XXL-JOB v2.2.0 — Stored Cross Site Scripting

Multiple cross-site scripting XSS vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via 1 AppName and 2AddressList parameter in JobGroupController.java file. id: CVE-2020-23814 info: name: XXL-JOB v2.2.0 — Stored Cross Site Scripting author:...

ChurchCRM 4.5.3 - Cross-Site Scripting

A stored Cross-site scripting XSS vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php. id: CVE-2023-26843 info: name: ChurchCRM 4.5.3 - Cross-Site Scripting author: Harsh severity: medium description: | A stored Cross-site scripti...

CVE-2026-19354

A vulnerability was found in lock-upme OPMS up to 831440f37a92c1568f2e071d5233bc873a9d8b09. The impacted element is an unknown function of the file controllers/messages/message.go of the component IN Clause Handler. Performing a manipulation of the argument ids results in sql injection. The attac...

CVE-2026-19344

A vulnerability has been found in code-projects Task Management System 1.0. Affected by this issue is some unknown functionality of the file /user/commentcountuser.php. The manipulation of the argument taskid leads to sql injection. It is possible to initiate the attack remotely. The exploit has...

EUVD-2026-54913

A vulnerability has been found in code-projects Task Management System 1.0. Affected by this issue is some unknown functionality of the file /user/commentcountuser.php. The manipulation of the argument taskid leads to sql injection. It is possible to initiate the attack remotely. The exploit has...

CVE-2025-71409 No Authentication for Very High Frequency Data Link messages used in CPDLC

Lack of authentication for Very High Frequency Data Link messages allows rogue ground stations to inject CPDLC messages leading to unexpected or misleading clearances and potential pilot confusion. This type of attack can be carried out remotely over radio frequency...

EUVD-2026-53867

A vulnerability was identified in Shibby Tomato 1.28.0000. Affected by this issue is the function newqoslimitstart of the file /etc/qoslimit. The manipulation of the argument newqoslimitenable leads to os command injection. The attack may be initiated remotely. The exploit is publicly available a...

CVE-2026-19021

SourceCodester Computer Repair Shop Management System 1.0 is affected by a remote SQL injection in the file /classes/Master.php?f=delete_product, caused by manipulated ID parameter. The vulnerability can be exploited without authentication and has publicly disclosed exploit details. No patch/reme...

CVE-2026-8478

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code...

CVE-2026-18613

A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. This issue affects the function plugins.setconfig of the file /cgi-bin/glc of the component plugins.so Native Plugin. Such manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed to the...

CVE-2026-18613

GL-iNet GL-MT3000 (firmware up to 4.4.5) is affected by a vulnerability in the plugins.so Native Plugin: the function plugins.set_config in /cgi-bin/glc can be manipulated to cause injection. The attack is remote and publicly disclosed; vendor awareness confirmed. No remediation details are provi...

CVE-2026-18613 GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.set_config injection

A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. This issue affects the function plugins.setconfig of the file /cgi-bin/glc of the component plugins.so Native Plugin. Such manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed to the...

EUVD-2026-52267

A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switchinfo/network.switchstatus of the file /usr/lib/oui-httpd/rpc/network of the component Network Lua RPC Plugin. Such manipulation of the argument switch leads to command injection. The attack ma...

CVE-2026-18587

A flaw has been found in Wavlink WL-NU516U1 708c073-mt7628. The impacted element is an unknown function of the component Config Import. Executing a manipulation of the argument Password can lead to os command injection. The attack may be launched remotely. This attack is characterized by high...

PT-2026-67453

A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. This issue affects the function plugins.set config of the file /cgi-bin/glc of the component plugins.so Native Plugin. Such manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed to the...

Brother MFC-9970CDW Printers Cross-site Scripting (CVE-2013-2670)

Cross-site scripting XSS vulnerability in the Brother MFC-9970CDW printer with firmware G 1.03 and L 1.10 allows remote attackers to inject arbitrary web script or HTML via an arbitrary parameter name QUERYSTRING to admin/adminmain.html, a different vulnerability than CVE-2013-2507 and...

CVE-2026-17962

Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Low...

EUVD-2026-50602

Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to inject scripts or HTML into a privileged page via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-50767

Inappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-50746

Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...