CVE-2016-10993

CVE-2016-10993 Wordpress Vulnerability - XSS Cross-Site Scripting Vulnerability Location https://themesinfo.com/scoreme-wordpress-theme-design-496 Proof of Concept PoC https://example.com/?s=%22%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E Refrensi...

CVE-2026-76569

Reflected XSS via search GET Parameter in Phoca Download Phoca Download ≤ 6.1.4 — Authenticated Attacker Executes Arbitrary JavaScript via Crafted Search URL in User Control Panel SUMMARY Phoca Download comphocadownload for Joomla contains a reflected Cross-Site Scripting XSS vulnerability in the...

CVE-2020-35545

CVE-2020-35545 Spotweb 1.4.9 - 'search' SQL Injection...

Lyrion Music Server <= 9.2.0 - Cross-Site Scripting

Lyrion Music Server 9.2.0 contains a reflected XSS caused by improper sanitization of the search parameter in the server.log endpoint, letting unauthenticated attackers execute arbitrary script in users' browsers. id: CVE-2026-50230 info: name: Lyrion Music Server = 9.2.0 - Cross-Site Scripting...

WordPress-XStore-theme-SQL-Injection

WordPress-XStore-theme-SQL-Injection CVE-2024-33559 XStore theme-SQL Injection CVE-2024-33551 is a SQL injection vulnerability found in 8theme XStore, an ecommerce platform built on WordPress. This vulnerability allows attackers to execute malicious SQL commands on the database, which can lead to...

CVE-2023-46016-Code-Projects-Blood-Bank-1.0-Reflected-Cross-Site-Scripting-Vulnerability

CVE-2023-46016-Code-Projects-Blood-Bank-1.0-Reflected-Cross-Site-Scripting-Vulnerability Exploit Author: ersinerenler Vendor Homepage https://code-projects.org/blood-bank-in-php-with-source-code Software Link https://download-media.code-projects.org/2020/11/BloodBankInPHPWithSourcecode.zip Overvi...

CVE-2023-51810

CVE-2023-51810 Description Blind SQL injection vulnerability in StackIdeas EasyDiscuss v.5.0.5 allows a remote attacker to obtain sensitive information via search parameter in the Users module. Product StackIdeas EasyDiscuss v5.0.5 - EasyDiscuss - Joomla Forum Discussion Tool - StackIdeas...

CVE-2023-34632

CVE-2023-34632 Reflected XSS in 1000projects Book Management System 1.0 CVE-2023-34632 Reflected Cross-Site Scripting XSS in 1000projects Book Management System 1.0 Description A Reflected Cross-Site Scripting XSS vulnerability was discovered in 1000projects Book Management System version 1.0. Th...

VulnCheck KEV: CVE-2026-2579

The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the ‘search’ parameter in all versions up to, and including, 4.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing S...

CVE-2025-61454

🛡️ CVE Disclosure: CVE-2025-61454 — Reflected XSS in E-commerce Project Disclosure Date: 14 October 2025 CVE ID: CVE-2025-61454 Severity: MEDIUM CVSS 6.1 🧩 Summary A reflected Cross-Site Scripting XSS vulnerability exists in the E-commerce Project v1.0, specifically within the search.php endpoint...

CVE-2026-9848

CVE-2026-9848 CVE-2026-9848 is an Unauthenticated SQL Injection SQLi vulnerability affecting the WP Ticket Customer Support Ticket System & Helpdesk plugin for WordPress up to and including version 6.0.4.The flaw occurs because the plugin takes the WordPress search parameter s and concatenates it...

CVE-2022-38553

CVE-2022-38553 CROSS SITE SCRIPTING XSS ON "ACADEMY LEARNING MANAGEMENT SYSTEM" POC VIDEO: Security Risk: This security vulnerability allows to execute arbitrary JavaScript code in user browser if they access URL prepared by attackers...

CVE-2024-50969

CVE-2024-50969 Description A Reflected cross-site scripting XSS vulnerability in browse.php of Code-projects Jonnys Liquor 1.0 allows remote attackers to inject arbitrary web scripts or HTML via the search parameter. Vulnerability Type Cross Site Scripting XSS Vendor of Product Code-projects...

cve-2022-42889-text4shell-docker

Install maven - maven-linux 1. Maven install to create the fat jar mvn clean install 2. Docker build docker build --tag=text4shell . 3. Docker run docker run -p 80:8080 text4shell 4. Test the app http://localhost/text4shell/attack?search= 5. Attack can be performed by passing a string...

text4shell-cve-2022-42889

Text4Shell CVE-2022-42889 Docker Lab for CVE-2022-42889 You can either build the Docker image locally or pull the image from Docker Hub and run the container. Clone the repo git clone https://github.com/devenes/text4shell-cve-2022-42889.git Build the Docker image locally docker build...

Joe Dolson My Calendar code injection vulnerability

In versions 3.8.8 through 3.8.11 of Joe Dolson’s My Calendar, there is a code injection vulnerability. This vulnerability arises from short code injection via the mcs search parameter. Unauthenticated attackers can execute registered short codes; the mcs value is passed directly to...

EUVD-2026-110720

SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject markup through the search parameter of the extended Special:Search profile. Attackers can send visitors crafted URLs using the smw profile with SVG eve...

CVE-2026-116892

SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject markup through the search parameter of the extended Special:Search profile. Attackers can send visitors crafted URLs using the smw profile with SVG eve...

CVE-2026-116892 SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via Special:Search smw Profile

SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject markup through the search parameter of the extended Special:Search profile. Attackers can send visitors crafted URLs using the smw profile with SVG eve...

Semantic MediaWiki cross-site scripting vulnerability

Versions 3.1.0 through 7.3.1 of Semantic MediaWiki contain a cross-site scripting vulnerability. This flaw arises because the search parameter in the extended Special:Search configuration file is not properly filtered. ProfileForm::profilesheet inserts specially crafted URLs containing an SVG eve...