8895 matches found
WordPress < 4.8.2 - Authenticated Open Redirect
WordPress versions before 4.8.2 contain an open redirect caused by improper validation in wp-admin/edit-tag-form.php and wp-admin/user-edit.php, letting attackers redirect users to malicious sites, exploit requires access to admin interface. id: CVE-2017-14725 info: name: WordPress 4.8.2 -...
Xinuo Openserver 5/6 - Cross-Site scripting
Xinuo formerly SCO Openserver versions 5 and 6 allows remote attackers to inject arbitrary web script or HTML tag via the parameter 'section' and is vulnerable to reflected cross-site scripting. id: CVE-2020-25495 info: name: Xinuo Openserver 5/6 - Cross-Site scripting author: 0xAkoko severity:...
CVE-2026-41846
CVE-2026-41846...
EUVD-2026-64262
WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in objects/videoEditLight.php that lacks request authenticity checks and accepts GET requests. Attackers can store an img tag in a video description that transfers video ownership to an attacker-controlled...
CVE-2026-14325
The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbitrary web scripts that execute on any front-end page...
CVE-2026-14325 Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Admin+ Stored XSS via drag_n_drop_heading_tag Setting
The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbitrary web scripts that execute on any front-end page...
EUVD-2026-63502
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in eventtagging.c when decodetaginternal requests at most five bytes from evbufferpullup but iterates using the full logical buffer length. A fragmented evbuffer...
CVE-2026-63383 Libevent: decode_tag_internal() can lead to out-of-bounds read
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in eventtagging.c when decodetaginternal requests at most five bytes from evbufferpullup but iterates using the full logical buffer length. A fragmented evbuffer...
CVE-2026-76833 @cgauge/yaml npm Package Arbitrary Code Execution via eval() YAML Tag
@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary JavaScript by embedding a custom !js YAML tag whose construct callback unconditionally calls eval on attacker-supplied string values during document parsing. Any application...
CVE-2026-76833
The @cgauge/yaml npm package has a custom YAML tag handler that unconditionally calls eval() on attacker-supplied string values during document parsing. Any application that parses untrusted YAML with this library exposes full Node.js runtime authority — environment variables, filesystem read/wri...
EUVD-2026-63350
@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary JavaScript by embedding a custom !js YAML tag whose construct callback unconditionally calls eval on attacker-supplied string values during document parsing. Any application...
CVE-2026-76833 @cgauge/yaml npm Package Arbitrary Code Execution via eval() YAML Tag
@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary JavaScript by embedding a custom !js YAML tag whose construct callback unconditionally calls eval on attacker-supplied string values during document parsing. Any application...
CVE-2026-76610
Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized tag modifications by unauthenticated users...
CVE-2026-76610
Zoo (a Joomla extension by YOOtheme ) versions prior to 4.1.65 contain an access control flaw in the comment controller endpoint . The endpoint lacked ACL checks, enabling unauthenticated users to modify tags remotely over the network with no user interaction required. The CVSS 4.0 base score is ...
EUVD-2026-63237
Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized tag modifications by unauthenticated users...
CVE-2026-76610 Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65
Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized tag modifications by unauthenticated users...
CVE-2026-76610 Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65
Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized tag modifications by unauthenticated users...
MINI-WRC6-9CMQ-QH8G
Bulletin has no description...
