6001 matches found
CVE-2025-52132
CVE-2025-52132 affects the Mocca Calendar application for XWiki (pre-2.15). The vulnerability is an XSS flaw triggered by the title on the View Event page. Affected versions are Mocca Calendar prior to 2.15. The root cause is an improper sanitization/encoding of the title parameter on the event v...
CVE-2025-52132
The Mocca Calendar application before 2.15 for XWiki allows XSS via a title to the view event page...
CVE-2025-50270
A stored Cross Site Scripting xss vulnerability in the "content management" feature in AnQiCMS v.3.4.11 allows a remote attacker to execute arbitrary code via a crafted script to the title, categoryTitle, and tmpTag parameters...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through crafted requests. An attacker can execute arbitrary scripts in the context of a user's browser by submitting crafted input to the title, categoryTitle, or tmpTag parameters. Details Cross-site scripting ...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through crafted requests. An attacker can execute arbitrary scripts in the context of a user's browser by submitting crafted input to the title, categoryTitle, or tmpTag parameters. Details Cross-site scripting ...
GO-2025-3766 Grafana long dashboard title or panel name causes unresponsives in github.com/grafana/grafana
Grafana long dashboard title or panel name causes unresponsives in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
CVE-2025-6385 WP Applink <= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter
The WP Applink plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 0.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...
CVE-2025-6385 WP Applink <= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter
The WP Applink plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 0.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the title field of the component admin/blog/blogpost/add. An attacker can execute arbitrary web scripts or HTML by maliciously formatted blog post. Details Cross-site scripting or XSS is a code vulnerability...
CVE-2025-8015 Shortcodes Ultimate <= 7.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title and Slide Link
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded image's 'Title' and 'Slide link' fields in all versions up to, and including, 7.4.2 due to insufficient input sanitization and output escaping. This makes it possible f...
CVE-2025-8015 Shortcodes Ultimate <= 7.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title and Slide Link
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded image's 'Title' and 'Slide link' fields in all versions up to, and including, 7.4.2 due to insufficient input sanitization and output escaping. This makes it possible f...
Malicious code in lint-pr-title (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f7a7398205d96f4d045fedf2fbd41ba545c40048a2e9683747ab8bec7ac77a1f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-6177 Malicious code in lint-pr-title (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f7a7398205d96f4d045fedf2fbd41ba545c40048a2e9683747ab8bec7ac77a1f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2025-54352
WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not changing this behavior...
CVE-2025-54352
WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not changing this behavior...
CVE-2025-54352
WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not changing this behavior...
ZVING ZCMS 代码注入漏洞
ZVING ZCMS Zeyuan Web Content Management System is an enterprise-level web content management software from China Zeyuan Software ZVING Company. A code injection vulnerability exists in ZVING ZCMS version 3.6.0, which originates from improper handling of the parameter Title in the component Creat...
jshERP 路径遍历漏洞
jshERP Huaxia ERP is a homegrown ERP system by the individual developer of Ji Sheng Hua in China. jshERP 3.5 and previous versions of path traversal vulnerability, the vulnerability stems from improper operation of the parameter Title in the file SystemConfigController.java, which may lead to pat...
CVE-2025-2942
The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title such as from draft and private posts via an unauthenticated AJAX action, allowing attackers to retrieve such information...