CVE-2026-57196

A flaw was found in Asterisk. When phone provisioning resphoneprov is enabled, reflected cross-site scripting in HTTP error pages allows an unauthenticated remote attacker to steal an authorized user's Asterisk Manager Interface AMI session cookie and impersonate that user. Exploitation requires...

CVE-2025-60374

CVE-2025-60374 CVE-2025-60374: Stored Cross-Site Scripting XSS in Perfex CRM Chatbot ⚠️ Security Advisory A critical Stored Cross-Site Scripting vulnerability in Perfex CRM's chatbot feature 📋 Overview A stored cross-site scripting XSS vulnerability in the chatbot component of Perfex CRM, prior to...

CVE-2026-103898

The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.2.2. This is due to the social login REST callback registered at /wp-json/wslu-social-login/type/provider/ with permissioncallback = returntrue...

CVE-2023-25292

CVE-2023-25292 Reflected Cross Site Scripting XSS in Intermesh BV Group-Office version 6.6.145, allows attackers to gain escalated privileges and gain sensitive information via the GOLANGUAGE cookie Vulnerability Details Product: Group Office Application Version: 6.6.145 Vulnerability Type:...

CVE-2023-44812

CVE-2023-44812 A reflected cross-site scripting XSS vulnerability in the adminredirecturl parameter on user login function of mooSocial v3.1.8 which allows attackers to steal admin's session cookies and impersonate their account via a crafted URL. Vulerable Parameter: adminredirecturl Exploit -...

PT-2026-134510

Name of the Vulnerable Software and Affected Versions WebDyne versions 2.014 through 3.021 Description WebDyne for Perl issues session cookies that lack the Secure, HttpOnly, and SameSite attributes. The WebDyne::Session component sets session cookies using only a name, value, and path. This allo...

CVE-2026-61804 myTinyWMS has Stored Cross-Site Scripting (XSS) in Product and Category Management

myTinyWMS is a free, open-source warehouse management system. Prior to version 1.6.4, Product Artikel and Category management store the name parameter without adequate backend sanitization and render raw database strings through unescaped Blade output in dynamic table cells, including...

CVE-2026-61804

The myTinyWMS warehouse management system (versions prior to 1.6.4 ) is vulnerable to Stored Cross-Site Scripting (XSS) within the Product (Artikel) and Category management modules. The root cause is the lack of backend sanitization for the name parameter, which is subsequently rendered as unesca...

CVE-2026-61804 myTinyWMS has Stored Cross-Site Scripting (XSS) in Product and Category Management

myTinyWMS is a free, open-source warehouse management system. Prior to version 1.6.4, Product Artikel and Category management store the name parameter without adequate backend sanitization and render raw database strings through unescaped Blade output in dynamic table cells, including...

EUVD-2026-114254

myTinyWMS is a free, open-source warehouse management system. Prior to version 1.6.4, Product Artikel and Category management store the name parameter without adequate backend sanitization and render raw database strings through unescaped Blade output in dynamic table cells, including...

CVE-2026-91914

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Authentication Bypass by Spoofing vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Session theft...

CVE-2026-91914

Dell OpenManage Enterprise, versions prior to 4.8.0 , is vulnerable to an Authentication Bypass by Spoofing vulnerability (CWE-290). An unauthenticated attacker with adjacent network access can exploit this flaw to perform Session theft . No specific exploit details or remediation steps are provi...

EUVD-2026-113943

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Authentication Bypass by Spoofing vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Session theft...

CVE-2026-91914

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Authentication Bypass by Spoofing vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Session theft...

PT-2026-133566

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Authentication Bypass by Spoofing vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Session theft...

CVE-2026-61804: myTinyWMS: myTinyWMS is a free, open-source warehouse management system

myTinyWMS is a free, open-source warehouse management system. Prior to version 1.6.4, Product Artikel and Category management store the name parameter without adequate backend sanitization and render raw database strings through unescaped Blade output in dynamic table cells, including...

CVE-2026-66912

Zimbra is vulnerable to Stored Cross-Site Scripting XSS via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containing a malicious From header with an embedded JavaScript...

CVE-2026-111739

The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security AIOS WordPress plugin before 5.5.0 do not bind the account whose two-factor code is verified to the account being authenticated, allowing an attacker who knows a victim's password and holds their own...

CVE-2026-116874

SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unescaped default parameter in JsonResultPrinter. Attackers can lure victims to a crafted Special:Ask link with a zero-result query...

CVE-2026-116875

SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in Special:Ask, which outputs separator parameters sep, propsep, valuesep, delim, separator without HTML escaping in list, category, DSV, and CSV result printers. Unauthenticated attackers can send...