WordPress Stray Random Quotes <= 1.9.9 - Cross-Site Scripting

Stray Random Quotes WordPress plugin = 1.9.9 contains a reflected cross-site scripting caused by a lack of sanitization and escaping of a parameter before output, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a malicious URL...

CVE-2026-48732-poc

CVE-2026-48732: إثبات المفهوم PoC لحقن أوامر cwd عن بعد عبر SSH في Warp النسخة الإنجليزية نظرة عامة يُعد هذا المستودع إثبات المفهوم PoC للثغرة الأمنية عالية الخطورة CVE-2026-48732 ، وهي ثغرة من نوع حقن أوامر نظام التشغيل OS Command Injection موجودة في معالجة أوامر الخلفية التقليدية لـ SSH في تطبي...

CVE-2024-13488

CVE-2024-13488 LTL Freight Quotes – Estes Edition = 5.6 AND error-based - WHERE, HAVING,...

CVE-2024-13483

CVE-2024-13483 LTL Freight Quotes – SAIA Edition = 2.2.10 - Injection SQL non authentifiée Description Le plugin LTL Freight Quotes – SAIA Edition pour WordPress est vulnérable à une injection SQL via les paramètres 'editid' et 'dropshipeditid' dans toutes les versions jusqu'à la 2.2.10 incluse, ...

CVE-2024-13479

CVE-2024-13479 LTL Freight Quotes – SEFL Edition = 5.6 AND error-based -...

CVE-2024-13481

CVE-2024-13481 LTL Freight Quotes – R+L Carriers Edition = 3.3.4 - Injection SQL non authentifiée Description Le plugin LTL Freight Quotes – R+L Carriers Edition pour WordPress est vulnérable à une injection SQL via les paramètres 'editid' et 'dropshipeditid' dans toutes les versions jusqu'à la...

EUVD-2026-62596

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. From version 8.19.0 until 8.21.0, a double quote in a schema property name is emitted into the generated zod.object... schema without safe encoding. This permits attacker-controlled JavaScrip...

CVE-2024-13485

CVE-2024-13485 LTL Freight Quotes – ABF Freight Edition = 3.3.7 - Injection SQL non authentifiée Description Le plugin LTL Freight Quotes – ABF Freight Edition pour WordPress est vulnérable à l'injection SQL via les paramètres 'editid' et 'dropshipeditid' dans toutes les versions jusqu'à la versi...

CVE-2024-13478

CVE-2024-13478 LTL Freight Quotes – TForce Edition = 3.6.4 - Injection SQL non authentifiée Description Le plugin LTL Freight Quotes – TForce Edition pour WordPress est vulnérable à une injection SQL via les paramètres 'dropshipeditid' et 'editid' dans toutes les versions jusqu'à la 3.6.4 incluse...

CVE-2024-13489

CVE-2024-13489 عروض الشحن LTL – إصدار Old Dominion = 5.6 AND error-based - WHERE, HAVING, ORDER BY o...

CVE-2026-45115

MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messag...

CVE-2026-45115

MyBB's Buddy/Ignore component fails to escape single quotes in usernames via htmlspecialchars_uni(), enabling stored XSS in the User CP and Private Messages Select Buddies list. Victims are affected when confirming buddy removal in usercp.php or selecting buddies in the xmlhttp.php onclick handle...

EUVD-2026-61005

MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messag...

CVE-2026-45115 MyBB: Buddy/ignore list username XSS

MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messag...

CVE-2026-19744 Stored Cross-site Scripting in Pentestify Markdown renderer via unescaped quotes

Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization...

CVE-2026-19744 Stored Cross-site Scripting in Pentestify Markdown renderer via unescaped quotes

Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization...

CVE-2026-19744

CVE-2026-19744 details a stored Cross-site Scripting (XSS) vulnerability in the Markdown renderer of Pentestify (MaAlfer) prior to version 2.3.2. The issue arises when a Markdown link URL contains a double quote, which closes the anchor href and allows arbitrary JavaScript execution in the applic...

CVE-2026-19744 Stored Cross-site Scripting in Pentestify Markdown renderer via unescaped quotes

Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization...

CVE-2026-14863

FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by uploading a file with a malicious filename containing shell command substitution sequences. The thumbnail generation system passes...

EUVD-2026-56976

FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by uploading a file with a malicious filename containing shell command substitution sequences. The thumbnail generation system passes...