WP DSGVO Tools (GDPR) <= 3.1.22 - Unauthenticated Stored Cross-Site Scripting

The WP DSGVO Tools GDPR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to, and including, 3.1.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2023-44812

CVE-2023-44812 A reflected cross-site scripting XSS vulnerability in the adminredirecturl parameter on user login function of mooSocial v3.1.8 which allows attackers to steal admin's session cookies and impersonate their account via a crafted URL. Vulerable Parameter: adminredirecturl Exploit -...

CVE-2026-124491

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean and execute JavaScript in victims'...

CVE-2026-124491 SunEditor before 3.4.0 Stored XSS via FileUpload Plugin Filename

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean and execute JavaScript in victims'...

CVE-2026-124491 SunEditor before 3.4.0 Stored XSS via FileUpload Plugin Filename

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean and execute JavaScript in victims'...

CVE-2026-124491

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean and execute JavaScript in victims'...

CVE-2026-124491

SunEditor versions prior to 3.4.0 are susceptible to a stored cross-site scripting (XSS) vulnerability within the FileUpload plugin 's create() method. The root cause is the assignment of server-returned file names to innerHTML without proper escaping. Attackers can upload files with malicious, H...

CVE-2026-124491 SunEditor before 3.4.0 Stored XSS via FileUpload Plugin Filename

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean and execute JavaScript in victims'...

EUVD-2026-119546

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean and execute JavaScript in victims'...

PT-2026-140004

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean and execute JavaScript in victims'...

CVE-2026-124491: JiHong88 suneditor: SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method…

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean and execute JavaScript in victims'...

CVE-2025-60374

CVE-2025-60374 CVE-2025-60374: Stored Cross-Site Scripting XSS in Perfex CRM Chatbot ⚠️ Security Advisory A critical Stored Cross-Site Scripting vulnerability in Perfex CRM's chatbot feature 📋 Overview A stored cross-site scripting XSS vulnerability in the chatbot component of Perfex CRM, prior to...

CVE-2023-25292

CVE-2023-25292 Reflected Cross Site Scripting XSS in Intermesh BV Group-Office version 6.6.145, allows attackers to gain escalated privileges and gain sensitive information via the GOLANGUAGE cookie Vulnerability Details Product: Group Office Application Version: 6.6.145 Vulnerability Type:...

CVE-2026-75599

HomeBox is a home inventory and organization system. Prior to 0.27.0, the maybeUrl utility accepts markdown-style links in entity custom-field values without restricting the URL scheme, so an authenticated user can store a javascript: URI that is rendered as a clickable anchor on an item page. Wh...

CVE-2026-75599

The home inventory system HomeBox is vulnerable to a Stored Cross-Site Scripting (XSS) flaw in versions prior to 0.27.0 . The root cause is the maybeUrl() utility, which fails to restrict URL schemes when processing markdown-style links in entity custom-field values . An authenticated attacker ca...

CVE-2026-75599 HomeBox: Stored XSS via `javascript:` URI in Custom Entity Fields

HomeBox is a home inventory and organization system. Prior to 0.27.0, the maybeUrl utility accepts markdown-style links in entity custom-field values without restricting the URL scheme, so an authenticated user can store a javascript: URI that is rendered as a clickable anchor on an item page. Wh...

CVE-2026-75599 HomeBox: Stored XSS via `javascript:` URI in Custom Entity Fields

HomeBox is a home inventory and organization system. Prior to 0.27.0, the maybeUrl utility accepts markdown-style links in entity custom-field values without restricting the URL scheme, so an authenticated user can store a javascript: URI that is rendered as a clickable anchor on an item page. Wh...

EUVD-2026-117167

VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing proof of ownershi...

CVE-2026-54384

VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing proof of ownershi...

CVE-2026-54384

The VitaFit cloud API (prior to 2026-10-30) is vulnerable to an authentication bypass in the POST /front/login/sns/ endpoint. This flaw allows remote attackers to gain a full session for a victim's account by submitting a linked Google or Facebook account identifier without providing proof of own...