CVE-2021-3030

CVE-2021-3030 — Cute Editor 6.4 Reflected Cross-Site Scripting XSS CVE ID: CVE-2021-3030 Status: Reserved by the CVE Program MITRE on 2021-01-06. No public record has ever been published for this ID — this document is the public reference required to complete that publication. Vulnerability type:...

cve-2025-50946

cve-2025-50946 Exploit script for CVE-2025-50946 OliveTin get-theme RCE. The character requirements are finnicky and many commands that include multiple arguments may not be executed properly. I haven't taken the time to run down the root cause or try to make the script more robust. Holler at me ...

CVE-2025-63499

Targeted Reflected XSS in theme parameter Researchers: Arseniy Poblaguev, Daniil Khomichenok Affected Versions = 5.12.4 https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.4 Date: 02.12.2025 In the theme parameter there are Reflected XSS Vulnerability:...

CVE-2026-92174

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.73.2 via the 'theme' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary...

CVE-2026-92174 SiteOrigin Widgets Bundle <= 1.73.2 - Authenticated (Contributor+) Local File Inclusion via 'theme' Parameter

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.73.2 via the 'theme' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary...

EUVD-2026-91178

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.73.2 via the 'theme' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary...

CVE-2026-92174: Improper Control of Filename for Include/Require Statement in PHP Program

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.73.2 via the 'theme' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary...

PT-2026-104082

Name of the Vulnerable Software and Affected Versions SiteOrigin Widgets Bundle versions prior to 1.73.3 Description The SiteOrigin Widgets Bundle plugin for WordPress contains a Local File Inclusion flaw. Authenticated attackers with contributor-level access or higher can include and execute...

CVE-2026-54613

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, getThemeFolder in admin/controller/editor/revisions.php returns the attacker-controlled theme parameter without sanitization, and backupFolder concatenates it beneath DIRTHEME...

CVE-2026-54613

Vvveb is a CMS with a page builder for websites, blogs, and ecommerce stores. Prior to 1.0.8.5 , the function getThemeFolder() in admin/controller/editor/revisions.php returns the attacker-controlled theme parameter without sanitization. The method sanitizeBackupFileName() strips traversal charac...

CVE-2026-54613 Vvveb: Path Traversal in Revision Backup Reader/Deleter via Unsanitized theme Parameter

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, getThemeFolder in admin/controller/editor/revisions.php returns the attacker-controlled theme parameter without sanitization, and backupFolder concatenates it beneath DIRTHEME...

CVE-2026-54613 Vvveb: Path Traversal in Revision Backup Reader/Deleter via Unsanitized theme Parameter

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, getThemeFolder in admin/controller/editor/revisions.php returns the attacker-controlled theme parameter without sanitization, and backupFolder concatenates it beneath DIRTHEME...

CVE-2026-54613 Vvveb: Path Traversal in Revision Backup Reader/Deleter via Unsanitized theme Parameter

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, getThemeFolder in admin/controller/editor/revisions.php returns the attacker-controlled theme parameter without sanitization, and backupFolder concatenates it beneath DIRTHEME...

CVE-2021-3030

Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme GET parameter in colorpickermore.aspx. A remote, unauthenticated attacker can craft a URL that, once opened by a victim in a browser session authenticated to a site running the...

Exploit for CVE-2021-3030

CVE-2021-3030 — Cute Editor 6.4 Reflected Cross-Site Scripting...

USN-8504-1 sogo vulnerabilities

It was discovered that SOGo did not properly sanitize categories used for events, tasks, and contacts. A remote authenticated attacker could possibly use this issue to perform cross-site scripting attacks. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu...

📄 Event Booking Calendar 5.0 Cross Site Scripting

Event Booking Calendar version 5.0 suffers from a cross site scripting vulnerability. Titles: Event Booking Calendar-5.0 Cross-site scripting reflected Author: nu11secur1ty Date: 5/13/2026 Vendor: https://www.phpjabbers.com/ Software: https://www.phpjabbers.com/event-booking-calendar/ Reference:...

📄 Car Rental Script 4.0 Cross Site Scripting

Car Rental Script version 4.0 suffers from a cross site scripting vulnerability. Titles: Car-Rental-Script4.0-XSS-Reflected Cross-site scripting reflected Author: nu11secur1ty Date: 05/08/2026 Vendor: https://www.phpjabbers.com/ Software: https://www.phpjabbers.com/car-rental-script/ Reference:...

CVE-2026-1988

The Flexi Product Slider and Grid for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0.5 via the flexipsgcarousel shortcode. This is due to the theme parameter being directly concatenated into a file path without proper sanitization ...

PT-2026-8087

The Flexi Product Slider and Grid for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0.5 via the flexipsg carousel shortcode. This is due to the theme parameter being directly concatenated into a file path without proper sanitization...