CVE-2024-5961

CVE-2024-5961 Reflected XSS in 2ClickPortal Version: from 7.2.31 through 7.6.4. intext:"Powered by 2ClickPortal" PoC https://domain/szukaj/?searchlang=pl&search=all&string=" onfocus=alert1 autofocus="...

CVE-2024-1112

CVE-2024-1112 This is a PoC, I wrote for "ResHacker.exe" Heap overflow vulnerability. Usage Execute CVE-2024-1112.py, copy all string at created payload.txt then use it to as parameter to open ResHacker.exe ResHacker.exe $string NOTE: Don't forget the find correct address - You can find full...

CVE-2026-110910

The qs library (versions >=6.12.0

CVE-2026-110910 qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection

Summary qs.stringify with allowEmptyArrays: true writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains & or the configured delimiter, =, or therefore becomes query string syntax instead of data, so a caller-supplied key name can add...

CVE-2026-110910 qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection

Summary qs.stringify with allowEmptyArrays: true writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains & or the configured delimiter, =, or therefore becomes query string syntax instead of data, so a caller-supplied key name can add...

CVE-2026-88020

Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to route the program based on a query string parameter with no encoding...

CVE-2026-88020

Autonomy Logic OpenPLC Runtime v3 is susceptible to an improper neutralization of input during web page generation vulnerability. This occurs because the web interface fails to encode a query string parameter used for program routing. Successful exploitation could allow an attacker to hijack sess...

CVE-2026-88020 Improper Neutralization of Input During Web Page Generation in OpenPLC Runtime v3

Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to route the program based on a query string parameter with no encoding...

EUVD-2026-84871

Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to route the program based on a query string parameter with no encoding...

CVE-2026-88020: Improper Neutralization of Input During Web Page Generation

Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to route the program based on a query string parameter with no encoding...

CVE-2026-92554

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query-String Parameter Name in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it...

EUVD-2026-82747

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query-String Parameter Name in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-92554 ShopLentor <= 3.5.1 - Reflected Cross-Site Scripting via Query-String Parameter Name

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query-String Parameter Name in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-92554: Improper Neutralization of Input During Web Page Generation

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query-String Parameter Name in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it...

PT-2026-95300

Name of the Vulnerable Software and Affected Versions ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin versions prior to 3.5.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occur...

CVE-2026-75164

An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to retrieve arbitrary files from the device filesystem via the file query string parameter...

CVE-2026-75164

The MBS-Solutions X-Serie Gateway is affected by an arbitrary file read vulnerability in the /cgi-bin/ugwdownload.cgi component of firmware version V6_00_05 . A remote authenticated user with a low-privileged Standard role can exploit this by using the file query string parameter to retrieve arbi...

CVE-2026-75164

An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to retrieve arbitrary files from the device filesystem via the file query string parameter...

CVE-2026-75164

An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to retrieve arbitrary files from the device filesystem via the file query string parameter...

PT-2026-78432

Name of the Vulnerable Software and Affected Versions HumHub Community Edition version 1.18.4 Description A reflected cross-site scripting issue exists in the Space membership-request workflow. An attacker can inject malicious button configuration into the options query-string parameter of the...