Sakai Conversations has a Stored XSS Issue

Summary The Sakai Conversations tool stores topic and post messages without HTML sanitization, and the frontend renders them using LitElement's unsafeHTML directive, resulting in stored cross-site scripting XSS. Any authenticated user with access to a site that has the Conversations tool enabled...

CVE-2023-6000-POC

Dettagli Generali CVE-ID : CVE-2023-6000 Punteggio CVSS : 6.1 Tipo : XSS Memorizzato Stored XSS Versione Risolta : Popup Builder 4.2.3 Questa vulnerabilità consente a un attaccante di sfruttare una falla di Cross-Site Scripting XSS nel plugin WordPress Popup Builder. Il plugin non impedisce ai...

CVE-2025-25460

FlatPress CMS Gespeichertes XSS in v1.3.1 CVE-2025-25460 Autor: Athul S Beschreibung Eine gespeicherte Cross-Site Scripting XSS Sicherheitslücke wurde in FlatPress 1.3.1 in der "Add Entry" Funktion identifiziert. Diese Sicherheitslücke erlaubt es authentifizierten Angreifern , bösartige...

CVE-2025-65676

CVE-2025-65676 Vulnerabilità di Stored Cross-Site Scripting XSS in Classroomio LMS 0.1.13 consente ad attaccanti autenticati di eseguire codice arbitrario tramite immagini di copertina SVG appositamente create. Scoperta da - Rivek Raj Tamang RivuDon, Sikkim, India. Prodotto interessato: Classroom...

CVE-2025-65675

CVE-2025-65675 Stored Cross site scripting XSS Schwachstelle in Classroomio LMS 0.1.13 erlaubt authentifizierten Angreifern, beliebigen Code über manipulierte SVG-Profilbilder auszuführen. Entdeckt von - Rivek Raj Tamang RivuDon, Sikkim, Indien. Betroffenes Produkt: ClassroomIO Betroffene Version...

CVE-2026-78541

A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attacker with administrative access may store a crafted profile name containing shell metacharacters, which is later processed unsafely during daily cloud report...

CVE-2026-10104-POC

CVE-2026-10104: Cross-Site Scripting Armazenado em Product Video Gallery para WooCommerce Resumo...

CVE-2026-40791-WP-Time-Slots-Booking-Form-XSS

CVE-2026-40791: Um Slot de Reserva para XSS de Administrador Encontrei um XSS armazenado não autenticado no plugin WordPress WP Time Slots Booking Form. Uma submissão pública de reserva controla parte do valor armazenado do horário slot. O plugin posteriormente imprime esse valor na página de...

EUVD-2026-65062

A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attacker with administrative access may store a crafted profile name containing shell metacharacters, which is later processed unsafely during daily cloud report...

CVE-2026-78541 Command Injection in Parent Control of TP-Link Archer BE3600 v1

A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attacker with administrative access may store a crafted profile name containing shell metacharacters, which is later processed unsafely during daily cloud report...

AdTran-Personal-Phone-Manager-Vulns

AdTran-Personal-Phone-Manager-Vulns Un repository che ospita write-up per le vulnerabilità zero-day CVE-2021-25679, CVE-2021-25680 e CVE-2021-25681. Riepilogo CVE-2021-25679: Adtran Personal Phone Manager XSS Memorizzato Autenticato nel modulo di modifica dell'indirizzo email CVE-2021-25680: Adtr...

CVE-2025-65754

CVE-2025-65754 : Gespeichertes XSS in Algernon 1.17.4 Beschreibung Algernon v1.17.4 ist von einer Cross-Site-Scripting XSS-Sicherheitslücke betroffen, die es Angreifern ermöglicht, über eine manipulierte Nutzlast in einem Dateinamen beliebigen Code auszuführen. Betroffenes Projekt : Algernon -...

CVE-2026-76837 Baserow before 2.3.0 Stored Cross-Site Scripting via Rich Text Mention Display Name

Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/account/ stores the firstname value verbatim, and the mention renderer in web-frontend/modules/core/editor/mention.js builds its element with a template literal that places the name...

CVE-2026-76837 Baserow before 2.3.0 Stored Cross-Site Scripting via Rich Text Mention Display Name

Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/account/ stores the firstname value verbatim, and the mention renderer in web-frontend/modules/core/editor/mention.js builds its element with a template literal that places the name...

CVE-2026-76837

Baserow before 2.3.0 is vulnerable to stored cross-site scripting via the rich-text mention feature. The display name set through PATCH /api/user/account/ is interpolated without HTML encoding into the mention element built in mention.js. A name containing a double quote breaks out of the data-la...

EUVD-2026-65009

Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/account/ stores the firstname value verbatim, and the mention renderer in web-frontend/modules/core/editor/mention.js builds its element with a template literal that places the name...

CVE-2026-76837 Baserow before 2.3.0 Stored Cross-Site Scripting via Rich Text Mention Display Name

Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/account/ stores the firstname value verbatim, and the mention renderer in web-frontend/modules/core/editor/mention.js builds its element with a template literal that places the name...

CVE-2026-76564

XSS memorizzato tramite User-Agent nella vista dell'ordine dell'amministratore in PhocaCart PhocaCart ≤ 6.1.7 — Un attaccante non autenticato memorizza un payload XSS tramite il checkout. Si esegue nel contesto del browser dell'amministratore SOMMARIO PhocaCart 6.1.7 per Joomla memorizza l'header...

CVE-2023-44763_ConcreteCMS-Arbitrary-file-upload-Thumbnail

ConcreteCMS XSS Armazenado v.9.2.1 Autor: Sergio Descrição: O ConcreteCMS v9.2.1 é afetado por uma vulnerabilidade de Upload Arbitrário de Arquivos que permite Cross-Site Scripting XSS armazenado. Vetores de Ataque: Uma vulnerabilidade na sanitização do upload de arquivos "Thumbnail" permite...

CVE-2026-74252

XSS Armazenado no Checkout de Convidado do J2Commerce via Bypass do Filtro de Cookie J2Commerce comj2store ≤ 4.1.5 — Atacante não autenticado armazena payload XSS que é executado automaticamente no navegador do administrador ao carregar a página RESUMO O J2Commerce 4.1.5 é vulnerável a Cross-Site...