CVE-2026-26952

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions 6.4 and below are vulnerable to stored HTML injection through the local DNS records configuration page, which allows an authenticated administrator to inject cod...

CVE-2026-0102

Under specific conditions, a malicious webpage may trigger autofill population after two consecutive taps, potentially without clear or intentional user consent. This could result in disclosure of stored autofill data such as addresses, email, or phone number metadata...

WordPress Allow HTML in Category Descriptions plugin <= 1.2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Category Descriptions vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting via Category Descriptions vulnerability discovered by ZAST.AI - ZAST.AI in WordPress Plugin Allow HTML in Category Descriptions versions = 1.2.4...

CVE-2026-25514 FacturaScripts has SQL Injection vulnerability in Autocomplete Actions

FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the autocomplete functionality that allows authenticated attackers to extract sensitive data from the database including...

CVE-2025-57796

Explorance Blue versions prior to 8.14.12 use reversible symmetric encryption with a hardcoded static key to protect sensitive data, including user passwords and system configurations. This approach allows stored values to be decrypted offline if the encrypted data are obtained...

CVE-2025-69025 WordPress Poptics plugin <= 1.0.20 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Aethonic Poptics poptics allows Retrieve Embedded Sensitive Data.This issue affects Poptics: from n/a through = 1.0.20...

EUVD-2025-204565

pluginsGLPI's Database Inventory Plugin "manages" the Teclib' inventory agents in order to perform an inventory of the databases present on the workstation. Prior to version 1.1.2, in certain conditions database write access must first be obtained through another vulnerability or misconfiguration...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via widget URLs in the skywalking-ui component. An attacker can execute arbitrary scripts in the context of a user's browser by injecting malicious content into stored data that is later rendered in the web...

CVE-2025-13383 Job Board by BestWebSoft <= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via $_GET Array Storage

The Job Board by BestWebSoft plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.2.1. This is due to the plugin storing the entire unsanitized $GET superglobal array directly into the database via updateusermeta when users save search results,...

CVE-2025-11843 Therefore™ Online and Therefore™ On-Premises contains an account impersonation issue, which could potentially allow the attacker to access all the stored data

Therefore Corporation GmbH has recently become aware that Therefore™ Online and Therefore™ On-Premises contain an account impersonation vulnerability. A malicious user may potentially be able to impersonate the web service account or the account of a service using the API when connecting to the...

CVE-2025-62656

CVE-2025-62656 concerns a stored XSS in the Wikimedia Foundation MediaWiki GlobalBlocking extension. The connected sources confirm the vulnerability arises from improper neutralization of input during web page generation, enabling stored cross-site scripting. Affected versions are MediaWiki Globa...

CVE-2025-62646

The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to review the stored audio of conversations between associates and Drive Thru customers...

EUVD-2021-24029

Malware in sbrugna...

EUVD-2021-14215

Malware in sbrugna...

EUVD-2018-18138

Malware in sbrugna...

Linux Distros Unpatched Vulnerability : CVE-2021-36399

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Moodle, ID numbers displayed in the quiz override screens required additional sanitizing to prevent a stored XSS risk. CVE-2021-36399 Note that Nessus relies...

CVE-2025-48315

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in stanton119 WordPress HTML custom-html-bodyhead allows Stored XSS.This issue affects WordPress HTML: from n/a through = 0.51...

Linux Distros Unpatched Vulnerability : CVE-2020-25722

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker could use this flaw to cause total doma...

Linux Distros Unpatched Vulnerability : CVE-2019-7336

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Self - Stored Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, as the view monitorfilters.php contains takes in input from the user and saves it in...

CVE-2025-41689 Wiesemann & Theis: Motherbox 3 allows unauthenticated read-only DB access

An unauthenticated remote attacker can get access without password protection to the affected device. This enables the unprotected read-only access to the stored measurement data...