1556 matches found
CVE-2025-53254 WordPress Cyrlitera plugin <= 1.3.0 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Themeisle Cyrlitera cyrlitera allows Cross Site Request Forgery.This issue affects Cyrlitera: from n/a through = 1.3.0...
WordPress plugin Networker 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
PT-2025-27119 · Amwerk · Amwerk
Name of the Vulnerable Software and Affected Versions: Amwerk versions 1.2.0 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For Amwerk versions 1.2.0 and earlier, at the moment, there is no information about a...
WordPress plugin Amwerk 代码问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...
Open Redirect
Overview Affected versions of this package are vulnerable to Open Redirect via the redirecturl parameter in the /xxl-sso-server/doLogin and /xxl-sso-server/login endpoints. An attacker can redirect users to arbitrary external sites by crafting a malicious link and tricking authenticated users int...
CVE-2025-49149
Dify is an open-source LLM app development platform. In version 1.2.0, there is insufficient filtering of user input by web applications. Attackers can use website vulnerabilities to inject malicious script code into web pages. This may result in a cross-site scripting XSS attack when a user...
CVE-2025-50038
CVE-2025-50038 is a stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Anant Addons for Elementor (versions ≤ 1.2.0, per initial description). Connected sources corroborate a broader vulnerable range (plugins ≤ 1.2.8) and attribute the issue to improper input neutralization d...
CVE-2025-49149
Dify is an open-source LLM app development platform. In version 1.2.0, there is insufficient filtering of user input by web applications. Attackers can use website vulnerabilities to inject malicious script code into web pages. This may result in a cross-site scripting XSS attack when a user...
CVE-2025-49149 Dify has XSS vulnerability
Dify is an open-source LLM app development platform. In version 1.2.0, there is insufficient filtering of user input by web applications. Attackers can use website vulnerabilities to inject malicious script code into web pages. This may result in a cross-site scripting XSS attack when a user...
CVE-2025-30618
Deserialization of Untrusted Data vulnerability in yuliaz Rapyd Payment Extension for WooCommerce rapyd-payments allows Object Injection.This issue affects Rapyd Payment Extension for WooCommerce: from n/a through = 1.2.0...
PT-2025-25765 · Dify · Dify
Name of the Vulnerable Software and Affected Versions: Dify version 1.2.0 Description: Dify is an open-source LLM app development platform. In this platform, there is insufficient filtering of user input by web applications, which allows attackers to inject malicious script code into web pages...
WordPress plugin Rapyd Payment Extension for WooCommerce 代码问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in...
dify 跨站脚本漏洞
dify is an open source LLM application development platform from LangGenius Open Source. A cross-site scripting vulnerability exists in dify version 1.2.0, which stems from insufficient user input filtering and could lead to cross-site scripting attacks...
Argo CD 跨站脚本漏洞
Argo CD is an Argo open source declarative GitOps continuous delivery tool for Kubernetes. A cross-site scripting vulnerability exists in Argo CD 1.2.0-rc1 and earlier versions, which stems from insufficient URL protocol filtering and could lead to cross-site scripting attacks...
CVE-2025-47535
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in wpopal Opal Woo Custom Product Variation opal-woo-custom-product-variation allows Path Traversal.This issue affects Opal Woo Custom Product Variation: from n/a through = 1.2.0...
CVE-2025-47535
CVE-2025-47535 (Opal Woo Custom Product Variation) affects WordPress plugin Opal Woo Custom Product Variation, versions up to and including 1.2.0. The issue is described as an improper limitation of a pathname to a restricted directory, i.e., a Path Traversal, which can enable Arbitrary File Dele...
CVE-2024-52357
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in lqd LIQUID BLOCKS liquid-blocks allows Stored XSS.This issue affects LIQUID BLOCKS: from n/a through = 1.2.0...
CVE-2024-25722
qanythingkernel/connector/database/mysql/mysqlclient.py in qanything.ai QAnything before 1.2.0 allows SQL Injection...
CVE-2024-56263
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in GS Plugins GS Shots for Dribbble gs-dribbble-portfolio allows DOM-Based XSS.This issue affects GS Shots for Dribbble: from n/a through = 1.2.0...