Export limit exceeded: 88004 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (88004 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-8306 | 1 Armiya | 1 Access Control System (gks) | 2026-07-10 | 6.1 Medium |
| Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Armiya Information Technologies Ltd. Co. Access Control System (GKS) allows Stored XSS. This issue affects Access Control System (GKS): before Version 2. | ||||
| CVE-2026-8309 | 1 Armiya | 1 Access Control System (gks) | 2026-07-10 | 5.4 Medium |
| Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Armiya Information Technologies Ltd. Co. Access Control System (GKS) allows Reflected XSS. This issue affects Access Control System (GKS): before Version 2. | ||||
| CVE-2026-6101 | 2 Mohammed Kaludi, Wordpress | 2 Amp For Wp – Accelerated Mobile Pages, Wordpress | 2026-07-10 | 7.5 High |
| The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Arbitrary File Write in versions up to and including 1.1.12. This is due to unsafe ZIP file extraction in the ampforwp_save_local_font() function combined with inadequate cleanup that fails to remove nested directories and files. This makes it possible for authenticated attackers, with Author-level access and above, and permissions granted by an Administrator, to write arbitrary files to the server in a web-accessible location, potentially leading to remote code execution on hosts that execute PHP files in the uploads directory. | ||||
| CVE-2026-12948 | 1 Digi International | 4 Digi One Ia, Digi One Sp, Digi One Sp Ia and 1 more | 2026-07-10 | N/A |
| A stored cross-site scripting (XSS) vulnerability in the web management interface of the Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA allows a remote, authenticated administrator to inject script into certain system configuration fields. The script subsequently executes in the browser of a user who views the affected pages (CWE-79). | ||||
| CVE-2026-48954 | 1 Joomla | 2 Joomla!, Joomla\! | 2026-07-10 | 6.1 Medium |
| Improper validation leads to a generic XSS vector in the language override feature. | ||||
| CVE-2026-48949 | 1 Joomla | 2 Joomla!, Joomla\! | 2026-07-10 | 6.1 Medium |
| Lack of validation leads to an XSS vulnerability in the MFA management views. | ||||
| CVE-2026-48953 | 1 Joomla | 2 Joomla!, Joomla\! | 2026-07-10 | 6.1 Medium |
| Lack of escaping leads to an XSS vulnerability in the generic image output layout. | ||||
| CVE-2026-48951 | 1 Joomla | 2 Joomla!, Joomla\! | 2026-07-10 | 6.1 Medium |
| Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components. | ||||
| CVE-2026-48950 | 1 Joomla | 2 Joomla!, Joomla\! | 2026-07-10 | 6.1 Medium |
| Lack of escaping leads to an XSS vulnerability in the file management view of com_templates. | ||||
| CVE-2026-48952 | 1 Joomla | 2 Joomla!, Joomla\! | 2026-07-10 | 6.1 Medium |
| Lack of escaping leads to an XSS vulnerability in the update list view of com_installer. | ||||
| CVE-2026-55592 | 1 Lissy93 | 1 Dashy | 2026-07-10 | 3.9 Low |
| Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript runs on the Dashy origin and can read same-origin browser data, interact with the Dashy DOM, and send requests as the victim. This issue is fixed in version 4.3.7. | ||||
| CVE-2026-11798 | 2 The Champ, Wordpress | 2 Social Share, Social Login And Social Comments Plugin – Super Socializer, Wordpress | 2026-07-10 | 6.1 Medium |
| The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'heateor_mastodon_share' parameter in all versions up to, and including, 7.14.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. | ||||
| CVE-2026-12041 | 2 Chatra, Wordpress | 2 Chatra Live Chat + Chatbot + Cart Saver, Wordpress | 2026-07-10 | 4.4 Medium |
| The Chatra Live Chat + ChatBot + Cart Saver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. | ||||
| CVE-2026-10570 | 2 Idocoh, Wordpress | 2 Sympl Repeater For Acf And Elementor, Wordpress | 2026-07-10 | 6.4 Medium |
| The Sympl Repeater for ACF and Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ACF repeater field values in all versions up to, and including, 2.3. This is due to insufficient input sanitization and output escaping in the symp_arfe_replace_content() function, which uses str_replace() to substitute raw ACF field values (retrieved via get_field()) directly into Elementor-rendered HTML without any escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2025-14785 | 2 Seedprod, Wordpress | 2 Website Builder By Seedprod — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode, Wordpress | 2026-07-10 | 6.4 Medium |
| The Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `seedprodnestedmenuwidget` shortcode in all versions up to, and including, 6.20.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-8310 | 1 Webbeyaz Website Design | 1 Mediküm Web | 2026-07-10 | 6.1 Medium |
| Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Webbeyaz Web Design Mediküm Web allows Reflected XSS. This issue affects Mediküm Web: through 08072026. NOTE: The vendor was contacted and it was learned that the product is not supported. | ||||
| CVE-2026-8315 | 1 Webbeyaz Website Design | 1 Mediküm Web | 2026-07-10 | 5.4 Medium |
| Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Webbeyaz Web Design Mediküm Web allows Stored XSS. This issue affects Mediküm Web: through 08072026. NOTE: The vendor was contacted and it was learned that the product is not supported. | ||||
| CVE-2026-6740 | 2 Posimyththemes, Wordpress | 2 Nexter Blocks – Gutenberg Blocks, Page Builder & Ai Website Builder, Wordpress | 2026-07-10 | 6.4 Medium |
| The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'commentIcon' parameter in all versions up to, and including, 4.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-49145 | 1 Petdance | 1 App::ack | 2026-07-10 | 7.5 High |
| App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The project-source option blocklist in App::Ack::ConfigLoader does not include --files-from, so a project .ackrc can set it to a path whose listed files ack then reads and searches. Version 3.10.0 added --follow to the blocklist; --files-from remains accepted. A project .ackrc committed to an untrusted repository can make ack read files outside the project and print their matching lines. | ||||
| CVE-2026-49146 | 1 Petdance | 1 App::ack | 2026-07-10 | 7.5 High |
| App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The -B and -C context options accepted any positive integer, and ack sized the before-context buffer to that value, so a project .ackrc setting --before-context=100000000 made ack allocate a buffer of 100 million elements. A project .ackrc committed to an untrusted repository can abort ack with an out-of-memory condition. | ||||