-CVE-2021-26904

CVE-2021-26904 LMA ISIDA Retriever 5.2에서 SQL Injection이 가능합니다. 제안된 설명 : "ISIDA RETRIEVER v5.2" SQL Injection 취약한 기능 : ISIDA RETRIEVER Platform은 SQL Injection에 취약합니다. 취약한 URL 및 매개변수 : website.com/index.php?title=Injection 취약한 URL 및 매개변수 : website.com/index.php?title=info?mode=info?query=Injection...

CVE-2025-56807

CVE-2025-56807 설명 FairSketch RISE Ultimate Project Manager & CRMv3.9.4의 File Manager 기능에서 저장형 XSSStored Cross Site Scripting 취약점이 발견되었습니다. 이 취약점은 새 폴더를 만들 때 제출되는 title 매개변수 에 존재합니다. 입력값 검증이 충분하지 않기 때문에 공격자는 HTML/JavaScript 페이로드예:를 주입할 수 있습니다. 해당 페이로드는 폴더 이름에 저장되며 File Manager에서 폴더 목록을 표시할 때 실행되어,...

CVE-2024-44542

CVE-2024-44542 説明: todesk v1.1 には、/todesk.com/news.html の title パラメータに SQL インジェクションの脆弱性が含まれていることが発見されました。 脆弱性の種類: SQLインジェクション 製品ベンダー: todesk 影響を受ける製品バージョン: todesk - v1.1 影響を受けるコンポーネント: todesk.com, news.html 攻撃タイプ: リモート 影響（情報漏えい）: True 攻撃ベクトル: 特定のURLリクエストを構築することで、攻撃者はSQLインジェクションの脆弱性を悪用できます。例:...

CVE-2026-38469

A Stored XSS vulnerability exists in the custom bonus title feature of GazellePW (GazellePosterWall) at commit 86c4bed. Remote authenticated users can inject arbitrary JavaScript via the title parameter in /bonus.php and /user.php?action=staff_tool, affecting low-level user accounts. The CVSS 3.1...

CVE-2026-38469

A Stored XSS vulnerability in the custom bonus title feature in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the title parameter in /bonus.php and /user.php?action=stafftool...

CVE-2026-15653

The CVE concerns the WordPress plugin Visualizer – Tables & Charts Manager with Built-in AI Generator. All versions up to 4.0.5 are vulnerable to Stored Cross‑Site Scripting via the backend-title parameter due to insufficient input sanitization and output escaping. Exploitation requires at least ...

EUVD-2026-48510

The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'backend-title' parameter in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2026-9635

The WP Shortcode by MyThemeShop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter of the tab shortcode in versions up to, and including, 1.4.17. This is due to insufficient input sanitization and output escaping in the mtstabs function, which outputs the...

Plone 5.2.3 XSS

The version of Plone installed on the remote host is 5.2.3. It is, therefore, affected by a stored cross-site scripting XSS vulnerability within the site-controlpanel due to improper validation of user-supplied input before returning it to users. An authenticated, remote attacker can exploit this...

CVE-2026-12536

The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Module Title’ parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-12536

The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Module Title’ parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-11328

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title parameter in all versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-25557 Evoluted PHP Directory Listing Script 4.0.5 Reflected XSS via dir parameter

Evoluted PHP Directory Listing Script through 4.0.5 contains a reflected cross-site scripting vulnerability in index.php where the dir parameter value is reflected without HTML encoding inside the HTML title element and inside anchor href attributes in the breadcrumb navigation. Attackers can...

CodeAstro Human Resource Management System 跨站脚本漏洞

The CodeAstro Human Resource Management System is a human resource management system developed by CodeAstro Corporation. Version 1.0 of the CodeAstro Human Resource Management System has a cross-site scripting vulnerability. This vulnerability stems from incorrect handling of the Notice Title...

PT-2026-47189

Name of the Vulnerable Software and Affected Versions NousResearch hermes-agent versions prior to 0.12.1 Description An authorization bypass exists in the resume endpoint. The issue occurs within the resolve session by title function located in the hermes state.py file. A remote attacker can...

CVE-2026-5028

The Eight Day Week Print Workflow plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'title' parameter in the pp-get-articles AJAX action in all versions up to, and including, 1.2.6. This is due to insufficient escaping on the user supplied parameter and lack of sufficie...

Cross-site Scripting (XSS)

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Cross-site Scripting XSS via the pagetitle parameter in the WebSocket connection URL, which is broadcast to all connected clients without proper validation or...

CVE-2019-25744 WordPress Popup Builder 3.49 Persistent Cross-Site Scripting

WordPress Popup Builder 3.49 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by breaking out of option tags in the posttitle parameter. Attackers can submit crafted POST requests to the post.php endpoint with script payloads...

CVE-2019-25744

The CVE-2019-25744 entry concerns WordPress Popup Builder 3.49, which is vulnerable to a persistent cross-site scripting (XSS) flaw. The affected component is the post_title parameter, where an attacker can break out of option tags and craft POST requests to the post.php endpoint with a script pa...

CVE-2019-25744

WordPress Popup Builder 3.49 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by breaking out of option tags in the posttitle parameter. Attackers can submit crafted POST requests to the post.php endpoint with script payloads...