CVE-2026-108725 Cheshire Cat AI core through 2.0.23 Stored XSS via uploads plugin

Cheshire Cat AI core through 2.0.23 contains a stored cross-site scripting vulnerability in the uploads plugin that allows authenticated users to upload HTML files via POST /uploads without type restrictions. Attackers can send the public GET /uploads/path URL to a signed-in victim, executing...

CVE-2026-108725

The Cheshire Cat AI core (versions through 2.0.23 ) contains a stored cross-site scripting (XSS) vulnerability within the uploads plugin . The root cause is a lack of file type restrictions, allowing authenticated users to upload HTML files via POST /uploads. An attacker can then trick a signed-i...

CVE-2026-108722

The open-computer-use project (specifically through commit 610bac8) is vulnerable to a stored cross-site scripting (XSS) flaw. The issue resides in the Logger.write_log_file function within os_computer_use/logging.py, which fails to perform HTML escaping when writing transcript text into log.html...

CVE-2026-108722 open-computer-use through commit 610bac8 Stored XSS via log.html Session Log

open-computer-use through commit 610bac8 contains a stored cross-site scripting vulnerability in Logger.writelogfile in oscomputeruse/logging.py, which writes transcript text into log.html without HTML escaping. Attackers controlling sandbox content, such as web pages or files appearing in...

CVE-2026-96227

The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is...

CVE-2026-88905

The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector...

CVE-2026-88826

The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJAX action that stores gallery data, and does not sanitise or escape that data before outputting it, allowing unauthenticated users to store arbitrary web scripts that execute when an administrator...

CVE-2026-87764

The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to, nor does it escape message content before outputting it back, allowing unauthenticated users to store arbitrary web scripts that will execute...

CVE-2026-87760

The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated visitors before storing them and outputting them in a script context on an administrative page, allowing unauthenticated attackers to perform Stored Cross-Site...

CVE-2026-87761

The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticated user to overwrite its site-wide configuration, and does not escape those configuration values before printing them inside an inline script block on ever...

CVE-2026-84258

The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

CVE-2026-84259

The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

CVE-2026-84260

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

CVE-2026-84261

The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

CVE-2026-81649

The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credential that is identical on every installation, allowing unauthenticated attackers to disclose the store's payment credentials and customer ord...

CVE-2026-81153

The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image settings before outputting them in a gallery page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the...

CVE-2026-81154

The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before outputting it in one of its gallery layouts, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected...

CVE-2026-81155

The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting before outputting it on a frontend page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing a gallery, includi...

CVE-2026-103305

The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators and site visitors...

SharpDecryptPwd

SharpDecryptPwd لم يعد هذا المشروع مُحدَّثًا، مشروع إعادة هيكلة الشفرة المصدرية أدناه https://github.com/RowTeam/SharpDecryptPwd مقدمة يقوم بتحليل بعض البرامج التي تحفظ كلمات المرور على نظام Windows، بما في ذلك: Navicat, TeamViewer, FileZilla, WinSCP, سلسلة منتجات Xmanager Xshell, Xftp. طريقة...