ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +6231 more potentially affected by CVE-2025-24813 via org.apache.tomcat.embed:tomcat-embed-core (>=10.0.0-m1, <=10.1.34)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.0.0-m1, =0.2.0, =0.0.4, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2025-24813 Source advisory: MEND:CVE-2025-24813...

com.github.cafdataprocessing.services.staging:staging-service (>=3.3.0-1231, <=3.3.1-1249), com.github.cafdataprocessing.services.staging:staging-service-container (>=3.3.0-1231, <=3.3.1-1249) +33 more potentially affected by CVE-2025-24813 via org.apache.tomcat.embed:tomcat-embed-core (>=11.0.0-m1, <=11.0.2)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =11.0.0-m1, =3.3.0-1231, =3.3.0-1231, =5.0.59, =13.2, =1.0.0, =2.0.0-beta2, =2.0.0 and more Source cves: CVE-2025-24813 Source advisory: MEND:CVE-2025-24813...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.6.0.0), ai.apiverse:apipulse (1.0.1) +13555 more potentially affected by CVE-2025-24813 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.0.m1, <=9.0.98)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.0.m1, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =1.4.2, =1.6.6, =j8.2.2.0, =j8.2.2.0, =2.1.0 and more Source cves: CVE-2025-24813 Source advisory: SNYK:JAVA-ORGAPACHETOMCATEMBED-9396739...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +6214 more potentially affected by CVE-2025-24813 via org.apache.tomcat.embed:tomcat-embed-core (>=10.1.0-m1, <=10.1.34)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.1.0-m1, =0.2.0, =0.0.4, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2025-24813 Source advisory:...

com.github.cafdataprocessing.services.staging:staging-service (>=3.3.0-1231, <=3.3.1-1249), com.github.cafdataprocessing.services.staging:staging-service-container (>=3.3.0-1231, <=3.3.1-1249) +33 more potentially affected by CVE-2025-24813 via org.apache.tomcat.embed:tomcat-embed-core (>=11.0.0-m1, <=11.0.2)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =11.0.0-m1, =3.3.0-1231, =3.3.0-1231, =5.0.59, =13.2, =1.0.0, =2.0.0-beta2, =2.0.0 and more Source cves: CVE-2025-24813 Source advisory: SNYK:JAVA-ORGAPACHETOMCATEMBED-9396739https://vulners.com/snyk/SNYK:JAVA-ORGAPACHETOMCATEMB...

CVE-2025-1043

CVE-2025-1043 – The WordPress plugin Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files is affected by a Server-Side Request Forgery (SSRF) in all versions up to 2.7.5 via the embeddoc shortcode. With Contributor-level access or higher, an authenticated attacker can cause the web ap...

CVE-2025-1043 Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files <= 2.7.5 - Authenticated (Contributor+) Blind Server-Side Request Forgery via embeddoc Shortcode

The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.5 via the 'embeddoc' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-1043 Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files <= 2.7.5 - Authenticated (Contributor+) Blind Server-Side Request Forgery via embeddoc Shortcode

The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.5 via the 'embeddoc' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-1043: Server-Side Request Forgery (SSRF)

The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.5 via the 'embeddoc' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and...

PT-2025-7487

Name of the Vulnerable Software and Affected Versions Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress versions up to, and including, 2.7.5 Description The issue allows authenticated attackers, with Contributor-level access and above, to make web requests to...

WordPress Embed Any Document plugin <= 2.7.5 - Authenticated (Contributor+) Blind Server-Side Request Forgery via embeddoc Shortcode vulnerability

Authenticated Contributor+ Blind Server-Side Request Forgery via embeddoc Shortcode vulnerability discovered by theviper17y in WordPress Plugin Embed Any Document versions = 2.7.5...

CVE-2024-12522: Improper Neutralization of Input During Web Page Generation

The Yay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'yayforms' shortcode in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-13743 Wonder Video Embed <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Wonder Video Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wonderpluginvideo shortcode in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-13743 Wonder Video Embed <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Wonder Video Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wonderpluginvideo shortcode in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress Wonder Video Embed plugin <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by Krzysztof Zając in WordPress Plugin Wonder Video Embed versions = 2.2...

WordPress plugin Wonder Video Embed has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-6607

Name of the Vulnerable Software and Affected Versions Wonder Video Embed plugin for WordPress versions up to and including 2.2 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the wonderplugin video shortcode. This allows...

CVE-2024-13743: Improper Neutralization of Input During Web Page Generation

The Wonder Video Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wonderpluginvideo shortcode in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-23523

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in hoststreamsell HSS Embed Streaming Video hss-embed-streaming-video allows Reflected XSS.This issue affects HSS Embed Streaming Video: from n/a through = 3.23...

CVE-2025-26539

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in petkivim Embed Google Map embed-google-map allows Stored XSS.This issue affects Embed Google Map: from n/a through = 3.2...