CVE Intelligence
Início / CVEs

Base de CVEs

Vulnerabilidades publicadas, com severidade, exploração conhecida e fontes oficiais.

Severidade
Limpar

10.121 resultado(s)

Exportar esta busca: RSS · CSV · STIX
CVE-2026-73648 Média · 5.1 CWE-79 13/08/2026
rails-html-sanitizer: Possible XSS vulnerability with certain configurations
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVG_ALLOW_LOCAL_HREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applications with non-default allowed tags that included SVG use or feImage elements could therefore permit external references; a same-origin external SVG referenced by use could execute scripts in the sanitized document's context, while feImage could load external images for tracking. Applications using the default allowed tags are not affected. This issue is fixed in version 1.7.1.
CVE-2026-73572 Média · 6.1 CWE-79 13/08/2026
Cross-site Scripting (XSS) em Synacor Zimbra Collaboration Suite
In Zimbra Collaboration (ZCS) before 10.1.17, a stored cross-site scripting (XSS) vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of specific attachment content during inline preview. An attacker can send a crafted email containing a malicious attachment that, when previewed by a user, executes arbitrary JavaScript within the victim's browser session. Successful exploitation may allow an attacker to perform unauthorized actions on behalf of the victim user, potentially leading to data exfiltration or unauthorized access to sensitive information.
CVE-2026-19744 Média · 5.1 CWE-79 13/08/2026
Stored Cross-site Scripting in Pentestify Markdown renderer via unescaped quotes
Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization step does not escape quotes
CVE-2026-28154 Alta · 7.1 CWE-79 13/08/2026
WordPress Samex and M.Anh WordPress themes affected by Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex - Clean, Minimal Shop WooCommerce WordPress Theme: from n/a through 2.5; M.Anh - Fashion WooCoommerce WordPress Theme: from n/a through 1.7.
CVE-2026-73357 Média · 6.5 CWE-79 13/08/2026
WordPress GiveWP plugin < 4.16.6 - Cross Site Scripting (XSS) vulnerability
Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions.
CVE-2026-73344 Média · 5.9 CWE-79 13/08/2026
WordPress WP Data Access plugin <= 5.5.79 - Cross Site Scripting (XSS) vulnerability
Author Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.
CVE-2026-73340 Média · 6.5 CWE-79 13/08/2026
WordPress Featured Image from URL plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Featured Image from URL <= 5.3.3 versions.
CVE-2026-66700 Alta · 7.1 CWE-79 13/08/2026
WordPress Smart Online Order for Clover plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover <= 1.6.1 versions.
CVE-2026-66698 Alta · 7.1 CWE-79 13/08/2026
WordPress SureDash plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions.
CVE-2026-66697 Alta · 7.1 CWE-79 13/08/2026
WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions.
CVE-2026-66687 Média · 6.5 CWE-79 13/08/2026
WordPress WpBookingly plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability
Customer Cross Site Scripting (XSS) in WpBookingly <= 1.3.2 versions.
CVE-2026-66655 Alta · 7.1 CWE-79 13/08/2026
WordPress MultiParcels Shipping For WooCommerce plugin <= 1.30.36 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions.
CVE-2026-66471 Média · 6.5 CWE-79 13/08/2026
WordPress Accordion plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in Accordion <= 3.0.6 versions.
CVE-2026-66468 Alta · 7.1 CWE-79 13/08/2026
WordPress Local Delivery Drivers for WooCommerce plugin <= 3.0.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions.
CVE-2026-66467 Média · 6.5 CWE-79 13/08/2026
WordPress FluentCommunity plugin <= 2.7.5 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in FluentCommunity <= 2.7.5 versions.
CVE-2026-66460 Média · 6.5 CWE-79 13/08/2026
WordPress AfterShip Tracking plugin <= 1.18.1 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in AfterShip Tracking <= 1.18.1 versions.
CVE-2026-66456 Média · 6.5 CWE-79 13/08/2026
WordPress Profile Extra Fields by BestWebSoft plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in Profile Extra Fields by BestWebSoft <= 1.3.4 versions.
CVE-2026-66449 Alta · 7.1 CWE-79 13/08/2026
WordPress Geo Mashup plugin <= 1.13.18 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.18 versions.
CVE-2026-66429 Alta · 7.1 CWE-79 13/08/2026
WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.
CVE-2026-66426 Alta · 7.1 CWE-79 13/08/2026
WordPress WP-Stats plugin <= 2.56 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.56 versions.
CVE-2026-65580 Alta · 7.1 CWE-79 13/08/2026
WordPress Agrion theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Agrion <= 1.0.0 versions.
CVE-2026-61974 Alta · 7.1 CWE-79 13/08/2026
WordPress Mang Board WP plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.3.4 versions.
CVE-2026-61965 Alta · 7.1 CWE-79 13/08/2026
WordPress GeekyBot plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in GeekyBot <= 1.2.6 versions.
CVE-2026-61960 Alta · 7.1 CWE-79 13/08/2026
WordPress WP Full Stripe Free plugin <= 8.5.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions.
CVE-2026-28187 Alta · 7.1 CWE-79 13/08/2026
WordPress Knowledge Base for Documentation, FAQs with AI Assistance plugin <= 17.211.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 versions.