16 matches found
CVE-2026-37503
Cross-Site Scripting XSS in V2Board thru 1.7.4. The customhtml field in theme configuration is rendered using Blade unescaped output in public/theme/v2board/dashboard.blade.php. An admin can inject arbitrary JavaScript via the saveThemeConfig API. All site visitors execute the payload, enabling...
EUVD-2026-26667
Cross-Site Scripting XSS in V2Board thru 1.7.4. The customhtml field in theme configuration is rendered using Blade unescaped output in public/theme/v2board/dashboard.blade.php. An admin can inject arbitrary JavaScript via the saveThemeConfig API. All site visitors execute the payload, enabling...
PT-2026-36484
Name of the Vulnerable Software and Affected Versions V2Board versions prior to 1.7.5 Description Cross-Site Scripting XSS occurs when the custom html field in the theme configuration is rendered using unescaped Blade output in the 'public/theme/v2board/dashboard.blade.php' file. An administrator...
CVE-2026-37503
Cross-Site Scripting XSS in V2Board thru 1.7.4. The customhtml field in theme configuration is rendered using Blade unescaped output in public/theme/v2board/dashboard.blade.php. An admin can inject arbitrary JavaScript via the saveThemeConfig API. All site visitors execute the payload, enabling...
EUVD-2018-13439
Malware in sbrugna...
CVE-2018-20901
cPanel before 71.9980.37 allows Remote-Stored XSS in WHM Save Theme Interface SEC-400...
PT-2024-17973 · WordPress · Colibri Page Builder
Name of the Vulnerable Software and Affected Versions: Colibri Page Builder plugin for WordPress versions up to, and including, 1.0.253 Description: The issue is due to missing or incorrect nonce validation on the apiCall function, making it possible for unauthenticated attackers to call a limite...
Colibri Page Builder < 1.0.260 - Import Images, Delete Post, Save Theme Data via CSRF
Description The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on the apiCall function, allowing unauthenticated attackers to call a limited set of functions that can be used to import images, delete posts, or save theme data via a forged request...
CVE-2021-34636
The Countdown and CountUp, WooCommerce Sales Timers WordPress plugin is vulnerable to Cross-Site Request Forgery via the savetheme function found in the /includes/admin/coundownthemepage.php file due to a missing nonce check which allows attackers to inject arbitrary web scripts, in versions up t...
PT-2021-20604
Name of the Vulnerable Software and Affected Versions: The Countdown and CountUp, WooCommerce Sales Timers WordPress plugin versions up to and including 1.5.7 Description: The issue is related to Cross-Site Request Forgery, which occurs due to a missing nonce check in the save theme function foun...
CVE-2018-20901
cPanel before 71.9980.37 allows Remote-Stored XSS in WHM Save Theme Interface SEC-400...
CVE-2018-20901
cPanel before 71.9980.37 allows Remote-Stored XSS in WHM Save Theme Interface SEC-400...
CVE-2018-20901
cPanel before 71.9980.37 allows Remote-Stored XSS in WHM Save Theme Interface SEC-400...
CVE-2018-20901
CVE-2018-20901 affects cPanel before 71.9980.37 and enables Remote-Stored XSS in the WHM Save Theme Interface (SEC-400). The incident is described as XSS that can be triggered remotely via the Save Theme UI, with a CVSS v3 base score of 6.1 (MEDIUM) and CVSS v2 base score 4.3 (MEDIUM). The availa...
PT-2019-10332
Name of the Vulnerable Software and Affected Versions: cPanel versions prior to 71.9980.37 Description: The issue allows for Remote-Stored XSS in the WHM Save Theme Interface. Recommendations: For versions prior to 71.9980.37, update to version 71.9980.37 or later to resolve the issue...
