tag
Session-Hijacking
Critical
PrestaShop Checkout Zero-Click Account Takeover via ExpressCheckout Endpoint (CVE-2025-61922)
CVE-2025-61922·
PrestaShop Checkout module (ps_checkout)
unpatched
Critical
CrushFTP AS2 Header Authentication Bypass (CVE-2025-54309)
CVE-2025-54309·
CrushFTP server, AS2 (Applicability Statement 2) authentication module / web admin interface
patched
High
Termix Stored XSS via Malicious SVG Upload -> LFI / Session Hijack (CVE-2026-22804 / GHSA-m3cv-5hgp-hv35)
CVE-2026-22804 (GHSA-m3cv-5hgp-hv35)·
Termix (Electron-based SSH/terminal manager), File Manager component (FileViewer.tsx)
patched
High
Saleor Rich Text (EditorJS) Field Stored XSS (CVE-2026-22849)
CVE-2026-22849 (GHSA-8jcj-r5g2-qrpv)·
Saleor (open-source e-commerce platform), rich text fields (EditorJS content on pages/products)
unpatched
Medium
OpenSTAManager Reflected XSS via `righe` Parameter (CVE-2026-24415)
CVE-2026-24415 (GHSA-jfgp-g7x7-j25j)·
OpenSTAManager (devcode-it/openstamanager)
patched
Medium
NextScripts Social Networks Auto-Poster — WordPress Stored XSS (CVE-2026-3228)
CVE-2026-3228·
NextScripts: Social Networks Auto-Poster (WordPress plugin)
unpatched