firefox: Privilege escalation in the Remote Settings Client component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the Remote Settings Client component...

firefox: Privilege escalation in the Remote Settings Client component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the Remote Settings Client component...

CVE-2026-86416

ILIAS is an e-learning platform affected by an authorization bypass in the ilObjGroupGUI component prior to versions 9.23, 10.11, and 11.4 . The methods saveMapSettingsObject() and updateGroupTypeObject() perform state-changing operations without verifying write permissions, allowing any authenti...

CVE-2026-86416 ILIAS before 9.23, 10.11, and 11.4 Missing Authorization in Group Object Action Methods

ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject and updateGroupTypeObject perform state-changing operations without write permission checks. Authenticated users with only read access to a group can craft POST...

CVE-2026-86416 ILIAS before 9.23, 10.11, and 11.4 Missing Authorization in Group Object Action Methods

ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject and updateGroupTypeObject perform state-changing operations without write permission checks. Authenticated users with only read access to a group can craft POST...

CVE-2026-86294

A vulnerability has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this issue is some unknown functionality of the file save-settings.php of the component Settings Update Endpoint. The manipulation of the argument sitename/sitedesc leads to cross site scripting. Remot...

CVE-2026-86294 SourceCodester Simple Traffic Offense System Settings Update Endpoint save-settings.php cross site scripting

A vulnerability has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this issue is some unknown functionality of the file save-settings.php of the component Settings Update Endpoint. The manipulation of the argument sitename/sitedesc leads to cross site scripting. Remot...

CVE-2026-86294 SourceCodester Simple Traffic Offense System Settings Update Endpoint save-settings.php cross site scripting

A vulnerability has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this issue is some unknown functionality of the file save-settings.php of the component Settings Update Endpoint. The manipulation of the argument sitename/sitedesc leads to cross site scripting. Remot...

EUVD-2026-72342

A vulnerability has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this issue is some unknown functionality of the file save-settings.php of the component Settings Update Endpoint. The manipulation of the argument sitename/sitedesc leads to cross site scripting. Remot...

PT-2026-86766

Name of the Vulnerable Software and Affected Versions ILIAS versions prior to 9.23 ILIAS versions prior to 10.11 ILIAS versions prior to 11.4 Description An authorization bypass exists in the ilObjGroupGUI component. The functions saveMapSettingsObject and updateGroupTypeObject execute...

PT-2026-86678

A vulnerability has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this issue is some unknown functionality of the file save-settings.php of the component Settings Update Endpoint. The manipulation of the argument site name/site desc leads to cross site scripting...

CVE-2026-86437: Incorrect Authorization

Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive...

PT-2026-86627

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/settings edit.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to...

CVE-2026-86294: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this issue is some unknown functionality of the file save-settings.php of the component Settings Update Endpoint. The manipulation of the argument sitename/sitedesc leads to cross site scripting. Remot...

PT-2026-86507

The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into an action's settings and then processes those settings for shortcodes, allowing unauthenticated users to run...

EUVD-2026-71946

Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including instance-wide defaults. Attackers can inject malicious container configurations with privileged settings or host path mounts th...

CVE-2026-85414 Gallery : FooGallery <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute

The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'customsettings' Shortcode Attribute in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-82846

The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape some course settings before outputting them in a page available to all visitors, allowing users with a course-author role to perform Stored Cross-Site Scripting attacks that run in the session of anyone viewing the cours...

CVE-2025-15694

The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability ...

CVE-2026-84935

The HT Menu WordPress plugin (versions before 1.2.7 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The vulnerability exists because the plugin fails to perform capability or object-ownership checks when saving navigation menu-item settings and fails to escape stored settings during ...