Newsletter < 7.4.5 - Cross-Site Scripting

The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $SERVER'REQUESTURI' before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to Reflected XSS in older browsers such as...

Keycloak-12.0.1-CVE-2020-10770

Keycloak-12.0.1-CVE-2020-10770 Keycloak 12.0.1 - 'requesturi ' ブラインド サーバーサイドリクエストフォージェリ SSRF 認証不要 Exploit-DB-50405 期待される結果: localhost または内部からアクセス可能なホストのポートスキャン。 企業環境における教育およびテスト専用です。 このエクスプロイトは Python 3.8.6 でテスト済みです。 脆弱なアプリケーション : docker run -p 9990:9990 -p 8080:8080 -e KEYCLOAKUSER=admin -e...

CVE-2022-36663-PoC

CVE-2022-36663-PoC Gluu IAM のブラインド SSRF を利用した内部ネットワークスキャナー Gluu IAM はブラインド SSRF に対して脆弱であり、応答時間に基づいて内部ネットワークの開いているポートをスキャンするために悪用される可能性があります。 https://nvd.nist.gov/vuln/detail/CVE-2022-36663 ターゲットが脆弱かどうかを確認するには、/oxauth/restv1/authorize リクエストに &requesturi=http://burpcollab...

CVE-2024-27198-TeamCity

Mitigation methods: regexp on WAF REQUESTURI Regex ^\S\?jsp=\S;\.jsp...

CVE-2026-93896

The WPFront Notification Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.5.1. This is due to the debug-log output path writedebuglogs reflecting the raw value of $SERVER'REQUESTURI' through vprintf directly inside a block emitted on...

CVE-2026-103421

The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUESTURI path segment after /androidjson/search/' parameter in all versions up to, and including, 11.84 due to insufficient input sanitization and output escaping. This make...

CVE-2026-93896 WPFront Notification Bar <= 3.5.1 - Reflected Cross-Site Scripting via REQUEST_URI

The WPFront Notification Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.5.1. This is due to the debug-log output path writedebuglogs reflecting the raw value of $SERVER'REQUESTURI' through vprintf directly inside a block emitted on...

CVE-2026-93896

The WPFront Notification Bar plugin for WordPress (versions up to and including 3.5.1 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the write_debug_logs output path, which reflects the raw value of $_SERVER['REQUEST_URI'] through vprintf() directly into a [removed] b...

EUVD-2026-91956

The WPFront Notification Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.5.1. This is due to the debug-log output path writedebuglogs reflecting the raw value of $SERVER'REQUESTURI' through vprintf directly inside a block emitted on...

EUVD-2026-91951

The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUESTURI path segment after /androidjson/search/' parameter in all versions up to, and including, 11.84 due to insufficient input sanitization and output escaping. This make...

CVE-2026-103421

The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 11.84 . The root cause is insufficient input sanitization and output escaping of the REQUEST_URI (specifically the path segment after /android...

CVE-2026-92826

The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...

CVE-2026-92826

The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 8.7.7 . The root cause is insufficient input sanitization and output escaping within the REQUEST_URI Parameter Key . An unauthenticated attacker can inject arbit...

EUVD-2026-91894

The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...

CVE-2026-92826 EWWW Image Optimizer <= 8.7.7 - Reflected Cross-Site Scripting via REQUEST_URI Parameter Key

The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...

CVE-2026-97652

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Query-Parameter Key in all versions up to, and including, 14.16.14 due to insufficient input sanitization and output escaping. This makes i...

CVE-2026-97652 WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Query-Parameter Key in all versions up to, and including, 14.16.14 due to insufficient input sanitization and output escaping. This makes i...

CVE-2026-97652

The WP Statistics WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 14.16.14 . The root cause is insufficient input sanitization and output escaping of the REQUEST_URI Query-Parameter Key. This allows unauthenticated attackers to inject arb...

CVE-2026-97652 WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Query-Parameter Key in all versions up to, and including, 14.16.14 due to insufficient input sanitization and output escaping. This makes i...

EUVD-2026-91337

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Query-Parameter Key in all versions up to, and including, 14.16.14 due to insufficient input sanitization and output escaping. This makes i...