CVE-2026-77607 Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, sep was inserted verbatim into HTML cell joins. This made it possible to inject HTML through the separator value. Version 7.2.0 fixes the issue...

EUVD-2026-83181

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, sep was inserted verbatim into HTML cell joins. This made it possible to inject HTML through the separator value. Version 7.2.0 fixes the issue...

CVE-2026-77607 Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, sep was inserted verbatim into HTML cell joins. This made it possible to inject HTML through the separator value. Version 7.2.0 fixes the issue...

CVE-2026-77607

Semantic MediaWiki , a free open-source MediaWiki extension, had a reflected XSS vulnerability in versions prior to 7.2.0 . The sep parameter in the Special:Ask table renderer was inserted verbatim into HTML cell joins, allowing an attacker to inject arbitrary HTML through the separator value. Pe...

CVE-2026-77608 Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when the value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Version 7.2.0...

CVE-2026-77608

Semantic MediaWiki , a free open-source extension to MediaWiki, is affected by a reflected cross-site scripting (XSS) vulnerability in the Special:SearchByProperty page. Prior to version 7.2.0 , the value parameter was reflected into rendered output and error messaging paths without sufficient ou...

CVE-2026-77608 Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when the value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Version 7.2.0...

EUVD-2026-83173

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when the value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Version 7.2.0...

EUVD-2026-83171

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when headers=plain, table header text was emitted into via a raw HTML path. User-controlled mainlabel content could therefore become executable...

CVE-2026-77606

Semantic MediaWiki , a free open-source extension to MediaWiki, is affected by a reflected XSS vulnerability in Special:Ask when the headers=plain option is used. Table header text was emitted into elements via a raw HTML path , allowing user-controlled mainlabel content to become executable HTM...

CVE-2026-77606 Semantic MediaWiki has reflected XSS in Special:Ask plain table headers

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when headers=plain, table header text was emitted into via a raw HTML path. User-controlled mainlabel content could therefore become executable...

CVE-2026-77606 Semantic MediaWiki has reflected XSS in Special:Ask plain table headers

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when headers=plain, table header text was emitted into via a raw HTML path. User-controlled mainlabel content could therefore become executable...

XSS2Shell-CVE-2026-64638

CVE-2026-64638 — XSS2Shell WordPress Pre-Auth Reflected XSS → Remote Code Execution Chain DOM Clobbering + Application Password Theft + REST API Plugin Activation = Full RCE ⚡ Overview CVE-2026-64638 is a critical pre-authentication Reflected XSS in WordPress wp-login.php. The vulnerability exist...

WordPress Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin <= 2.15.22 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin BP Better Messages versions = 2.15.22...

WordPress ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin <= 3.5.1 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin ShopLentor versions = 3.5.1...

WordPress Booking Calendar plugin <= 11.8.2 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Yuto Hyakumoto in WordPress Plugin Booking Calendar versions = 11.8.2...

CVE-2025-12101-Scanner-PoC

CVE-2025-12101 Scanner Multi-threaded vulnerability scanner for CVE-2025-12101 - Citrix NetScaler XSS via SAML RelayState. Overview CVE-2025-12101 is a reflected XSS vulnerability in Citrix NetScaler ADC and Gateway products affecting the /cgi/logout endpoint through the RelayState parameter. CVS...

CVE-2025-6563

MikroTik Hotspot Login Page Reflected XSS Vulnerability Advisory Overview A reflected Cross-Site Scripting XSS vulnerability was discovered in the MikroTik RouterOS Hotspot login page. The vulnerability is triggered via the dst URL parameter, which improperly sanitizes input, allowing malicious...

CVE-2026-64638-PoC-XSS2Shell-

XSS2Shell — WordPress Pre-Auth XSS → RCE Chain PoC CVE-2026-64638 · Reflected XSS on wp-login.php · CVSS 8.9 v4.0 · Patched in WordPress 7.0.3 ⚠️ AUTHORIZED TESTING ONLY. This tool is for security research and authorized penetration testing against systems you own or have explicit written...

CVE-2026-64638-XSS-to-Shell-PoC

CVE-2026-64638 — XSS2Shell Proof of Concept A proof-of-concept PoC tool for validating CVE-2026-64638 , a pre-authentication reflected Cross-Site Scripting XSS vulnerability affecting WordPress installations versions 6.4 – 7.0.2. Overview This tool automates the process of fingerprinting,...