4006 matches found
Astra Linux – Vulnerability in Firefox and Thunderbird
Through a series of API calls and redirections, an alert dialog controlled by an attacker could have been displayed on another website with the victim website’s URL shown. This vulnerability affects Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8...
EUVD-2026-72647
Unauthenticated Cross Site Scripting XSS in Open User Map = 1.4.50 versions...
MobSF's CSRF checks not enforced after Django migration
SummaryDjango's CsrfViewMiddleware exists only in the deprecated MIDDLEWARECLASSES ignored since Django 2.0. The active MIDDLEWARE tuple does not include it. All authenticated web POST endpoints delete scan, upload, download APK, change password, manage users accept requests without CSRF tokens...
ROS-20260819-73-0020
The vulnerability in MediaWiki relates to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
CVE-2026-65902
A flaw was found in DOMPurify. An attacker can exploit a vulnerability in how DOMPurify handles its sanitization hooks when default configurations are used. By manipulating the uponSanitizeElement or uponSanitizeAttribute hooks, an attacker can permanently alter the allowed HTML tags and...
ROS-20260812-73-0019
The vulnerability in dnsdist relates to the failure to take measures to eliminate script-related HTML tags on web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...
CVE-2026-64941
The CVE describes an Open Redirect in Phoenix.LiveView.validate_local_url!/2 where ASCII tab, LF or CR are not rejected. This allows a crafted :to value to bypass path-only validation and be resolved as a scheme-relative URL (e.g., //example.com) when using redirect/2 and related navigation funct...
CVE-2026-72570 cube-root directory-serve - Stored Cross-Site Scripting via Malicious Filename
A stored cross-site scripting XSS vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters...
EUVD-2026-55236
A stored cross-site scripting XSS vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters...
cve-2026-poc-collection
CVE-2026 Proof-of-Concept PoC Collection Report Collectio...
EUVD-2026-53573
IBM Langflow OSS 1.0.0 through 1.10.3 installations allow anyone on the internet to execute arbitrary code on the server without any credentials via 2 HTTP requests...
CVE-2026-69704
Atals-Livre contains a SQL injection vulnerability that allows attackers to manipulate database queries by passing unsanitized input through a GET parameter to the supp deletion helper function. Attackers can inject malicious SQL syntax via the vulnerable GET parameter to perform unauthorized...
Stored Cross Site Scripting
Mettle SendPortal is vulnerable to stored cross-site scripting. The vulnerability is due to the application's failure to properly sanitize user-supplied input in the content parameter of the /templates endpoint, where an attacker can persistently inject malicious JavaScript code that is executed ...
guardx
🛡️ Guard Toolkit — Full Tutorial Security toolkit: Secret S...
CVE-2026-64827
CVE-2026-64827 affects Telenia Software TVox 26.5.3 and earlier in 26.x and 24.x lines. The root cause is an authentication bypass in set_env.php: redirectToLoginAdminIRequestHaveAccessToken() derives the current page name from PHP_SELF and skips authentication when it equals 'login_admin.php'. T...
cve-2026-poc-collection
CVE-2026 Proof-of-Concept PoC Collection Report Collectio...
PT-2026-66830
Name of the Vulnerable Software and Affected Versions Johnson Controls FM Systems Employee versions prior to 2025.3.1 Description Improper neutralization of script-related HTML tags in a web page allows for Cross-Site Scripting XSS, a condition where malicious scripts are injected into trusted...
Brother MFC-9970CDW Printers Cross-site Scripting (CVE-2013-2507)
Multiple cross-site scripting XSS vulnerabilities in the Brother MFC-9970CDW printer with firmware G 1.03 allow remote attackers to inject arbitrary web script or HTML via the 1 id parameter to admin/logtonet.html or 2 kind parameter to fax/copysettings.html, a different vulnerability than...
CVE-2026-15235
The MotoPress Hotel Booking WordPress plugin (versions prior to 6.0.4 ) is vulnerable to a sensitive data disclosure. The root cause is a missing capability check in one of the plugin's AJAX actions , which allows any authenticated user with a low-privileged account (such as a Subscriber ) to acc...
