CWE-94

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100358",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T22:37:21.689876Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T22:37:40.336Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SuiteCRM",
          "vendor": "SuiteCRM",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.15.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.10.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Studio Dropdown Editor passes $dropdown_name through html_entity_decode() and writes the result verbatim into a PHP language file under custom/ that is included on later page loads. An administrator can inject persistent PHP that executes as the web-server account, survives cache clears, and compromises application and host confidentiality, integrity, and availability. This issue is fixed in versions 7.15.2 and 8.10.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-05T18:47:59.749Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-4773-c8fh-3rww",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-4773-c8fh-3rww"
        },
        {
          "name": "https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68"
        },
        {
          "name": "https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c"
        },
        {
          "name": "https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2"
        },
        {
          "name": "https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2"
        }
      ],
      "source": {
        "advisory": "GHSA-4773-c8fh-3rww",
        "discovery": "UNKNOWN"
      },
      "title": "SuiteCRM: Admin  OS RCE via Dropdown Editor PHP Injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-100358",
    "datePublished": "2026-11-05T18:47:59.749Z",
    "dateReserved": "2026-09-25T19:19:54.698Z",
    "dateUpdated": "2026-11-09T22:37:40.336Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100313",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-28T19:14:41.743465Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-28T19:17:01.191Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:*"
          ],
          "product": "CloudClassroom-PHP-Project",
          "vendor": "mathurvishal",
          "versions": [
            {
              "status": "affected",
              "version": "5dadec098bfbbf3300d60c3494db3fb95b66e7be"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "vinniboy021 (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of the file updatequery.php. Executing a manipulation of the argument queryx can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Cross Site Scripting",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Code Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-26T11:15:10.990Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-410441 | mathurvishal CloudClassroom-PHP-Project updatequery.php cross site scripting",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/410441"
        },
        {
          "name": "VDB-410441 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/410441/cti"
        },
        {
          "name": "CVE-2026-100313 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-100313"
        },
        {
          "name": "Submit #914577 | https://github.com/mathurvishal/CloudClassroom-PHP-Project CloudClassroom-PHP-Project 5dadec098bfbbf3300d60c3494db3fb95b66e7be Cross Site Scripting",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/914577"
        },
        {
          "tags": [
            "broken-link",
            "exploit",
            "patch"
          ],
          "url": "https://github.com/vinniboy021-blip/Advisory/blob/main/updatequery-stored-xss.md"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-25T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-25T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-25T21:15:26.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "mathurvishal CloudClassroom-PHP-Project updatequery.php cross site scripting",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-100313",
    "datePublished": "2026-09-26T11:15:10.990Z",
    "dateReserved": "2026-09-25T19:10:06.310Z",
    "dateUpdated": "2026-09-28T19:17:01.191Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100311",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-28T17:01:55.324240Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-28T17:02:10.205Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Faculty Video Management"
          ],
          "product": "CloudClassroom-PHP-Project",
          "vendor": "mathurvishal",
          "versions": [
            {
              "status": "affected",
              "version": "5dadec098bfbbf3300d60c3494db3fb95b66e7be"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "raffarj (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The affected element is an unknown function of the file managevideos2.php of the component Faculty Video Management. Such manipulation of the argument V_Title/V_Url/V_Remarks leads to cross site scripting. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Cross Site Scripting",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Code Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-26T08:00:10.040Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-410439 | mathurvishal CloudClassroom-PHP-Project Faculty Video Management managevideos2.php cross site scripting",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/410439"
        },
        {
          "name": "VDB-410439 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/410439/cti"
        },
        {
          "name": "CVE-2026-100311 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-100311"
        },
        {
          "name": "Submit #914572 | https://github.com/mathurvishal/CloudClassroom-PHP-Project/blob/ CloudClassroom PHP Project 5dadec098bfbbf3300d60c3494db3fb95b66e7be Cross Site Scripting",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/914572"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/raffarj/CVE/tree/main"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-25T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-25T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-25T21:15:19.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "mathurvishal CloudClassroom-PHP-Project Faculty Video Management managevideos2.php cross site scripting",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-100311",
    "datePublished": "2026-09-26T08:00:10.040Z",
    "dateReserved": "2026-09-25T19:09:58.070Z",
    "dateUpdated": "2026-09-28T17:02:10.205Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100174",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-25T15:14:24.607198Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-25T15:14:51.969Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "tag selector (tags.js)"
          ],
          "product": "ail framework",
          "programFiles": [
            "var/www/static/js/tags.js"
          ],
          "repo": "https://github.com/ail-project/ail-framework",
          "vendor": "ail project",
          "versions": [
            {
              "lessThan": "7.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Aurelien Thirion"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Jeroen Pinoy"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe AIL Framework tag selector component (var/www/static/js/tags.js) is vulnerable to stored cross-site scripting (XSS). A user with the ability to create a custom tag could embed an HTML payload containing JavaScript event handlers (e.g., \u0026lt;img src=x onerror=alert(1)\u0026gt; or \u0026lt;svg onload=...\u0026gt;) in the tag name. When another authenticated user opened a page containing the tag selector, the malicious tag name was inserted into the DOM using jQuery\u0027s html property, causing the embedded script to execute in the victim\u0027s browser context.\u003c/p\u003e\u003cp\u003eThe vulnerable code paths affected both the suggestion/combo-item rendering (_renderComboItems) and the selected-tag rendering logic. In both cases, the display value derived from the tag\u0027s displayField was passed directly to the html property of a jQuery element constructor, which parses and inserts the string as raw HTML rather than as text.\u003c/p\u003e\u003cp\u003ePreconditions: the attacker must have an authenticated account with permission to create custom tags, and the victim must be an authenticated user who views a page that renders the tag selector with the attacker\u0027s stored tag. The attack is stored (persistent) and does not require the victim to perform any action beyond loading the page.\u003c/p\u003e\u003cp\u003eSecurity impact: successful exploitation allows arbitrary JavaScript execution in the victim\u0027s browser within the application\u0027s origin, potentially leading to session hijacking, unauthorized data access, form manipulation, or further client-side attacks.\u003c/p\u003e"
            }
          ],
          "value": "The AIL Framework tag selector component (var/www/static/js/tags.js) is vulnerable to stored cross-site scripting (XSS). A user with the ability to create a custom tag could embed an HTML payload containing JavaScript event handlers (e.g., \u003cimg src=x onerror=alert(1)\u003e or \u003csvg onload=...\u003e) in the tag name. When another authenticated user opened a page containing the tag selector, the malicious tag name was inserted into the DOM using jQuery\u0027s html property, causing the embedded script to execute in the victim\u0027s browser context.\n\nThe vulnerable code paths affected both the suggestion/combo-item rendering (_renderComboItems) and the selected-tag rendering logic. In both cases, the display value derived from the tag\u0027s displayField was passed directly to the html property of a jQuery element constructor, which parses and inserts the string as raw HTML rather than as text.\n\nPreconditions: the attacker must have an authenticated account with permission to create custom tags, and the victim must be an authenticated user who views a page that renders the tag selector with the attacker\u0027s stored tag. The attack is stored (persistent) and does not require the victim to perform any action beyond loading the page.\n\nSecurity impact: successful exploitation allows arbitrary JavaScript execution in the victim\u0027s browser within the application\u0027s origin, potentially leading to session hijacking, unauthorized data access, form manipulation, or further client-side attacks."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-66",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-66 Cross Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T13:22:38.669Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ail-project/ail-framework/commit/b2d0ed05f6cf79b2312a3f1f923d0d1a5d7a9edb"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix ensures that tag names and display values are rendered as plain text rather than as HTML when no custom renderer is explicitly configured. In the suggestion rendering path, the default (non-renderer) case now uses jQuery\u0027s .text() method, which HTML-escapes the content. In the selection rendering path, the default case uses document.createTextNode() to insert the value as a text node. Custom renderers, which are developer-supplied and trusted to produce safe HTML, continue to use .html() or .prepend() with raw HTML. The eval() call was also replaced with JSON.parse() to eliminate a code-injection vector.\u003c/p\u003e"
            }
          ],
          "value": "The fix ensures that tag names and display values are rendered as plain text rather than as HTML when no custom renderer is explicitly configured. In the suggestion rendering path, the default (non-renderer) case now uses jQuery\u0027s .text() method, which HTML-escapes the content. In the selection rendering path, the default case uses document.createTextNode() to insert the value as a text node. Custom renderers, which are developer-supplied and trusted to produce safe HTML, continue to use .html() or .prepend() with raw HTML. The eval() call was also replaced with JSON.parse() to eliminate a code-injection vector."
        }
      ],
      "title": "Stored Cross-Site Scripting (XSS) in AIL Framework Tag Selector via Unescaped Tag Names",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "none",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is inferred from the tag_version_boundary metadata indicating the fix commit is 31 commits before the v7.1 tag; exact version boundaries are not explicitly stated in the patch.",
                  "The UI:P (Passive) rating assumes the victim only needs to load a page containing the tag selector; if the application requires the victim to explicitly open a specific dialog or widget, UI:A (Active) could be more appropriate.",
                  "The CAPEC-66 mapping is the closest available pattern; no CAPEC entry specifically covers stored XSS in a tag-selector UI component, so the general XSS pattern is used.",
                  "The PR:L rating assumes that creating a custom tag requires only a basic authenticated account; if tag creation requires elevated privileges, PR:H would be more appropriate.",
                  "The eval() to JSON.parse() change is treated as a secondary hardening fix within the same patch set; the primary vulnerability addressed is the stored XSS in tag rendering.",
                  "No specific reporter or finder is identified in the patch metadata or commit message; only the remediation developer (commit author) is credited."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-66",
                    "rationale": "CAPEC-66 describes the general XSS attack pattern where attacker-controlled input is reflected or stored and later rendered as executable content in a victim\u0027s browser. This patch fixes a stored XSS variant where malicious tag names are persisted and rendered as HTML. The mapping is direct and well-supported by the commit message and code changes. No more specific CAPEC entry for stored XSS in a tag/selector widget exists in the CAPEC catalog, making CAPEC-66 the closest and most appropriate match."
                  }
                ],
                "commit": "b2d0ed05f6cf79b2312a3f1f923d0d1a5d7a9edb",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "terrtia"
                  }
                ],
                "cvssRationale": "AV:N: The vulnerability is exploitable over the network via a web application. AC:L: No race conditions or special timing are required; the payload is stored and triggers on page load. AT:N: No manipulation of the attack target is needed; the stored payload executes automatically. PR:L: The attacker needs a low-privilege authenticated account with permission to create custom tags. UI:P: The victim passively interacts by loading a page that contains the tag selector; no active click or download is required. VC:L: The XSS can read data from the victim\u0027s session and page context. VI:L: The XSS can modify page content and submit forms. VA:N: No availability impact is evident. SC:L: The compromised session can access other resources within the same origin. SI:L: The attacker can modify data through the victim\u0027s authenticated session. SA:N: No availability impact on subsequent components.",
                "fixSummary": "The fix ensures that tag names and display values are rendered as plain text rather than as HTML when no custom renderer is explicitly configured. In the suggestion rendering path, the default (non-renderer) case now uses jQuery\u0027s .text() method, which HTML-escapes the content. In the selection rendering path, the default case uses document.createTextNode() to insert the value as a text node. Custom renderers, which are developer-supplied and trusted to produce safe HTML, continue to use .html() or .prepend() with raw HTML. The eval() call was also replaced with JSON.parse() to eliminate a code-injection vector.",
                "generatedAt": "2026-09-25T13:16:06.156442Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 6,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 4
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "2d147dabcc9bebce7722917d80f13e49a10f9a2a4089ec6207cce9edb9187f77",
                "patchSummary": "In var/www/static/js/tags.js: (1) Replaced eval(data) with JSON.parse(data) for parsing array-like data strings. (2) In _renderComboItems, introduced a hasRenderer flag; when no custom renderer is set, the displayed value is inserted via resultItemEl.text(displayed) instead of the html property in the jQuery constructor. (3) In the selection rendering block, introduced a hasSelectionRenderer flag; when no custom selection renderer is set, the value is prepended as a text node via document.createTextNode(selectedItemHtml) instead of being set through the html property. (4) The comma separator for text-mode selections is now appended as a text node rather than concatenated into an HTML string.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "b2d0ed05f6cf79b2312a3f1f923d0d1a5d7a9edb",
                    "patchSha256": "2d147dabcc9bebce7722917d80f13e49a10f9a2a4089ec6207cce9edb9187f77",
                    "source": "https://github.com/ail-project/ail-framework/commit/b2d0ed05f6cf79b2312a3f1f923d0d1a5d7a9edb.patch",
                    "sourceUrl": "https://github.com/ail-project/ail-framework/commit/b2d0ed05f6cf79b2312a3f1f923d0d1a5d7a9edb.patch",
                    "subject": "chg: [security] prevent stored XSS in"
                  }
                ],
                "source": "https://github.com/ail-project/ail-framework/commit/b2d0ed05f6cf79b2312a3f1f923d0d1a5d7a9edb.patch",
                "subject": "chg: [security] prevent stored XSS in",
                "tagVersionBoundary": {
                  "commits_after_fix": 31,
                  "repository": "https://github.com/ail-project/ail-framework",
                  "tag": "v7.1",
                  "version": "7.1",
                  "version_type": "custom"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-79",
                    "rationale": "The patch explicitly addresses stored XSS: user-controlled tag names were inserted into the DOM as HTML via jQuery\u0027s html property without escaping. The fix renders these values as text nodes, which is the canonical remediation for CWE-79. The commit subject line also explicitly states \u0027prevent stored XSS\u0027."
                  },
                  {
                    "cweId": "CWE-94",
                    "rationale": "The replacement of eval(data) with JSON.parse(data) addresses a secondary code-injection weakness where a crafted data string could execute arbitrary JavaScript. This is a contributing factor but the primary vulnerability is the stored XSS in tag rendering."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20269"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-100174",
    "datePublished": "2026-09-25T13:22:38.669Z",
    "dateReserved": "2026-09-25T13:22:15.197Z",
    "dateUpdated": "2026-09-25T15:14:51.969Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100159",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T14:50:08.374687Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T15:09:41.509Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Popup Box \u2013 Create Countdown, Coupon, Video, Contact Form Popups",
          "vendor": "ays-pro",
          "versions": [
            {
              "lessThanOrEqual": "6.4.2",
              "status": "affected",
              "version": "6.4.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "YC_Infosec"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ays_popup_get_user_ip() function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only with sanitize_text_field() (which does not strip the bracket, quote, space, or \u0027=\u0027 characters used by shortcode syntax), substituting the value into a popup body wherever the %%user_ip_address%% token appears (a raw str_replace with no escaping in Ays_Pb_Data::replace_message_variables()), and then passing the resulting body to do_shortcode() in Ays_Pb_Public::ays_autoembed() at output on the wp_footer hook. This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes with attacker-supplied attributes on the server whenever an administrator has added the %%user_ip_address%% token to a popup\u0027s Custom Content body, which can be leveraged to read arbitrary data or perform other actions exposed by shortcodes installed on the site."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T02:26:09.256Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/535c4796-d1aa-4cd1-922e-f9dcf216f76d?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/class-ays-pb-public.php#L3389"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L4560"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L4299"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/includes/class-ays-pb-data.php#L79"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L69"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.3/public/class-ays-pb-public.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-25T12:34:28.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-15T13:57:16.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-100159",
    "datePublished": "2026-10-16T02:26:09.256Z",
    "dateReserved": "2026-09-25T12:19:23.903Z",
    "dateUpdated": "2026-10-16T15:09:41.509Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100157",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-03T15:24:14.767164Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-03T15:42:41.054Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Ultimate Review",
          "vendor": "roxnor",
          "versions": [
            {
              "lessThanOrEqual": "2.4.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "walid213"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The nonce required to pass the only gate is emitted to unauthenticated visitors via the public review form, and submitted shortcode payloads are auto-published without admin approval by default, meaning exploitation requires no account and no privileged interaction."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T06:38:26.027Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ee3690d9-d1c3-4653-948b-cba1a7653574?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.3/app/content.php#L347"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.3/app/content.php#L217"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.3/app/content.php#L52"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-review/tags/2.4.3/init.php#L286"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3720426%40wp-ultimate-review\u0026new=3720426%40wp-ultimate-review"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-25T12:33:09.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-02T17:41:41.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Ultimate Review \u003c= 2.4.3 - Unauthenticated Arbitrary Shortcode Execution via \u0027xs_reviw_summery\u0027 Parameter (Split-Shortcode / Late-Registered Shortcode)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-100157",
    "datePublished": "2026-10-03T06:38:26.027Z",
    "dateReserved": "2026-09-25T12:18:04.662Z",
    "dateUpdated": "2026-10-03T15:42:41.054Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100155",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-02T14:50:33.517770Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-02T14:50:42.803Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures \u0026 AI Form Builder",
          "vendor": "kstover",
          "versions": [
            {
              "lessThanOrEqual": "3.15.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kuba"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The The Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures \u0026 AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-31T05:33:08.113Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a1cf42f7-77c6-4594-a6a4-cebf5c3558d7?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.4/includes/Actions/SuccessMessage.php#L63"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.4/includes/Actions/SuccessMessage.php#L70"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.4/includes/AJAX/Controllers/Submission.php#L52"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.4/includes/Abstracts/MergeTags.php#L64"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.4/includes/MergeTags/Fields.php#L268"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.4/includes/AJAX/Controllers/Submission.php#L60"
        },
        {
          "url": "https://wordpress.org/plugins/ninja-forms/"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3749135%40ninja-forms%2Ftags%2F3.15.6\u0026old=3717122%40ninja-forms%2Ftags%2F3.15.5"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-25T12:32:38.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-30T17:25:47.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Ninja Forms \u003c= 3.15.5 - Unauthenticated Arbitrary Shortcode Execution via \u0027formData\u0027 Field Value via Success Message Merge Tag"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-100155",
    "datePublished": "2026-10-31T05:33:08.113Z",
    "dateReserved": "2026-09-25T12:17:34.300Z",
    "dateUpdated": "2026-11-02T14:50:42.803Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100152",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-03T15:27:31.930798Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-03T15:42:44.600Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings \u0026 Traffic (Schema, Local SEO, Sitemap \u0026 SEO Insights)",
          "vendor": "smub",
          "versions": [
            {
              "lessThanOrEqual": "5.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kuba"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The The All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings \u0026 Traffic (Schema, Local SEO, Sitemap \u0026 SEO Insights) plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.2 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This requires the AIOSEO breadcrumb to be rendered on the search results page via the block, widget, shortcode, or template tag."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T05:29:16.146Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9fa47d2b-e9a9-4d1b-b933-fd4aa453ba1a?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/5.0.2/app/Common/Breadcrumbs/Frontend.php#L280"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/5.0.2/app/Common/Breadcrumbs/Frontend.php#L104"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/5.0.2/app/Common/Breadcrumbs/Breadcrumbs.php#L242"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/5.0.2/app/Common/Breadcrumbs/Tags.php#L108"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3723760/all-in-one-seo-pack/trunk/app/Common/Breadcrumbs/Frontend.php?old=3709877\u0026old_path=all-in-one-seo-pack%2Ftrunk%2Fapp%2FCommon%2FBreadcrumbs%2FFrontend.php"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3723760/all-in-one-seo-pack/trunk/app/Common/Breadcrumbs/Frontend.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-25T12:19:21.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-02T16:33:28.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "All in One SEO \u003c= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution via \u0027s\u0027 Search Query Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-100152",
    "datePublished": "2026-10-03T05:29:16.146Z",
    "dateReserved": "2026-09-25T12:04:15.445Z",
    "dateUpdated": "2026-10-03T15:42:44.600Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-97897",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T17:52:12.671880Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T17:54:15.390Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/carlosalbertotuma/advisory/blob/main/advisory-03-stored-xss-tinymce-media-upload.md"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:krayin:laravel-crm:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "TinyMCE Media Upload"
          ],
          "product": "laravel-crm",
          "vendor": "Krayin",
          "versions": [
            {
              "status": "affected",
              "version": "2.2.0"
            },
            {
              "status": "affected",
              "version": "2.2.1"
            },
            {
              "status": "affected",
              "version": "2.2.2"
            },
            {
              "status": "affected",
              "version": "2.2.3"
            },
            {
              "status": "affected",
              "version": "2.2.4"
            },
            {
              "status": "affected",
              "version": "2.2.5"
            },
            {
              "status": "unaffected",
              "version": "2.2.6"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "bl4dsc4n (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The attack may be performed from remote. Upgrading to version 2.2.6 is capable of addressing this issue. The patch is identified as 734aa10ae6c2ffa4c96c8869a89aa66940e4d345. You should upgrade the affected component."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:ND/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Cross Site Scripting",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Code Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T18:45:09.156Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-409909 | Krayin laravel-crm TinyMCE Media Upload Sanitizer.php cross site scripting",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/vuln/409909"
        },
        {
          "name": "VDB-409909 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/409909/cti"
        },
        {
          "name": "CVE-2026-97897 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-97897"
        },
        {
          "name": "Submit #915413 | Krayin Krayin CRM \u2264 2.2.5 Cross Site Scripting",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/915413"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://github.com/carlosalbertotuma/advisory/blob/main/advisory-03-stored-xss-tinymce-media-upload.md"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/krayin/laravel-crm/pull/2639"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/krayin/laravel-crm/commit/734aa10ae6c2ffa4c96c8869a89aa66940e4d345"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/krayin/laravel-crm/releases/tag/v2.2.6"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/krayin/laravel-crm/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-25T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-25T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-25T12:10:48.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Krayin laravel-crm TinyMCE Media Upload Sanitizer.php cross site scripting",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-97897",
    "datePublished": "2026-09-25T18:45:09.156Z",
    "dateReserved": "2026-09-25T10:05:32.174Z",
    "dateUpdated": "2026-09-29T17:54:15.390Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-97896",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T00:01:46.346618Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T00:01:55.385Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:krayin:laravel-crm:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Upload Functionality"
          ],
          "product": "laravel-crm",
          "vendor": "krayin",
          "versions": [
            {
              "status": "affected",
              "version": "2.2.0"
            },
            {
              "status": "affected",
              "version": "2.2.1"
            },
            {
              "status": "affected",
              "version": "2.2.2"
            },
            {
              "status": "affected",
              "version": "2.2.3"
            },
            {
              "status": "affected",
              "version": "2.2.4"
            },
            {
              "status": "affected",
              "version": "2.2.5"
            },
            {
              "status": "unaffected",
              "version": "2.2.6"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "bl4dsc4n (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was identified in krayin laravel-crm up to 2.2.5. This vulnerability affects the function ConfigurationForm::rules of the file packages/Webkul/Admin/src/Http/Requests/ConfigurationForm.php of the component Upload Functionality. The manipulation leads to cross site scripting. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. Upgrading to version 2.2.6 is able to resolve this issue. The identifier of the patch is b9836530ec9f5ef0f51653bb0cbbc47ef7184f51. It is advisable to upgrade the affected component."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Cross Site Scripting",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Code Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T18:30:19.532Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-409908 | krayin laravel-crm Upload Functionality ConfigurationForm.php rules cross site scripting",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/409908"
        },
        {
          "name": "VDB-409908 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/409908/cti"
        },
        {
          "name": "CVE-2026-97896 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-97896"
        },
        {
          "name": "Submit #915399 | Krayin Krayin CRM \u2264 2.2.5 Cross Site Scripting",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/915399"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/krayin/laravel-crm/issues/2617"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/krayin/laravel-crm/pull/2620"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/carlosalbertotuma/advisory/blob/main/advisory-02-config-upload-xss.md"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/krayin/laravel-crm/commit/b9836530ec9f5ef0f51653bb0cbbc47ef7184f51"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/krayin/laravel-crm/releases/tag/v2.2.6"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/krayin/laravel-crm/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-25T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-25T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-25T12:10:44.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "krayin laravel-crm Upload Functionality ConfigurationForm.php rules cross site scripting",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-97896",
    "datePublished": "2026-09-25T18:30:19.532Z",
    "dateReserved": "2026-09-25T10:05:26.998Z",
    "dateUpdated": "2026-09-30T00:01:55.385Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}