495 matches found
CVE-2026-18119
Concrete CMS versions below 9.5.3 are vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is unsanitized custom style values in the Block Design dialog that are written into page CSS via a DOM sink . An editor-level user can inject a payload that executes script in an administr...
EUVD-2026-77805
Concrete CMS below 9.5.3 did not sanitize custom style values in the Block Design dialog before writing them into page CSS via a DOM sink, permitting stored cross-site scripting. An editor-level user could execute script in an administrator's session and escalate privileges. The Concrete CMS...
Jeg Elementor Kit < 2.5.7 - Unauthenticated Settings Update
The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and including, 2.5.6. Unauthenticated users can use an easily available nonce, obtained from pages edited by the plugin, to update the...
CVE-2022-47447
CVE-2022-47447 POC CSRF - CVE-2022-47447 ⚠️ 仅限教育用途和授权环境使用。 针对CVE-2022-47447漏洞的功能性PoC，该漏洞影响一个易受攻击的WordPress插件，允许对经过身份验证的用户发起跨站请求伪造（CSRF）攻击。 VULNERABLE URL: /wp-admin/admin.php?page=WPAdvancedSearchCallbackStyles...
trellis-cve-2018-6389
trellis-cve-2018-6389 WordPress の load-scripts / load-styles 攻撃（CVE-2018-6389）を緩和します。 目標 なぜ？ 緩和策 なぜやらないのか？ 要件 インストール Trellis WordPress FAQ マネージドホスティングでも使用できますか？ すごいですね。他にもこのような便利なものはありますか？ wp.org にはないのですね。どこで⭐️⭐️⭐️⭐️⭐️のレビューを書けますか？ 代替案 テスト 構文チェック 作者情報 フィードバック 変更履歴 ライセンス 目標 Nginx によって...
stylesmuggler-ioc-toolkit
StyleSmuggler IOC 工具包 — CVE-2026-75650 Magento 零日漏洞 · Adobe Commerce 零日漏洞 · CVE-2026-75650 · APSB26-146 · VULN-39341 · 未认证 RCE · Magento 恶意软件 · Magento 后门清除 · Magento 2.4.9 漏洞 · Rust 植入程序 · GraphQL styles 注入 · PHP Web Shell 社区失陷指标（IOC）、失陷扫描器以及缓解/修补指南，针对 StyleSmuggler （CVE-2026-75650 ）——由 Sansec 于...
CVE-2025-60574
脆弱性発見者とエクスプロイト作成者 Stefano Andreatta & Jacopo Candido Augelli CVE-2025-60574 脆弱性の説明 tQuadra CMS 4.2.1117 に、ローカルファイルインクルージョン（LFI）の脆弱性が確認されました。この問題は、「/styles/」パスに存在し、ユーザーが入力した値を適切にサニタイズできていません。攻撃者は、細工されたGETリクエストを送信することで、基盤となるシステム上の任意のファイルを取得できます。 発見者: Stefano Andreatta & Jacopo Candido Augelli CVSS...
Malicious Package
Overview tailwind-scrollbar-styles is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
MAL-2026-15826 Malicious code in tailwindcss-fluid-styles (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e9b69dc0a9e6eabb685fa4be860fa456d8810c712ab300ff87023d72cf93631 src/index.js executes an evalatob... blob at top level on require. The decoded loader queries Ethereum RPC endpoints for the latest transaction from...
CVE-2026-81772
Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles = 3.0.31 versions...
CVE-2026-81772 WordPress Ninja Forms - Layout & Styles plugin <= 3.0.31 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles = 3.0.31 versions...
EUVD-2026-69930
Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles = 3.0.31 versions...
PT-2026-84691
Name of the Vulnerable Software and Affected Versions Ninja Forms - Layout & Styles versions prior to 3.0.32 Description An unauthenticated PHP Object Injection exists in the plugin. PHP Object Injection is a vulnerability that occurs when untrusted input is passed to the PHP unserialize function...
WordPress Ninja Forms - Layout & Styles plugin <= 3.0.31 - PHP Object Injection vulnerability
WordPress Ninja Forms - Layout & Styles plugin = 3.0.31 - PHP Object Injection vulnerability discovered by Marc-André Beaulieu h3dg3h0g in WordPress Plugin Ninja Forms - Layout & Styles versions = 3.0.31...
MAL-2026-14568 Malicious code in tailwindcss-form-styles (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bf4e5fbd59048a5ab6a5c04ad7c98e7246c9cf57363d95acc84f92d8ca883f4 src/index.js re-exports the legitimate tailwindcss-forms plugin as a working cover, then appends an obfuscator.io-style 0x string-array cipher that...
Malicious code in tailwindcss-form-styles (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bf4e5fbd59048a5ab6a5c04ad7c98e7246c9cf57363d95acc84f92d8ca883f4 src/index.js re-exports the legitimate tailwindcss-forms plugin as a working cover, then appends an obfuscator.io-style 0x string-array cipher that...
CVE-2026-32258
Winter is a free, open-source content management system CMS based on the Laravel PHP framework. From 1.2.10 through 1.2.12, authenticated backend users with the backend.manageeditor permission can store custom Markup Styles that are compiled by the LESS parser and rendered without sanitization on...
CVE-2026-32258 Winter: Stored XSS through Editor Settings custom styles
Winter is a free, open-source content management system CMS based on the Laravel PHP framework. From 1.2.10 through 1.2.12, authenticated backend users with the backend.manageeditor permission can store custom Markup Styles that are compiled by the LESS parser and rendered without sanitization on...
Astra Linux – Vulnerability in Firefox, Thunderbird
When saving a page as a PDF, certain font styles might lead to a potential “use-after-free” crash. This vulnerability affects Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11...