has expired via the post patch and update API endpoints...
CVE-2018-25308
BuddyPress Xprofile Custom Fields Type 2.6.3 contains an arbitrary file deletion vulnerability that allows authenticated users to delete arbitrary files by manipulating unescaped POST parameters. Attackers can modify the fieldhiddenfile and fielddeleteimg parameters during profile editing to unli...
PT-2026-35991
BuddyPress Xprofile Custom Fields Type 2.6.3 contains a remote code execution vulnerability that allows authenticated users to delete arbitrary files by manipulating unescaped POST parameters. Attackers can modify the field hiddenfile and field deleteimg parameters during profile editing to unlin...
Pachno 1.0.6 Stored Cross-Site Scripting
Summary Pachno is an open-source collaboration platform formerly known as The Bug Genie designed for team project management, issue tracking, and documentation. It offers a module-based, customizable environment for software development and team workflows, distributed under the Mozilla Public...
MATRI4WEB Marriage Website Script M-Plus SQL Injection Vulnerability
MATRI4WEB Matrimony Website Script M-Plus is a website scripting system developed by the Indian company MATRI4WEB. It is used to create dating platforms and manage member profiles as well as matching functions. The MATRI4WEB Matrimony Website Script M-Plus has a SQL injection vulnerability. This...