CVE-2026-5711

The Post Blocks & Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sliderStyle' block attribute in the Posts Slider block in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes ...

CVE-2026-5811 SourceCodester Online Food Ordering System POST Parameter Actions.php save_product logic error

A vulnerability was identified in SourceCodester Online Food Ordering System 1.0. Affected by this issue is the function saveproduct of the file /Actions.php of the component POST Parameter Handler. Such manipulation of the argument price leads to business logic errors. The attack may be performe...

CVE-2026-35479

creationtimestamp| type| source ---|---|--- 2026-04-08 22:11:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mizcrhd7sc2z...

CVE-2026-35407

creationtimestamp| type| source ---|---|--- 2026-04-08 22:01:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mizc7jymup2i...

CVE-2026-34724

creationtimestamp| type| source ---|---|--- 2026-04-08 21:57:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mizbxtsm2b22 2026-04-09 01:26:43+00:00| published-proof-of-concept| Telegram/LyxiOFuM6k6JRrVhGkcWrU8R1Vj8dluNTy4xGDA54CBUTMw 2026-04-09 15:00:04+00:00|...

CVE-2026-35401

creationtimestamp| type| source ---|---|--- 2026-04-08 21:50:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mizbl575ko27 2026-04-09 01:26:43+00:00| published-proof-of-concept| Telegram/LyxiOFuM6k6JRrVhGkcWrU8R1Vj8dluNTy4xGDA54CBUTMw 2026-04-09 07:15:52+00:00| seen|...

CVE-2026-34782

creationtimestamp| type| source ---|---|--- 2026-04-08 21:31:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mizakbphxh27...

CVE-2026-5711

The Post Blocks & Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sliderStyle' block attribute in the Posts Slider block in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes ...

CVE-2026-5711

CVE-2026-5711 affects the Post Blocks & Tools plugin for WordPress, specifically the Posts Slider block. The issue is a Stored Cross‑Site Scripting (XSS) vulnerability in the sliderStyle attribute, caused by insufficient input sanitization and output escaping for user-supplied attributes. It affe...

CVE-2026-5711 Post Blocks & Tools <= 1.3.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'sliderStyle' Block Attribute

The Post Blocks & Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sliderStyle' block attribute in the Posts Slider block in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes ...

CVE-2026-5806 code-projects Easy Blog Site update.php cross site scripting

A security vulnerability has been detected in code-projects Easy Blog Site 1.0. This affects an unknown function of the file /posts/update.php. The manipulation of the argument postTitle leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly a...

CVE-2026-4112

creationtimestamp| type| source ---|---|--- 2026-04-08 21:00:04+00:00| published-proof-of-concept| Telegram/jQQxeN2mPQPtfMYoTo2hQ-smSd26JApgUtHwY05JTWW84 2026-04-09 12:50:08+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mj2tufseft2h 2026-04-09 16:28:08+00:00| seen|...

CVE-2026-32586

creationtimestamp| type| source ---|---|--- 2026-04-08 20:30:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3miz53zmpwx2u...

CVE-2026-35478

InvenTree is an Open Source Inventory Management System. From 0.16.0 to before 1.2.7, any authenticated InvenTree user can create a valid API token attributed to any other user in the system — including administrators and superusers — by supplying the target's user ID in the user field of a POST...

CVE-2026-35476

InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, a non-staff authenticated user can elevate their account to a staff level via a POST request against their user account endpoint. The write permissions on the API endpoint are improperly configured, allowing any us...

CVE-2026-24983

creationtimestamp| type| source ---|---|--- 2026-04-08 19:30:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3miyzqq4kls2w...

CVE-2026-35476 InvenTree Affected by Privilege Escalation via API

InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, a non-staff authenticated user can elevate their account to a staff level via a POST request against their user account endpoint. The write permissions on the API endpoint are improperly configured, allowing any us...

EUVD-2026-20586

InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, a non-staff authenticated user can elevate their account to a staff level via a POST request against their user account endpoint. The write permissions on the API endpoint are improperly configured, allowing any us...

GHSA-8RH5-4MVX-XJ7J CI4MS Vulnerable to Post-Installation Re-entry via Cache-Dependent Install Guard Bypass

Summary The install route guard in ci4ms relies solely on a volatile cache check cache'settings' combined with .env file existence to block post-installation access to the setup wizard. When the database is temporarily unreachable during a cache miss TTL expiry or admin-triggered cache clear, the...

Cross-site Scripting (XSS)

Overview ci4-cms-erp/ci4ms is a composer create-project ci4-cms-erp/ci4ms Affected versions of this package are vulnerable to Cross-site Scripting XSS via the ajaxblackListpost process. An attacker can execute arbitrary JavaScript in the browser of other administrators by injecting malicious inpu...