WordPress plugin Website LLMs.txt 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

CVE-2026-31018: Improper Control of Generation of Code

In Dolibarr ERP & CRM = 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page...

CVE-2026-31019: Improper Neutralization of Special Elements used in an OS Command

In the Website module of Dolibarr ERP & CRM 22.0.4 and below, the application uses blacklist-based filtering to restrict dangerous PHP functions related to system command execution. An authenticated user with permission to edit PHP content can bypass this filtering, resulting in full remote code...

CVE-2026-31019

The Website module of Dolibarr ERP & CRM (version 22.0.4 and below ) is vulnerable to Remote Code Execution (RCE) due to a flaw in its blacklist-based filtering of dangerous PHP functions. An authenticated user possessing permissions to edit PHP content can bypass these restrictions to execute ar...

Dolibarr ERP & CRM 安全漏洞

Dolibarr ERP & CRM is an enterprise management software developed under the open-source license of Dolibarr. Dolibarr ERP & CRM versions 22.0.4 and earlier have a security vulnerability. This vulnerability stems from the use of a blocklist-based filtering mechanism in website modules to restrict...

CVE-2026-40584: Exposure of Sensitive Information to an Unauthorized Actor

RansomLook is a tool to monitor Ransomware groups and markets and extract their victims. Prior to 1.9.0, the API in the affected application improperly filters private location entries in website/web/api/genericapi.py. Because the code removes elements from a list while iterating over it, entries...

CVE-2026-31018

In Dolibarr ERP & CRM = 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page...

PT-2026-33987

Name of the Vulnerable Software and Affected Versions Dolibarr ERP & CRM versions prior to 22.0.5 Description In the Website module, the application employs blacklist-based filtering to restrict dangerous PHP functions associated with system command execution. An authenticated user with permissio...

PT-2026-33981

Name of the Vulnerable Software and Affected Versions Dolibarr ERP & CRM versions prior to 22.0.5 Description In the Website module, PHP code detection and editing permission enforcement is not applied consistently to all input parameters. This allows an authenticated user who is restricted to...

CVE-2026-31019

In the Website module of Dolibarr ERP & CRM 22.0.4 and below, the application uses blacklist-based filtering to restrict dangerous PHP functions related to system command execution. An authenticated user with permission to edit PHP content can bypass this filtering, resulting in full remote code...

CVE-2026-31018

In Dolibarr ERP & CRM = 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page...

CVE-2026-6711: Improper Neutralization of Input During Web Page Generation

The Website LLMs.txt plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 8.2.6. This is due to the use of filterinput without a sanitization filter and insufficient output escaping. This makes it possible for...

CVE-2026-31018

Dolibarr ERP & CRM versions

WordPress Website LLMs.txt plugin <= 8.2.6 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by Kazuma Matsumoto - GMO Cybersecurity by IERAE, Inc. in WordPress Plugin Website LLMs.txt versions = 8.2.6...

The vulnerability of the FortiSandbox threat detection and mitigation system, related to the lack of protection for website structures, allows attackers to execute arbitrary commands or code.

The vulnerability of the FortiSandbox threat detection and mitigation system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands or code...

The vulnerability of the sub_401F80() function in the microprogramming software for Wavlink WL-WN579A3 allows attackers to carry out XSS attacks.

The vulnerability of the sub401F80 function in the microprogramming software for Wavlink WL-WN579A3 relates to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a remote attacker to perform XSS attacks...

The vulnerability of the software for coordinating the operation of security systems and for managing real-time incident responses in Fortinet FortiSOAR lies in the lack of protection for website structures. This allows attackers to execute XSS attacks.

The vulnerability of the graphical user interface of the software solution for coordinating the operation of cybersecurity systems and for managing incident responses in real-time is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a...

The vulnerability of the Jenkins automation server relates to the lack of protective measures for the website structure, allowing attackers to execute arbitrary code.

The vulnerability of the Jenkins automation server relates to the lack of protective measures for the web page structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

python-vulnerability-scanner

Python Web Vulnerability Scanner This project is a simple Pyt...

A fake Slack download is giving attackers a hidden desktop on your machine

A trojanized Slack download from a typosquatting website is giving attackers something most users wouldn’t even know to look for: a hidden desktop running on their machine. The installer looks legitimate and even launches a working copy of Slack. But in the background, it can create an invisible...