284095 matches found
CVE-2026-103050
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - MassMessage extension allows Stored XSS. This issue affects Mediawiki - MassMessage extension: before 1.46.1, 1.45.5, 1.43.10...
UBUNTU-CVE-2026-103051
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - CentralNotice extension allows Stored XSS. This issue affects Mediawiki - CentralNotice extension: before 1.46.1, 1.45.5, 1.43.10...
PT-2026-103026
The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher...
ABSENTIA: Detecting Broken Access Control Vulnerabilities in Web Applications
Broken access control, the failure of authorization, is one of the most prevalent web security risks. Unlike injection, a flow of untrusted input into a dangerous operation, authorization is a relation: who may act on what, not how data moves. Each application decides that relation for itself, so...
PT-2026-103087
Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course without proper permission,...
Open Interface Service Web Module Privilege Escalation
The vulnerability of the Open Interface Service in the web module of the Siemens Siveillance Control video surveillance and security management software is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a remote attacker to enhance their privileges and...
PT-2026-103056
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of the plugin's bt bb icon shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it...
PT-2026-103276
Name of the Vulnerable Software and Affected Versions LiteSpeed Web Server LSWS versions prior to 6.3.7 build 1 Description LiteSpeed Web Server LSWS mishandles internal redirect URL validation in a specific corner case. This issue involves double decoding of the same data, which can lead to...
CVE-2026-97287: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection. This issue affects Event Tickets: from n/a through 5.29.5...
PT-2026-103042
The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import preset they select, and switches to the preset author's identity before creating the resulting post, allowing users with contributor-level access and abo...
PT-2026-103003
Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a malicious attacker to render a Pexip Infinity node inaccessible...
PT-2026-103076
Name of the Vulnerable Software and Affected Versions EasyFlow .NET affected versions not specified Description An arbitrary file upload flaw allows privileged remote attackers to upload and execute web shell backdoors, which can lead to arbitrary code execution on the server. Recommendations At...
PT-2026-103592
Name of the Vulnerable Software and Affected Versions Apeos C4571 versions prior to 1.1.4 Apeos C3567 version 1.1.3 FUJIFILM and Sharp multifunction printers affected versions not specified Description A path traversal issue exists in the web management interface of several multifunction devices...
PT-2026-103625
Name of the Vulnerable Software and Affected Versions AJA HELO Plus versions prior to 2.1.7 Description A stored cross-site scripting issue exists that allows unauthenticated attackers with network access to inject malicious JavaScript. This occurs when the eParamID SystemName variable is set wit...
CVE-2026-93903: Double Decoding of the Same Data
LiteSpeed Web Server LSWS before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."...
CVE-2026-97286: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.11...
CVE-2026-97279: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in Polylang = 3.8.9 versions...
CVE-2026-97270: Improper Neutralization of Input During Web Page Generation
Subscriber Cross Site Scripting XSS in CMB2 = 2.13.0 versions...