73 matches found
GHSA-533C-2VH9-4R86 Decidim: HTML content blocks allow stored script execution
Description A privileged admin user who can edit an affected landing page can store arbitrary HTML/JavaScript in an HTML block, and the public page renders it with htmlsafe and no output escaping. Technical description This issue lets any admin who can edit an affected landing page store arbitrar...
DeepAI.org CSRF
RISK EVALUATION The DeepAI.org endpoint https://api.deepai.org/changeuseremail accepts POST requests without any CSRF protection. If a logged-in user is tricked into visiting a malicious HTML page, an attacker can change the user's email address to their own and take over the account via...
Security Bulletin: MongoDB Enterprised Advanced affected by: Missing Authorization and Other Issues (CVE-2026-34766 + 13 more)
Summary There are vulnerabilities in electron-37.8.0.tgz used in MongoDB Enterprised Advanced for IBM, involving 14 CVEs. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-34766 DESCRIPTION: Electron is a framework for writing cross-platform desktop applications using...
CVE-2026-25679
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs...
CVE-2026-28100 WordPress UberSlider PerpetuumMobile plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LambertGroup UberSlider PerpetuumMobile uberSliderperpetuummobile allows Reflected XSS.This issue affects UberSlider PerpetuumMobile: from n/a through = 2.3...
PSF-2026-6
User-controlled header names and values containing newlines can allow injecting HTTP headers...
Student Information System editprofile.php File Cross-Site Scripting Vulnerability
Student Information System is a student information system. A cross-site scripting vulnerability exists in the Student Information System, which originates from an unspecified function in the /editprofile.php file that improperly handles user input. An attacker can exploit this vulnerability by...
CVE-2025-52735 WordPress NextMove Lite plugin <= 2.24.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Reflected XSS.This issue affects NextMove Lite: from n/a through = 2.24.0...
EUVD-2025-34426
Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability...
EUVD-2006-6608
Malware in sbrugna...
EUVD-2008-7051
Malware in sbrugna...
EUVD-2011-2866
Malware in sbrugna...
EUVD-2002-1824
Malware in sbrugna...
EUVD-2005-3066
Malware in sbrugna...
EUVD-2012-1103
Malware in sbrugna...
EUVD-2006-3209
Malware in sbrugna...
EUVD-2011-4932
Malware in sbrugna...
EUVD-2013-2806
Malware in sbrugna...