CVE-2026-61526 AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the error.message is interpolated into the default HTML exception response without escaping, allowing a crafted missing-route URL to execute...

MantisBT < 2.28.4 Multiple Vulnerabilities

The version of MantisBT installed on the remote host is prior to 2.28.4. It is, therefore, affected by multiple vulnerabilities: - A SQL injection vulnerability exists in core/historyapi.php. The historyorder configuration value is concatenated directly into a SQL ORDER BY clause without any...

WordPress Sina Extension for Elementor plugin < 3.10.2 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Mustafa Ahmed in WordPress Plugin Sina Extension for Elementor versions 3.10.2...

WordPress Post Status Notifier Lite plugin < 1.13.0 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Luca Jungnickel in WordPress Plugin Post Status Notifier Lite versions 1.13.0...

CVE-2026-65882

Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle 3.1.1 - The goto url parameter of the moodle wrapper endpoint allowed a reflected XSS vector...

CVE-2026-65882

Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle 3.1.1 - The goto url parameter of the moodle wrapper endpoint allowed a reflected XSS vector...

EUVD-2026-49788

Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle 3.1.1 - The goto url parameter of the moodle wrapper endpoint allowed a reflected XSS vector...

CVE-2026-65882 Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1

Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle 3.1.1 - The goto url parameter of the moodle wrapper endpoint allowed a reflected XSS vector...

WOOF WordPress plugin - Cross-Site Scripting Detection

The WOOF WordPress plugin does not sanitize or escape the woofredrawelements parameter before reflecting it back in an admin page, leading to a reflected cross-site scripting. !/usr/bin/env python3 -- coding: utf-8 -- """The WOOF WordPress plugin does not sanitize or escape the woofredrawelements...

VMWare Cloud - Cross Site Scripting Detection

VMWare Cloud is vulnerable to Reflected Cross Site Scripting vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """VMWare Cloud is vulnerable to Reflected Cross Site Scripting vulnerability.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

WordPress Admin Font Editor <=1.8 - Cross-Site Scripting Detection

WordPress Admin Font Editor 1.8 and before contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...

WordPress anti-plagiarism <=3.60 - Cross-Site Scripting Detection

WordPress anti-plagiarism 3.6.0 and prior are vulnerable to reflected cross-site scripting. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress anti-plagiarism 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

WordPress enhanced-tooltipglossary 3.2.8 - Cross-Site Scripting Detection

WordPress enhanced-tooltipglossary 3.2.8 contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...

WordPress Raygun4WP <=1.8.0 - Cross-Site Scripting Detection

WordPress Raygun4WP 1.8.0 contains a reflected cross-site scripting vulnerability via sendtesterror.php. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Raygun4WP 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Sympa version =>6.2.16 - Cross-Site Scripting Detection

Sympa version 6.2.16 and later contains a URL Redirection to Untrusted Site vulnerability in the referer parameter of the wwsympa fcgi login action that can result in open redirection and reflected cross-site scripting via data URIs. !/usr/bin/env python3 -- coding: utf-8 -- """Sympa version 6.""...

WordPress wpForo Forum <= 1.4.11 - Cross-Site Scripting Detection

WordPress wpForo Forum plugin before 1.4.12 for WordPress allows unauthenticated reflected cross-site scripting via the URI. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress wpForo Forum plugin before 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Advantech R-SeeNet 2.4.12 - Cross-Site Scripting Detection

Advantech R-SeeNet 2.4.12 contains a reflected cross-site scripting vulnerability in the sshform.php script functionality. !/usr/bin/env python3 -- coding: utf-8 -- """Advantech R-SeeNet 2.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

WordPress White Label CMS <2.2.9 - Cross-Site Scripting Detection

WordPress White Label CMS plugin before 2.2.9 contains a reflected cross-site scripting vulnerability. It does not sanitize and validate the wlcmslogincustomjs parameter before outputting it back in the response while previewing. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress White Label...

Microweber <1.2.15 - Cross-Site Scripting Detection

Microweber prior to 1.2.15 contains a reflected cross-site scripting vulnerability. An attacker can execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch oth...

Temenos Transact - Cross-Site Scripting Detection

Multiple vulnerabilities in Temenos Transact formerly T24 that allows multiple reflected cross-site scripting XSS attacks. !/usr/bin/env python3 -- coding: utf-8 -- """Multiple vulnerabilities in Temenos Transact formerly T24 that allows multiple reflected cross-site scriptin.""" from kittysploit...