Lucene search
+L

1122531 matches found

NVD
NVD
added 1 hour ago4 views

CVE-2026-17506

The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 notfoundurl tracking parameter in versions up to, and including, 2.15.0. This is due to the getcellcontent function applying urldecode after escurl when rendering the URL column for 404 entries...

7.2CVSS
SaveExploits0References7
ATTACKERKB
ATTACKERKB
added 1 hour ago2 views

CVE-2026-17506

The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 notfoundurl tracking parameter in versions up to, and including, 2.15.0. This is due to the getcellcontent function applying urldecode after escurl when rendering the URL column for 404 entries...

7.2CVSS
SaveExploits0References8
EUVD
EUVD
added 1 hour ago3 views

EUVD-2026-53339

The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 notfoundurl tracking parameter in versions up to, and including, 2.15.0. This is due to the getcellcontent function applying urldecode after escurl when rendering the URL column for 404 entries...

7.2CVSS5.7AI score
SaveExploits0References7
EUVD
EUVD
added 2 hours ago3 views

EUVD-2026-53371

The render-template component of ember-dynamic-render-template addon/components/render-template.js passes its templateString property directly into Ember/Glimmer's compileTemplate from @ember/template-compilation with no sanitization, allow-listing, or validation of the input. Because...

6.1CVSS5.3AI score
SaveExploits0References2
EUVD
EUVD
added 2 hours ago2 views

EUVD-2026-53360

OpenBK7231T's httpfnotaexec src/httpserver/httpfns.c reflects the host query parameter directly into an HTML response via hprintf255request, "OTA requested for %s!", tmpA with no HTML encoding, allowing a crafted URL such as /otaexec?host=alert1 to execute JavaScript in an authenticated admin's...

5.4CVSS5.7AI score
SaveExploits0References1
EUVD
EUVD
added 2 hours ago3 views

EUVD-2026-53359

OpenBK7231T's CHANNELSetLabel src/cmnds/cmdchannels.c stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNELGetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/httpfns.c wit...

8.5CVSS5.5AI score
SaveExploits0References1
NVD
NVD
added 4 hours ago2 views

CVE-2026-71236

Grocy's API request-body parser controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing , , and back to , and & immediately after purification. This...

8.7CVSS
SaveExploits0References1
NVD
NVD
added 4 hours ago4 views

CVE-2026-71233

InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive !! $entity-terms !! resources/views/portal/ninja2020/invoices/includes/terms.blade.php with no HTML sanitization. StoreInvoiceRequest.php only strips newlines from th...

8.7CVSS
SaveExploits0References1
Cvelist
Cvelist
added 4 hours ago6 views

CVE-2026-71249 299Ko: Unauthenticated Reflected XSS in Public Contact Form

299Ko's public contact form plugin/contact/controllers/ContactController.php, home sets raw POST field values name, firstname, email, message into the page template with no sanitization. The template engine's variable output function common/Template.php, showvar echoes values with no...

6.1CVSS
SaveExploits0References1
EUVD
EUVD
added 4 hours ago3 views

EUVD-2026-53309

Grocy's API request-body parser controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing , , and back to , and & immediately after purification. This...

8.7CVSS5.5AI score
SaveExploits0References1
Cvelist
Cvelist
added 4 hours ago7 views

CVE-2026-71236 Grocy: Stored XSS via HTMLPurifier Output Double-Decode

Grocy's API request-body parser controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing , , and back to , and & immediately after purification. This...

8.7CVSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 4 hours ago2 views

CVE-2026-71236

Grocy's API request-body parser controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing , , and & back to , and & immediately after purification. This...

8.7CVSS5.5AI score
SaveExploits0References2
EUVD
EUVD
added 4 hours ago4 views

EUVD-2026-53306

InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive !! $entity-terms !! resources/views/portal/ninja2020/invoices/includes/terms.blade.php with no HTML sanitization. StoreInvoiceRequest.php only strips newlines from th...

8.7CVSS5.5AI score
SaveExploits0References1
CVE
CVE
added 4 hours ago9 views

CVE-2026-71233

CVE-2026-71233 affects InvoiceNinja v5-stable: the client portal renders the invoice/quote terms with Laravel Blade's raw output (resources/views/portal/ninja2020/invoices/includes/terms.blade.php) and no HTML sanitization. StoreInvoiceRequest.php only strips newlines, not HTML purification. An a...

8.7CVSS5.5AI score
SaveExploits0References1
CVE
CVE
added 5 hours ago8 views

CVE-2026-15452

The CVE covers the Smash Balloon Social Photo Feed – Easy Social Feeds Plugin for WordPress. Affected software: WordPress plugin versions up to 6.11.3. Vulnerability: Reflected Cross-Site Scripting via REQUEST_URI Query String caused by insufficient input sanitization and output escaping. Impact:...

4.7CVSS5.7AI score
SaveExploits0References10
EUVD
EUVD
added 5 hours ago4 views

EUVD-2026-53295

The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Query String in all versions up to, and including, 6.11.3 due to insufficient input sanitization and output escaping. This makes it possible for...

4.7CVSS5.7AI score
SaveExploits0References10
NVD
NVD
added 7 hours ago3 views

CVE-2026-70376

Pluck CMS's admin panel relies solely on a Referer-header comparison requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area. When a request carries no Referer/Host information, the...

9.6CVSS
SaveExploits0References1
CVE
CVE
added 8 hours ago13 views

CVE-2026-70376

Pluck CMS has a CSRF risk in the admin panel due to relying solely on Referer-based checks (requestedByTheSameDomain()) with no per-request anti-CSRF token. If Referer/Host is missing, the code treats the request as same-origin, enabling a cross-site attacker page to request forged admin actions....

9.6CVSS5.4AI score
SaveExploits0References1
CVE
CVE
added 8 hours ago5 views

CVE-2026-6972

The CVE-2026-6972 entry concerns the SKT Skill Bar WordPress plugin (

6.4CVSS5.7AI score
SaveExploits0References6
EUVD
EUVD
added 8 hours ago3 views

EUVD-2026-53185

The Simple Yearly Archive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the posttype attribute of the SimpleYearlyArchive shortcode in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This make...

6.4CVSS5.7AI score
SaveExploits0References6
Rows per page
Query Builder