CVE-2026-17032

Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites...

CVE-2026-17032 Supsystic Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server

Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites...

CVE-2026-14812: Hidden Functionality

The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enables remote code execution, server-side request forgery and arbitrary front-end script/content injection, giving an unauthenticated attacker...

CVE-2026-17032: Hidden Functionality

Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites...

Plone 5.2.3 XSS

The version of Plone installed on the remote host is 5.2.3. It is, therefore, affected by a stored cross-site scripting XSS vulnerability within the site-controlpanel due to improper validation of user-supplied input before returning it to users. An authenticated, remote attacker can exploit this...

CVE-2026-10735 ShapedPlugin Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server

Multiple Shapedsmart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 Pro smart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Produ...

CVE-2021-29002

A stored cross-site scripting XSS vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the "form.widgets.sitetitle" parameter...

Hackers Exploiting WP-Automatic Plugin Bug to Create Admin Accounts on WordPress Sites

Threat actors are attempting to actively exploit a critical security flaw in the ValvePress Automatic plugin for WordPress that could allow site takeovers. The shortcoming, tracked as CVE-2024-27956, carries a CVSS score of 9.9 out of a maximum of 10. It impacts all versions of the plugin prior t...

PYSEC-2021-889

A stored cross-site scripting XSS vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the "form.widgets.sitetitle" parameter...

CVE-2021-29002

A stored cross-site scripting XSS vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the "form.widgets.sitetitle" parameter...

PYSEC-2021-889

A stored cross-site scripting XSS vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the "form.widgets.sitetitle" parameter...

Apache Atlas CVE-2019-10070 HTML Injection Vulnerability

Description Apache Atlas is prone to an HTML injection vulnerability because it fails to sanitize user-supplied input. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based...

Design/Logic Flaw

DISPUTED The Netdata web application through 1.13.0 allows remote attackers to inject their own malicious HTML code into an imported snapshot, aka HTML Injection. Successful exploitation will allow attacker-supplied HTML to run in the context of the affected browser, potentially allowing the...

CVE-2018-19853

An issue was discovered in hitshop through 2014-07-15. There is an elevation-of-privilege vulnerability that allows control over the whole web site via the admin.php/user/add URI because a storekeeper account which is supposed to have only privileges for commodity management can add an...

CVE-2018-14939

The getapppath function in desktop/unx/source/start.c in LibreOffice through 6.0.5 mishandles the realpath function in certain environments such as FreeBSD libc, which might allow attackers to cause a denial of service buffer overflow and application crash or possibly have unspecified other impac...

MyBB has multiple vulnerabilities (CNVD-2016-11618)

MyBB aka MyBulletinBoard is a free and web-based forum software developed by MyBB team using PHP and MySQL. The software is characterized by its simplicity, multi-language support and extensibility. Multiple security vulnerabilities exist in versions of MyBB prior to 1.8.8 including: SQL injectio...

MyBB has multiple vulnerabilities (CNVD-2016-11616)

MyBB aka MyBulletinBoard is a free and web-based forum software developed by MyBB team using PHP and MySQL. The software is characterized by its simplicity, multi-language support and extensibility. Multiple security vulnerabilities exist in versions of MyBB prior to 1.8.8 including: SQL injectio...

Cloudera Manager has multiple vulnerabilities

Cloudera Manager is a set of Hadoop data management software from Cloudera, USA. The software supports the creation of clusters, authentication, data backup and recovery and so on. Cloudera Manager suffers from HTML injection and cross-site scripting vulnerabilities. An attacker exploiting the...

Xiangtan Times Information Technology Co., Ltd. website building system has arbitrary file upload vulnerability

Xiangtan Times Information Technology Co., Ltd. is an IT application service company, providing IT application services and e-commerce solutions. Xiangtan Times Information Technology Co., Ltd. website building system has an arbitrary file upload vulnerability, which can upload script files to...

File Upload Vulnerability in Real Estate Information Network System

Real Estate Information Network System is a software package that introduces real estate information. The product suffers from a file upload vulnerability, which can be exploited by an attacker to upload arbitrary files and thus gain control of the website...