CVE-2026-104473 YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages

YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as incomingurl, id, file, tags, and template. Attackers can lure authenticated or unauthenticated users into opening crafted...

EUVD-2026-91396

YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as incomingurl, id, file, tags, and template. Attackers can lure authenticated or unauthenticated users into opening crafted...

CVE-2026-104473 YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages

YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as incomingurl, id, file, tags, and template. Attackers can lure authenticated or unauthenticated users into opening crafted...

CVE-2026-104465 YesWiki before 4.6.7 Reflected XSS via field Parameter in mail Handler

YesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the field parameter of the mail handler. Attackers can craft links whose field value breaks out of the ajax-mail-form action attribute to execute JavaScript in...

EUVD-2026-91476

YesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the field parameter of the mail handler. Attackers can craft links whose field value breaks out of the ajax-mail-form action attribute to execute JavaScript in...

CVE-2026-104465

Versions of YesWiki prior to 4.6.7 are vulnerable to a reflected cross-site scripting (XSS) vulnerability. The flaw exists in the mail handler due to improper sanitization of the field parameter . Unauthenticated attackers can craft malicious links where a crafted field value breaks out of the aj...

CVE-2026-104465 YesWiki before 4.6.7 Reflected XSS via field Parameter in mail Handler

YesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the field parameter of the mail handler. Attackers can craft links whose field value breaks out of the ajax-mail-form action attribute to execute JavaScript in...

CVE-2026-97652

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Query-Parameter Key in all versions up to, and including, 14.16.14 due to insufficient input sanitization and output escaping. This makes i...

CVE-2026-64638

XSS2Shell Alert PoC CVE-2026-64638 Доказательство концепции отражённого XSS до аутентификации в WordPress Однофайловый HTML PoC для CVE-2026-64638 XSS2Shell — XSS в ядре WordPress, вызванный различием парсеров. Демонстрирует выполнение JavaScript без аутентификации в origin WordPress через...

CVE-2026-64638

🛡️ CVE-2026-64638 - XSS2Shell Отражённый XSS до аутентификации в WordPress с потенциальной эскалацией до выполнения PHP-кода 📌 Обзор CVE-2026-64638 — это высокоопасная уязвимость отражённого межсайтового скриптинга XSS до аутентификации , затрагивающая экран входа в WordPress. При определённых...

CVE-2026-97652

The WP Statistics WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 14.16.14 . The root cause is insufficient input sanitization and output escaping of the REQUEST_URI Query-Parameter Key. This allows unauthenticated attackers to inject arb...

CVE-2026-97652 WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Query-Parameter Key in all versions up to, and including, 14.16.14 due to insufficient input sanitization and output escaping. This makes i...

CVE-2026-97652 WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Query-Parameter Key in all versions up to, and including, 14.16.14 due to insufficient input sanitization and output escaping. This makes i...

EUVD-2026-91337

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Query-Parameter Key in all versions up to, and including, 14.16.14 due to insufficient input sanitization and output escaping. This makes i...

POC-WP-XSS2Shell-CVE-2026-64638

XSS2Shell — PoC для CVE-2026-64638 Образовательное Proof of Concept цепочки XSS2Shell CVE-2026-64638, уязвимость XSS → RCE до аутентификации в ядре WordPress, обнаруженная независимо pwn.ai и опубликованная 7 августа 2026 года. Содержание 1. Краткое описание 2. Правовое уведомление 3. Архитектура...

CVE-2026-93880

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'GET:' Dynamic Placeholder in all versions up to, and including, 13.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...

WordPress Greenshift – animation and page builder blocks plugin <= 13.2.0 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Jiemook in WordPress Plugin Greenshift versions = 13.2.0...

Teldat-Router-CVE-2022-POC

Teldat Router CVE-2022-39996 и CVE-2022-39997 POC Доказательство концепции для двух уязвимостей, обнаруженных в маршрутизаторах Teldat RS123 / RS123w. Обзор CVE ID| Тип| CWE| CVSS| Серьезность ---|---|---|---|--- CVE-2022-39996| Отраженный XSS| CWE-79| 6.1| Средняя CVE-2022-39997| Слабый пароль|...

CVE-2022-35499

В Trimble TM4WEB =22.2.0 конечная точка внешнего просмотра счетов уязвима для отраженного межсайтового скриптинга XSS через внедрение в произвольный параметр, добавленный к URL. Шаг 1 : Следующий пример URL вызовет уязвимость и выполнит javascript-функцию alert, отображающую число 1 в качестве...

CVE-2026-93880

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 13.2.0 . The root cause is insufficient input sanitization and output escaping involving the '{{GET:}}' Dynamic Placeholder . Specifica...