CVE-2026-33889

ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site scripting vulnerability in the @apostrophecms/color-field module, where color values prefixed with -- bypass TinyColor validation intended for CSS custom properties, and the...

CVE-2026-33888 ApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST API

ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain an authorization bypass vulnerability in the getRestQuery method of the @apostrophecms/piece-type module, where the method checks whether a MongoDB projection has already been set before applying...

Travel Portal Script 9.37 Cross Site Scripting / SQL Injection Vulnerabilities

Travel Portal Script version 9.37 suffers from cross site scripting and remote SQL injection vulnerabilities. Exploit Title : Travel Portal Script v9.37 - Multiple Vulnerability Google Dork : - Date : 23/02/2017 Exploit Author : Marc Castejon Vendor Homepage :...