1213191 matches found
CVE-2026-76794 MongoDB BI Connector Transition Readiness Report Improper HTML Encoding When Processing Database Metadata
MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce crafted metadata that may cause script code to run when another user generates and opens the report, potentially exposing report...
CVE-2024-50803-Redaxo
CVE-2024-50803 Stored XSS in der Mediapool-Funktion von Redaxo In Redaxo-Versionen 5.18.0 wurde eine gespeicherte Cross-Site-Scripting XSS-Schwachstelle gefunden, die es Angreifern mit ausreichenden Berechtigungen ermöglicht, eine schädliche SVG-Datei über die Mediapool-Funktion hochzuladen...
CVE-2026-55247 plone.app.event: Denial of service via iCalendar import
plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported events, and commits work per...
cve-2019-10070-apache-atlas-xss
Questo repository non contiene un README...
XSS2Shell-CVE-2026-64638
Questo repository non contiene un README...
CVE-2024-24135
CVE-2024-24135: Produktbestand mit Export nach Excel - Cross-Site-Scripting Proof of ConceptPoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-24135.md Proof of ConceptPoC : https://github.com/BurakSevben/CVE-2024-24135/blob/main/CVE-2024-24135.md...
CVE-2026-21013-PDF-JavaScript-Injection-via-Embedded-Script
CVE-2026-21013 – एम्बेडेड स्क्रिप्ट के माध्यम से PDF JavaScript इंजेक्शन प्रोग्राम कोड Python जो दुर्भावनापूर्ण PDF जनरेट करता है root@kitploit: generatepdfjsinject.py - Creates a PDF with embedded JavaScript pdf = b"""%PDF-1.7 1 0 obj endobj trailer %%EOF """ with open"malicious.pdf", "wb" as f:...
EUVD-2026-67845
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts without checking registered plugin...
CVE-2025-25296
CVE-2025-25296 Prova di concetto POC Descrizione Questo progetto dimostra una prova di concetto POC per la vulnerabilità CVE-2025-25296 che colpisce Label Studio, uno strumento open-source per l'etichettatura dei dati. La vulnerabilità risiede nell'endpoint /projects/upload-example, che non riesc...
CVE-2024-55976
CVE-2024-55976 Critical Site Intel = 1.0 - Iniezione SQL non autenticata Descrizione Il plugin Critical Site Intel per WordPress è vulnerabile a SQL Injection nelle versioni fino alla 1.0 inclusa, a causa di un escaping insufficiente sul parametro fornito dall'utente e della mancanza di una...
CVE-2026-51565
CVE-2026-51565 Avviso di sicurezza per CVE-2026-51565 Descrizione La vulnerabilità di cross-site scripting XSS in Modules/Docs/DocsController.php in Milk admin =0.9.8 consente ad attaccanti remoti di iniettare script web o HTML arbitrari tramite il parametro action in una richiesta appositamente...
CVE-2025-64095---DNN-Unauthenticated-arbitrary-file-upload
CVE-2025-64095---DNN-Unauthenticated-arbitrary-file-upload POC di DNN Insufficient Access Control - Image Upload permette la sovrascrittura dei contenuti del sito Sono un uomo semplice, vedo cvss:10/10 e ci vado xD Ho visto questa nuova CVE CVE-2025-64095 DNN Insufficient Access Control - Image...
CVE-2026-6176
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the aggregated review form submission in versions up to and including 5.106.0. This is due to insufficient input sanitization and output escaping on user-supplied review comment text. The...
CVE-2026-5953
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Ceviz Informatics Inc. Web Design allows Reflected XSS. This issue affects Web Design: through 25082026...
CVE-2026-27621
CVE-2026-27621: TypiCMS Core presenta Cross-Site Scripting XSS Memorizzato tramite Caricamento File SVG Panoramica...
CVE-2026-24415
CVE-2026-24415: OpenSTAManager Affected by XSS in modificaiva.php via righe parameter Panoramica...
CVE-2026-13156
CVE-2026-13156 — Integrazione SMTP Ufficiale MailerSend !IMPORTANT Abstract: È stata scoperta una vulnerabilità di Cross-Site Request Forgery CSRF ad alta severità CVE-2026-13156 nel plugin ufficiale MailerSend SMTP Integration per WordPress 1.0.8. L'handler di cancellazione della configurazione...
CVE-2026-4378 Stored XSS in Akıllı Ticaret's E-Commerce Pack
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Akilli Ticaret Software Technologies Ltd. E-Commerce Pack allows Stored XSS. This issue affects E-Commerce Pack: from 4.5.001 through 28082026. NOTE: The vendor was contacted early about this...
CVE-2024-54369
CVE-2024-54369 Zita Site Builder = 1.0.2 - Autorizzazione mancante per l'installazione arbitraria di plugin Descrizione Il plugin Zita Site Builder per WordPress è vulnerabile all'accesso non autorizzato alle funzionalità a causa di un controllo delle capability mancante su una delle sue funzioni...
