CVE-2026-100174

The AIL Framework tag selector component (specifically var/www/static/js/tags.js) is vulnerable to stored cross-site scripting (XSS) . The root cause is the lack of input sanitization for tag names; the application passes the displayField value directly to the jQuery .html() property in both the ...

CVE-2026-100174 Stored Cross-Site Scripting (XSS) in AIL Framework Tag Selector via Unescaped Tag Names

The AIL Framework tag selector component var/www/static/js/tags.js is vulnerable to stored cross-site scripting XSS. A user with the ability to create a custom tag could embed an HTML payload containing JavaScript event handlers e.g., or in the tag name. When another authenticated user opened a...

CVE-2026-9811

CVE-2026-9811 CVE-2026-9811 是一个影响 Mautic 7（版本 7.0.0 至 7.1.1）的存储型跨站脚本（Stored XSS）漏洞。该漏洞存在于项目选择器（Project Selector）组件中，通过 AJAX 请求返回的项目名称在未经正确的输出编码或净化处理的情况下被插入到页面中。拥有创建项目权限的已认证用户可以在项目名称中存储恶意 JavaScript 载荷。当其他管理员随后打开包含项目选择器的实体编辑器时，恶意脚本会在其浏览器中执行。 受影响软件 属性 值 产品 Mautic 受影响版本 7.0.0 – 7.1.1 修复版本 7.1.2 组件...

CrazyToolBox

CrazyToolBox 目次 📢 CrazyToolBox とは？ ⚙️ 実行方法 ⭐ 現在の機能 📢 CrazyToolBox とは？ CrazyToolBox は、Web3 に関連する便利なツールのコレクションです。これらのツールは、 CrazyToolBox アプリケーションの GUI を通じてアクセスできます。 今後、開発に伴い CrazyToolBox に新しいツールを追加していく予定です。現時点で利用可能なツールは、以下の 現在の機能 セクションで説明されています。 ⚙️ 実行方法 CrazyToolBox は pipenv を使用して実行できます。まず、pipenv...

essential-addons-for-elementor-xss-poc

🔍 Essential Addons for Elementor XSS脆弱性検出ツール 🚨 重要情報 このツールはセキュリティ研究およびパッチ適用目的のみに使用してください。サイトに害を及ぼすために使用しないでください。脆弱なサイトを見つけた場合は、サイト所有者に責任を持って報告し、直ちに更新してもらうようにしてください。 ⚠️ 脆弱性の詳細 Essential Addons for Elementorにおける反射型XSS脆弱性が、バージョン6.0.15未満を使用している10万以上のウェブサイトに影響を与えます。これには CVE-2025-24752 が割り当てられています。 👉...

CVE-2026-96777

A vulnerability was determined in Forma LMS up to 4.1.43. This impacts the function UserselectorAdmController::getDataTask of the file /appCore/ajax.admserver.php?r=adm/userselector/getData of the component Multi-User-Selector AJAX Endpoint. This manipulation of the argument Name causes sql...

EUVD-2026-85778

A vulnerability was determined in Forma LMS up to 4.1.43. This impacts the function UserselectorAdmController::getDataTask of the file /appCore/ajax.admserver.php?r=adm/userselector/getData of the component Multi-User-Selector AJAX Endpoint. This manipulation of the argument Name causes sql...

CVE-2026-96777

A SQL injection vulnerability exists in Forma LMS versions up to 4.1.43 . The flaw is located in the Multi-User-Selector AJAX Endpoint , specifically within the UserselectorAdmController::getDataTask function of the file /appCore/ajax.adm_server.php?r=adm/userselector/getData. An attacker can ini...

Linux Distros Unpatched Vulnerability : CVE-2026-62866

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go...

CVE-2025-12758

CVE-2025-12758：Validator.js isLength 函数 Unicode 变体选择符绕过漏洞 CVE ID： CVE-2025-12758 CVSS 评分： 8.7（高危） 严重性： 高危 CWE： CWE-792（对一个或多个特殊元素实例的过滤不完整） 发布日期： 2025年11月26日 披露日期： 2025年10月19日 漏洞概述 此漏洞影响 validator npm 包版本 13.15.22。isLength 函数在计算字符串长度时未考虑 Unicode 变体选择符（\uFE0F、\uFE0E），从而导致输入验证不当。 影响 使用 isLength...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in postcss-selector-parser (CVE-2026-9358)

Summary A Regular Expression Denial of Service ReDoS vulnerability in the postcss-selector-parser library CVE-2026-9358 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 7.1.4. Vulnerability Details CVEID:CVE-2026-9358 DESCRIPTION: A vulnerabilit...

Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`

Same panic class as GHSA-m5j3-4634-c2vq and GHSA-m6xr-fvfg-5g64, sister site on the same function. Trigger is any selector ending in whitespace: dasel query 'a ' panics at selector/lexer/tokenize.go:60. The whitespace-skip loop right above lines 55-57 advances p.i to p.srcLen when the input is...

GHSA-65GG-G7RW-6CPC Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`

Same panic class as GHSA-m5j3-4634-c2vq and GHSA-m6xr-fvfg-5g64, sister site on the same function. Trigger is any selector ending in whitespace: dasel query 'a ' panics at selector/lexer/tokenize.go:60. The whitespace-skip loop right above lines 55-57 advances p.i to p.srcLen when the input is...

CVE-2026-95657

A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8. This issue affects the function setCurrentSelectedText of the file changedetectionio/static/js/visual-selector.js of the component Visual Selector. Executing a manipulation of the argument s can lead to cross site...

CVE-2026-95657 dgtlmoon Changedetection.io Visual Selector visual-selector.js setCurrentSelectedText cross site scripting

A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8. This issue affects the function setCurrentSelectedText of the file changedetectionio/static/js/visual-selector.js of the component Visual Selector. Executing a manipulation of the argument s can lead to cross site...

CVE-2026-95657 dgtlmoon Changedetection.io Visual Selector visual-selector.js setCurrentSelectedText cross site scripting

A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8. This issue affects the function setCurrentSelectedText of the file changedetectionio/static/js/visual-selector.js of the component Visual Selector. Executing a manipulation of the argument s can lead to cross site...

CVE-2026-95657

The dgtlmoon Changedetection.io application is vulnerable to cross-site scripting (XSS) in versions up to 0.55.8 . The flaw exists in the setCurrentSelectedText function of the changedetectionio/static/js/visual-selector.js file within the Visual Selector component. A remote attacker can trigger ...

EUVD-2026-84604

A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8. This issue affects the function setCurrentSelectedText of the file changedetectionio/static/js/visual-selector.js of the component Visual Selector. Executing a manipulation of the argument s can lead to cross site...

CVE-2026-95657: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8. This issue affects the function setCurrentSelectedText of the file changedetectionio/static/js/visual-selector.js of the component Visual Selector. Executing a manipulation of the argument s can lead to cross site...

CVE-2024-56264

CVE-2024-56264 WordPress ACF City Selector - 任意ファイルアップロードエクスプロイト CVE-2024-56264 概要 このリポジトリには、WordPress ACF City Selector プラグイン（バージョン = 1.14.0）で見つかった 任意ファイルアップロード 脆弱性である CVE-2024-56264 のエクスプロイトが含まれています。この脆弱性により、攻撃者は脆弱なWordPressインスタンスに 悪意のあるPHPファイル（ウェブシェル） をアップロードし、サーバー上で任意のコマンドを実行できます。 CVE 詳細...