CVE-2026-103443 API permits session-seeded javascript URL XSS

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki Collection Book extension allows XSS Targeting Non-Script Elements. This issue affects MediaWiki Collection Book extension: 1.46, 1.45, and 1.43...

Linux Distros Unpatched Vulnerability : CVE-2026-97711

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values...

CVE-2026-97711

A flaw was found in serialize-javascript. This vulnerability allows a remote attacker to conduct Cross-Site Scripting XSS attacks by supplying crafted function code containing unescaped script-closing tags. When the serialized function is embedded within an HTML script element, the unescaped tag...

CVE-2026-100241

The Wikimedia Foundation Mediawiki - EventBus Extension (version 1.47.0-alpha ) is vulnerable to an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. Specifically, private change tags are exposed to anonymous users via revision-tags-change events . This flaw allows for the...

CVE-2026-100241 Private change tags exposed to anonymous users via revision-tags-change events

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - EventBus Extension allows Excavation. This issue affects Mediawiki - EventBus Extension: 1.47.0-alpha...

CVE-2026-100241 Private change tags exposed to anonymous users via revision-tags-change events

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - EventBus Extension allows Excavation. This issue affects Mediawiki - EventBus Extension: 1.47.0-alpha...

DEBIAN-CVE-2026-97711

Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialized by serialize-javascript are not fully protected against script-closing tags in attacker-influenced function source because...

CVE-2026-97711

Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialized by serialize-javascript are not fully protected against script-closing tags in attacker-influenced function source because...

CVE-2026-97711

The serialize-javascript library is vulnerable to cross-site scripting (XSS) in versions 7.1.1 through 7.1.2 . The root cause is that the SCRIPT_CLOSE_REGEXP can consume a second closing tag within a single match, failing to fully protect serialized function values against script-closing tags. If...

CVE-2023-26982

CVE-2023-26982 漏洞说明： Trudesk v1.2.6被发现包含一个存储型跨站脚本（XSS）漏洞，该漏洞位于创建工单（Create Ticket）功能下的“添加标签”（Add Tags）参数中。 攻击向量： 攻击者必须先创建一个工单，然后在工单中编辑标签，在“添加标签”（Add Tags）输入框和“创建标签”（Create Tag）处插入XSS载荷，以利用存储型XSS。保存后XSS载荷将立即触发。 受影响范围： http://ip:8118/tickets/ID POST /api/v1/tags/create 参数 : tag 载荷： 测试环境： 1. Trudesk ...

Duplicate-of-CVE-2023-26982

Trudesk 版本 1.2.6 漏洞说明： Trudesk 1.2.6 版本被发现存在一个存储型跨站脚本（XSS）漏洞，通过工单 创建/修改工单标签 功能，涉及管理员角色。 攻击向量： 攻击者需要进入设置菜单，选择工单，然后向下滚动找到工单标签。点击 创建，在 添加标签 输入框中插入 XSS 有效载荷，创建标签 即可利用存储型 XSS。保存后 XSS 有效载荷会立即执行。 受影响： http://IP:8118/settings/tickets POST /api/v1/tags/create Parameter : tag 有效载荷： 测试环境： 1. Trudesk 1.2.6 版...

vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion

A command injection vulnerability in Vim's C omni-completion script allows an attacker to execute arbitrary commands if a user is tricked into opening a maliciously crafted tags file and manually invoking the autocomplete feature...

vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion

A command injection vulnerability in Vim's C omni-completion script allows an attacker to execute arbitrary commands if a user is tricked into opening a maliciously crafted tags file and manually invoking the autocomplete feature...

CVE-2023-44762_ConcreteCMS-Reflected-XSS---Tags

ConcreteCMS 反射型XSS v.9.2.1 作者: Sergio 描述: ConcreteCMS v.9.2.1 中存在跨站脚本漏洞，允许本地攻击者通过向"设置 - 标签"中的标签字段注入特制脚本来执行任意代码。 攻击向量: "设置 - 标签"中标签输入清理机制存在漏洞，允许注入JavaScript代码，当用户访问网页时这些代码将被执行。 概念验证: 登录面板后，我们将进入"仪表盘菜单中的设置 - 标签"部分。 XSS 载荷: 在下图中，你可以看到嵌入的代码，该代码在主网页中执行载荷。 附加信息: https://www.concretecms.com/...

Ghost-CMS-Code-Injection-Audit-CVE-2026-26980

Ghost CMS Code Injection Cleaner Removes injected code from every post and page on a Ghost CMS website via the Admin API. Use this to clean up a compromised Ghost site — for example, one affected by the code injection vulnerability CVE-2026-26980 — by stripping attacker-supplied tags and other...

CVE-2023-43874-e107-CMS-Stored-XSS---MetaCustomTags

e107 CMS 存储型 XSS v2.3.2 作者：Sergio 描述： e017 CMS v.2.3.2 中存在多个跨站脚本（XSS）漏洞，允许本地攻击者通过向“Meta & Custom Tags Menu”中的“Copyright”和“Author”字段注入特制脚本来执行任意代码。 攻击向量： 脚本注入。“Meta & Custom Tags Menu”中的“Copyright”和“Author”字段在输入清理（sanitization）环节存在漏洞，允许注入 JavaScript 代码，当用户访问网页时将执行这些代码。 POC： 登录面板后，我们进入“常规菜单（General...

CVE-2021-45744

CVE-2021-45744 漏洞标题：Bludit 3.13.1 - 标签字段存储型跨站脚本（XSS） 漏洞作者：SANU P.L CVE：CVE-2021-45744 CVSS：5.4 中危 参考链接： https://www.plsanu.com/bludit-3-13-1-tags-field-stored-cross-site-scripting-xss https://nvd.nist.gov/vuln/detail/CVE-2021-45744 https://vulners.com/cve/CVE-2021-45744 描述： Bludit 3.13.1...

Bludit-3.13.1-TAGS-Field-Stored-Cross-Site-Scripting-XSS

CVE-2021-45744 漏洞标题：Bludit 3.13.1 - TAGS字段存储型跨站脚本（XSS） 漏洞作者：SANU P.L CVE：CVE-2021-45744 CVSS：5.4 中危 参考链接： https://www.plsanu.com/bludit-3-13-1-tags-field-stored-cross-site-scripting-xss https://nvd.nist.gov/vuln/detail/CVE-2021-45744 https://vulners.com/cve/CVE-2021-45744 描述： Bludit 3.13.1 的登录面板中...

CVE-2023-47119

Tabla de contenidos CVE-2023-47119 Análisis detallado POC Escalada ? Configuración del LAB CVE-2023-47119 Un POC para CVE-2023-47119 que es una vulnerabilidad que afecta a Discourse versiones anteriores a la versión 3.1.3 de la rama stable y a la versión 3.2.0.beta3 de las ramas beta y...

CVE-2026-61424

CVE-2026-61424 — DJ-Classifieds = 3.11.1 imageupload 任务 → 无认证 → 3字符串过滤器绕过（ 概述 DJ-Classifieds（Joomla 扩展）存在未授权任意文件上传漏洞。imageupload 任务端点在无身份验证 的情况下处理文件上传，并依赖一个3字符串黑名单 （?php、eval、base64），该黑名单可通过 PHP 短开标签（?=）轻松绕过。结合 GIF 多语言（polyglot）文件，上传的文件能通过所有图像校验，同时包含功能完整的 PHP WebShell。 字段| 详情 ---|--- CVE|...