CVE-2026-97315
The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some of the values submitted with its Form block before addi
CVSS
5.4
Medio
EPSS
—
KEV
—
Exploit Today
0
0-100
Publicado: 14 oct 2026 · Última mod.: 14 oct 2026 · CWE-74
Sin historial EPSS suficiente todavía.
The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some of the values submitted with its Form block before adding them to the HTML notification email sent to the site owner, allowing unauthenticated users to inject arbitrary HTML, such as phishing links, into that email.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1106707.3 ALT—
——0A vulnerability was found in cemtan sar2html 4.0.0. The affected element is the function updateDb of the file sar2html.py of the component Archive Processing. The manipulation of the argument s2host results in sql injection. The attack can be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.10hCVE-2026-1106687.3 ALT—
——0A weakness has been identified in cemtan sar2html 4.0.0. Affected by this issue is the function index of the file sar2html.py. This manipulation of the argument sort causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.11hCVE-2026-880948.1 ALT49.2%
——15Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Storage Library allows an authorized attacker to elevate privileges over a network.1dCVE-2026-1096207.3 ALT33.9%
——10A vulnerability has been found in SourceCodester Online Reviewer System 1.0. Affected by this vulnerability is the function PDO::prepare of the file login/index.php. Such manipulation of the argument username/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.15hCVE-2026-1096077.3 ALT33.9%
——10A flaw has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file adminpanel/admin/query/loginExe.php of the component Login Endpoint. This manipulation of the argument username/pass causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.2dCVE-2026-1096067.3 ALT33.9%
——10A vulnerability was detected in SourceCodester Art Gallery Management System 1.0. This impacts the function Action::save_user of the file admin/admin_class.php of the component Account Creation. The manipulation of the argument Name results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.2d