CVE-2026-97626

The Gitea platform is vulnerable to a visibility check bypass when requesting a user or organization profile page (GET /{username}) using an Accept: application/rss+xml or Accept: application/atom+xml header. This flaw allows anonymous users, restricted users, and non-members to confirm the exist...

CVE-2026-14860

The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated attackers to make the server issue requests to arbitrary hosts and read back responses that parse as RSS/XML...

CVE-2026-14860

The Podcast Player WordPress plugin (versions before 8.3.1 ) is vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) . The flaw exists because the plugin fails to validate the destination of a server-side request constructed from user-supplied input. This allows an unauthenticated ...

CVE-2026-14860: Server-Side Request Forgery (SSRF)

The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated attackers to make the server issue requests to arbitrary hosts and read back responses that parse as RSS/XML...

CVE-2026-47260: Server-Side Request Forgery (SSRF)

Koel is a free, open-source music streaming solution. Prior to version 9.3.5, Koel validates the podcast feed URL via the SafeUrl rule DNS resolution + public IP check, but the individual episode values extracted from the RSS XML are stored directly into the database without any SSRF validation...

CVE-2009-4936

Multiple SQL injection vulnerabilities in Small Pirate SPirate 2.1 allow remote attackers to execute arbitrary SQL commands via 1 the id parameter to the default URI in an rss .xml action, or the id parameter to 2 pag1.php, 3 pag1-guest.php, 4 rss-commentpost.php aka rss-comentpost.php, or 5...

Sql injection

Multiple SQL injection vulnerabilities in Small Pirate SPirate 2.1 allow remote attackers to execute arbitrary SQL commands via 1 the id parameter to the default URI in an rss .xml action, or the id parameter to 2 pag1.php, 3 pag1-guest.php, 4 rss-commentpost.php aka rss-comentpost.php, or 5...

Development Site Professional Liberal - Company Institutional SQL Injection

Author: L0rd CrusAd3r aka VSN [email protected] Exploit Title: Development Site Professional Liberal - Company Institutional SQL Injection Vulnerability Vendor url:http://www.mformula.com.br/ Version:n/a Price:100$ Published: 2010-06-11 Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue,...

Site for Real Estate - Brokers SQL Injection

Site for Real Estate - Brokers SQL Injection Vendor url:http://www.mformula.com.br/ Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue, S1ayer,d3c0d3r,KD and to all ICW & AH members. Spl Greetz to:inj3ct0r.com Team Description: Site for Real Estate - Brokers SQL Injection Vulnerability Resources and...

Site to Store Automobile - Motorcycle Boat SQL Injection

Vendor url:http://www.mformula.com.br/ Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue, S1ayer,d3c0d3r,KD and to all ICW & AH members. Spl Greetz to:inj3ct0r.com Team Description: Site to Store Automobile - Motorcycle - Boat SQL Injection Vulnerability Resources and Advantages Better cost-benefit...

Hotel / Resort Site Script SQL Injection

Author: L0rd CrusAd3r aka VSN [email protected] Exploit Title:Hotel / Resort Site Script with OnLine Reservation System SQLi Vulnerable Published: 2010-06-08 Vendor url:http://www.mformula.com.br Greetz to:Sid3^effects, aaNumb, M4n0j and to all ICW members DESCRIPTION: Internal system for tot...

Hotel / Resort Site Script with OnLine Reservation System - SQL Injection

Author: L0rd CrusAd3r aka VSN [email protected] Exploit Title:Hotel / Resort Site Script with OnLine Reservation System SQLi Vulnerable Published: 2010-06-08 Vendor url:http://www.mformula.com.br Greetz to:Sid3^effects, aaNumb, M4n0j and to all ICW members DESCRIPTION: Internal system for tot...

Cross site scripting

Cross-site scripting XSS vulnerability in Google Chrome 2.x and 3.x before 3.0.195.21 allows remote attackers to inject arbitrary web script or HTML via a 1 RSS or 2 Atom feed, related to the rendering of the application/rss+xml content type as XML "active content."...

CVE-2009-3265

Opera 9.x/10.x is affected by CVE-2009-3265, a Cross-site scripting (XSS) flaw where rendering of RSS/Atom feeds as scripted content enables injection of arbitrary script/HTML. The underlying issue is the handling of application/rss+xml as scripted content. The vendor reportedly viewed this as a ...

CVE-2009-3263: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Google Chrome 2.x and 3.x before 3.0.195.21 allows remote attackers to inject arbitrary web script or HTML via a 1 RSS or 2 Atom feed, related to the rendering of the application/rss+xml content type as XML "active content."...

CVE-2009-3265: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Opera 9 and 10 allows remote attackers to inject arbitrary web script or HTML via a 1 RSS or 2 Atom feed, related to the rendering of the application/rss+xml content type as "scripted content." NOTE: the vendor reportedly considers this behavior a "design...