CVE-2025-6429

Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an embed tag. This could have bypassed website security checks that restricted which domains users were allowed to embed. This vulnerability was fixed in Firefox 140, Firefox E...

CVE-2025-6429: Improper Encoding or Escaping of Output

Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an embed tag. This could have bypassed website security checks that restricted which domains users were allowed to embed. This vulnerability was fixed in Firefox 140, Firefox E...

CVE-2025-6430: Improper Neutralization of Input During Web Page Generation

When a file download is specified via the Content-Disposition header, that directive would be ignored if the file was included via a or tag, potentially making a website vulnerable to a cross-site scripting attack. This vulnerability was fixed in Firefox 140, Firefox ESR 128.12, Thunderbird 140,...

CVE-2025-50023

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Chris Coyier CodePen Embed Block codepen-embed-block allows Stored XSS.This issue affects CodePen Embed Block: from n/a through = 1.2.0...

CVE-2025-50023

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Chris Coyier CodePen Embed Block codepen-embed-block allows Stored XSS.This issue affects CodePen Embed Block: from n/a through = 1.2.0...

CVE-2025-50023 WordPress CodePen Embed Block plugin <= 1.2.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Chris Coyier CodePen Embed Block codepen-embed-block allows Stored XSS.This issue affects CodePen Embed Block: from n/a through = 1.2.0...

CVE-2025-50023 WordPress CodePen Embed Block plugin <= 1.2.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Chris Coyier CodePen Embed Block codepen-embed-block allows Stored XSS.This issue affects CodePen Embed Block: from n/a through = 1.2.0...

CVE-2025-50023

CVE-2025-50023 refers to a stored XSS vulnerability in the WordPress CodePen Embed Block (CodePen Embed Block) caused by improper neutralization of input during web page generation. Affected version range is up to 1.1.1 (per NVD/related records). Targeted component: CodePen Embed Block; vulnerabi...

PT-2025-26380 · Unknown · Codepen Embed Block

Name of the Vulnerable Software and Affected Versions: CodePen Embed Block versions through 1.1.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

WordPress Plugin CodePen: Embed Block – Cross-Site Script Vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. The WordPress CodePen Embed Block plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of...

CVE-2025-50023: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Chris Coyier CodePen Embed Block codepen-embed-block allows Stored XSS.This issue affects CodePen Embed Block: from n/a through = 1.2.0...

WordPress CodePen Embed Block plugin <= 1.2.0 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nabil Irawan in WordPress Plugin CodePen Embed Block versions = 1.2.0...

Integer Overflow or Wraparound

Overview org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Integer Overflow or Wraparound via file uploads through servlet containers. An attacker can craft malicious multipart/form-data requests with specially crafted...

cn.hutool.v7:hutool-http (7.0.0-m1), com.cleverpine:cp-virava-spring-helper (>=3.1.9, <=3.1.10) +79 more potentially affected by CVE-2025-52520 via org.apache.tomcat.embed:tomcat-embed-core (>=11.0.0-m1, <=11.0.8)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =11.0.0-m1, =3.1.9, =3.3.0-1231, =3.3.0-1231, =5.0.59, =13.2, =1.0.0, =1.1.6 - com.okta.spring.examples:okta-spring-boot-cloud-config-example 3.0.8 - com.okta.spring.examples:okta-spring-boot-hosted-code-flow-example 3.0.8 -...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +7546 more potentially affected by CVE-2025-52520 via org.apache.tomcat.embed:tomcat-embed-core (>=10.0.0-m1, <=10.1.42)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.0.0-m1, =0.2.0, =0.0.4, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2025-52520 Source advisory:...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.6.0.0), ai.apiverse:apipulse (1.0.1) +13583 more potentially affected by CVE-2025-52520 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.0.m1, <=9.0.106)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.0.m1, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =1.4.2, =1.6.6, =j8.2.2.0, =j8.2.2.0, =2.1.0 and more Source cves: CVE-2025-52520 Source advisory: SNYK:JAVA-ORGAPACHETOMCATEMBED-10674391...

ai.ylyue:yue-library-base (>=finchley.sr2.sr1, <=finchley.sr4.1), ai.ylyue:yue-library-base-crypto (>=finchley.sr4, <=finchley.sr4.1) +4123 more potentially affected by CVE-2025-49125 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.0, <=8.5.100)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.0, =finchley.sr2.sr1, =finchley.sr4, =finchley.sr2.sr1, =finchley.sr2.sr1, =finchley.sr4, =1.0.0, =0.0.2, =0.0.3, =1, =1, =1, =1, =1, =10 - be.ordina:microservices-dashboard-server 1.0.1 and more Source cves: CVE-2025-49125 Source...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +7103 more potentially affected by CVE-2025-49125 via org.apache.tomcat.embed:tomcat-embed-core (>=10.1.0-m1, <=10.1.41)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.1.0-m1, =0.2.0, =0.0.4, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2025-49125 Source advisory:...

com.cleverpine:cp-virava-spring-helper (>=3.1.9, <=3.1.10), com.github.cafdataprocessing.services.staging:staging-service (>=3.3.0-1231, <=3.3.4-1288) +76 more potentially affected by CVE-2025-49124 via org.apache.tomcat.embed:tomcat-embed-core (>=11.0.0-m1, <=11.0.7)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =11.0.0-m1, =3.1.9, =3.3.0-1231, =3.3.0-1231, =5.0.59, =13.2, =1.0.0, =1.1.6 - com.okta.spring.examples:okta-spring-boot-cloud-config-example 3.0.8 - com.okta.spring.examples:okta-spring-boot-hosted-code-flow-example 3.0.8 -...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +7103 more potentially affected by CVE-2025-48988 via org.apache.tomcat.embed:tomcat-embed-core (>=10.1.0-m1, <=10.1.41)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.1.0-m1, =0.2.0, =0.0.4, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2025-48988 Source advisory:...