#cwe-79

共收录 5376 条相关情报。

← 返回所有主题

漏洞预警2026-10-01 发布INFO

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Referer header in all versions up to, and including, 2.8....

CVE-2026-19902

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-01 发布INFO

The Five Star Restaurant Reviews WordPress plugin before 2.3.14 does not properly escape a user-supplied value before outputting it into an HTML tag, allowing unauthenticated at...

CVE-2026-92412

The Five Star Restaurant Reviews WordPress plugin before 2.3.14 does not properly escape a user-supplied value before ou

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-01 发布INFO

The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor escape it when rendering the analytics page, allowing users ...

CVE-2026-87973

The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor esc

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-01 发布INFO

The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is served as HTM...

CVE-2026-87970

The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-01 发布INFO

The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with...

CVE-2026-86610

The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before o

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-01 发布INFO

The Extendify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'styles.blocks' Block Type Key in all versions up to, and including, 3.1.6 due to insufficien...

CVE-2026-85679

The Extendify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'styles.blocks' Block Type Key in al

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-01 发布INFO

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page, and the integri...

CVE-2026-81739

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbac

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-01 发布INFO

HCL Digital Experience is affected by improper input sanitation. This can result in HTML injection which could be leveraged in content spoofing from a trusted domain. Apply HCL...

CVE-2026-67075

HCL Digital Experience is affected by improper input sanitation. This can result in HTML injection which could be lever

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-01 发布INFO

The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to an improperly secure capability ...

CVE-2026-12241

The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to unauthorized mod

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-01 发布INFO

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is d...

CVE-2026-96561

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Sc

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-30 发布INFO

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers can induce authenticated adm...

CVE-2026-103590

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's leng

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-30 发布INFO

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape room_num, floor, and comment field values ...

CVE-2026-103589

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that f

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-30 发布INFO

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, where date_to and id_room_type paramet...

CVE-2026-103587

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation Syste

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

安全公告2026-09-30 发布INFO

QloApps through 1.7.0 Reflected XSS via Length of Stay Fields

CVE-2026-103590

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's leng

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

安全公告2026-09-30 发布INFO

QloApps through 1.7.0 Reflected XSS via Room Type Editor

CVE-2026-103589

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that f

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

安全公告2026-09-30 发布INFO

QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters

CVE-2026-103587

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation Syste

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

漏洞预警2026-09-30 发布INFO

AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers with network access to inject malicious JavaScript...

CVE-2026-47096

AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated att

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-30 发布INFO

A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the a...

CVE-2026-102147

A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-30 发布INFO

A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a single, narrowly scoped delegated permission to store crafted content ...

CVE-2026-102126

A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a single, narro

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-30 发布INFO

Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store crafted content that executes arbitrary Ja...

CVE-2026-102092

Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated

历史摘要 · 未重新核验 · NVD

#cve #cwe-79