Exploit for CVE-2026-103437

CVE-2026-103437: ReadingLists imported canonical URL XSS Repo...

EUVD-2026-36009

Ghidra before 12.1 contains an unsafe deserialization vulnerability in client-side Shared-Project RMI connection code that allows unauthenticated remote code execution. Attackers can craft a malicious project file with a ghidra:// URL that, when opened via File → Open Project, deserializes...

CVE-2026-47716

Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, In affected versions, the issue list view authorizes access through the project in the URL, but applies the requested bulk action to the submitted issue IDs without also requiring those issues to belong to that project. This...

WordPress Infinite Photography theme <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via project_url Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via projecturl Parameter vulnerability discovered by Francesco Carlucci in WordPress Theme Infinite Photography versions = 1.1.2...

PT-2024-37161

Name of the Vulnerable Software and Affected Versions: Infinite theme for WordPress versions up to, and including, 1.1.2 Description: The issue arises from insufficient input sanitization and output escaping, allowing authenticated attackers with Contributor-level access and above to inject...

Cross site scripting

Jenkins GitHub Plugin 1.37.3 and earlier does not escape the GitHub project URL on the build page when showing changes, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

Stored XSS vulnerability in github

github 1.37.3 and earlier does not escape the GitHub project URL on the build page when showing changes. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. github 1.37.3.1 escapes GitHub project URL on the build page when showi...

CVE-2019-12434

An issue was discovered in GitLab Community and Enterprise Edition 10.6 through 11.11. Users could guess the URL slug of private projects through the contrast of the destination URLs of issues linked in comments. It allows Information Disclosure...