EUVD-2026-91892

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2026-15253

CVE-2026-15253 Easy Media Replace = 0.2.0 - Cross-Site Scripting Almacenado Autenticado Author+ Descripción El plugin Easy Media Replace es vulnerable a Cross-Site Scripting Almacenado XSS a través del título del archivo adjunto multimedia. Cuando un Author renombra un archivo multimedia utilizan...

CVE-2026-23009-DICOM-Network-Image-Injection-Without-Authentication

CVE-2026-23009 – 无认证的 DICOM 网络图像注入 程序代码 Python pydicom dicomserversim.py - DICOM C-STORE SCP with no AE title check from pynetdicom import AE, evt, AllStoragePresentationContexts def handlestoreevent: ds = event.dataset No authentication, accepts any image from any remote...

CVE-2026-104123 SourceCodester Online Reviewer Management System btn_functions.php activity sql injection

A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /reviewer0/admins/assessments/activities/btnfunctions.php?action=activity. The manipulation of the argument Title results in sql injection...

EUVD-2026-91164

A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /reviewer0/admins/assessments/activities/btnfunctions.php?action=activity. The manipulation of the argument Title results in sql injection...

PT-2026-104074

The Visitors Traffic Real Time Statistics Pro plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Scripting in all versions up to, and including, 11.22 via the page title parameter of the ahcpro track visitor AJAX action. The action is registered for logged-out callers wp ajax...

PT-2026-104072

A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /reviewer 0/admins/assessments/activities/btn functions.php?action=activity. The manipulation of the argument Title results in sql injection...

exploit-foxit-4.1.1-title-bof

此存储库没有 README。...

CVE-2026-78071

DPCalendar Free 中通过位置标题触发的存储型 XSS DPCalendar Free ≤ 10.11.2 — 作者角色用户绕过内容审核，通过位置标题注入持久型 XSS，任何访客悬停时触发 -orange 摘要 $location-title 字段在 defaultlocations.php 中未经 htmlspecialchars 处理即被渲染。Joomla 服务端的 InputFilter::clean 会从字符串字段中剥离 ，但允许 " 通过，这使得作者（Author）角色用户能够突破 HTML 属性上下文。当任何访客将鼠标悬停在事件页面的位置信息区域时，注入的...

EUVD-2026-91021

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, GetSimpleCMS-CE is vulnerable to stored Cross-Site Scripting XSS in the "Theme to Components" functionality admin/components.php via the title parameter. The...

CVE-2026-71542

GetSimple CMS CE , versions 3.3.22 and prior , is vulnerable to a stored Cross-Site Scripting (XSS) flaw within the "Theme to Components" functionality at the admin/components.php path. The vulnerability exists because the title parameter is rendered inside a double-quoted HTML attribute without ...

CVE-2026-71542 GetSimple CMS: Stored Cross-Site Scripting (XSS) via the "title" parameter in admin/components.php

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, GetSimpleCMS-CE is vulnerable to stored Cross-Site Scripting XSS in the "Theme to Components" functionality admin/components.php via the title parameter. The...

CVE-2026-6184-stored-XSS

新闻标题中的存储型 XSS - Simple Content Management System PHP 描述 Simple Content Management System PHP 中存在一个存储型跨站脚本（XSS）漏洞。管理面板中的新闻标题字段在将用户输入存储到数据库并反映到公共首页之前，未对其进行清理。任何浏览主页的访客都会触发存储型 XSS 载荷，从而允许攻击者窃取会话 Cookie 并劫持账户。 漏洞详情 类型： 存储型跨站脚本（CWE-79） 影响： 会话劫持 / Cookie 窃取 受影响文件： /web/admin/welcome.php 受影响参数： 新闻标题字段...

plone.app.dexterity has a Denial of Service due to excessive title or description length

ImpactWhen creating content with a very large title or description field, Plone can become unresponsive. Even if the content loads, it can be hard to edit or delete, because the UI is unwieldy. PatchesThe problem has been patched in plone.app.dexterity. On Plone 6.2, upgrade to plone.app.dexterit...

CVE-2024-4879-ServiceNow

CVE-2024-4879-ServiceNow ServiceNow 是一个业务转型平台，可帮助企业管理企业运营的数字工作流程。 CVE-2024-4879 可能允许未经身份验证的用户在 Now 平台中远程执行代码。该漏洞通过串联利用三个问题来访问 ServiceNow 数据：Title Injection、Template Injection Mitigation Bypass 和 Filesystem Filter Bypass。 受影响的版本包括 Vancouver、Washington DC Now 和 Utah 平台版本 用法： python3 exploit.py -i...

Craft-CMS-3.0.25---Cross-Site-Scripting

Craft-CMS-3.0.25 - クロスサイトスクリプティング Craft CMS 3.0.25 - クロスサイトスクリプティングの脆弱性 CVE-CVE-2018-20418 https://vulners.com/cve/CVE-2018-20418 概念実証 コンソールタブから新しいタイトルを保存することで、クロスサイトスクリプティング（XSS）を実行できます。 POST /admin-panel-path/index.php?p=admin/actions/entries/save-entry HTTP/1.1 Host: IP:PORT User-Agent:...

Bolt-CMS-3.6.2---Cross-Site-Scripting

Bolt CMS 3.6.2 - 跨站脚本漏洞 Bolt CMS 3.6.2 - 跨站脚本漏洞 CVE-2018-19933 https://vulners.com/cve/CVE-2018-19933 概念验证 要利用此漏洞，Bolt CMS 3.6.2 允许通过文本输入点击预览按钮触发 XSS，如 Configured 和 New Entry 的 Title 字段所示。 POST /preview/page HTTP/1.1 Host: 127.0.0.1:8000 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:63....

CVE-2024-44542

CVE-2024-44542 説明: todesk v1.1 には、/todesk.com/news.html の title パラメータに SQL インジェクションの脆弱性が含まれていることが発見されました。 脆弱性の種類: SQLインジェクション 製品ベンダー: todesk 影響を受ける製品バージョン: todesk - v1.1 影響を受けるコンポーネント: todesk.com, news.html 攻撃タイプ: リモート 影響（情報漏えい）: True 攻撃ベクトル: 特定のURLリクエストを構築することで、攻撃者はSQLインジェクションの脆弱性を悪用できます。例:...

CVE-2026-7176

CVE-2026-7176: the Help text and Title parameters in the endpoint /events/-/customform/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the event...

EUVD-2026-90746

CVE-2026-7176: the Help text and Title parameters in the endpoint /events/-/customform/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the event...