CVE-2025-28860 WordPress Google News Editors Picks Feed Generator plugin <= 2.1 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in PPDPurveyor Google News Editors Picks Feed Generator google-news-editors-picks-news-feeds allows Stored XSS.This issue affects Google News Editors Picks Feed Generator: from n/a through = 2.1...

Security Bulletin: JSch could allow a remote attacker to traverse directories on the system which affects watsonx.data

Summary JSch could allow a remote attacker to traverse directories on the system, which may impact watsonx.data. Vulnerability Details CVEID:CVE-2016-5725 DESCRIPTION: JSch could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request ...

CVE-2025-25940

VisiCut 2.1 allows code execution via Insecure XML Deserialization in the loadPlfFile method of VisicutModel.java...

CVE-2025-2133

A vulnerability classified as problematic was found in ftcms 2.1. Affected by this vulnerability is an unknown functionality of the file /admin/index.php/news/edit. The manipulation of the argument title leads to cross site scripting. The attack can be launched remotely. The exploit has been...

PT-2025-10599 · Visicut · Visicut

Name of the Vulnerable Software and Affected Versions: VisiCut version 2.1 Description: The issue allows code execution via insecure XML deserialization in the loadPlfFile method of VisicutModel.java. Recommendations: For VisiCut version 2.1, consider restricting the use of the loadPlfFile method...

CVE-2025-25940

VisiCut 2.1 allows code execution via Insecure XML Deserialization in the loadPlfFile method of VisicutModel.java...

CVE-2025-25940

VisiCut 2.1 allows code execution via Insecure XML Deserialization in the loadPlfFile method of VisicutModel.java...

CVE-2025-25940

VisiCut 2.1 allows code execution via Insecure XML Deserialization in the loadPlfFile method of VisicutModel.java...

CVE-2025-2133

CVE-2025-2133 affects ftcms 2.1. The vulnerability lies in the /admin/index.php/news/edit functionality, where improper handling of the title parameter enables cross‑site scripting. Attackers can exploit remotely; public disclosure exists. Other parameters may be affected. The sources do not prov...

CVE-2025-2133 ftcms edit cross site scripting

A vulnerability classified as problematic was found in ftcms 2.1. Affected by this vulnerability is an unknown functionality of the file /admin/index.php/news/edit. The manipulation of the argument title leads to cross site scripting. The attack can be launched remotely. The exploit has been...

CVE-2025-2132

The CVE-2025-2132 entry concerns ftcms 2.1. An SQL injection vulnerability arises in the Search component, specifically the unknown function in /admin/index.php/web/ajax_all_lists, caused by manipulation of the argument name. It is exploitable remotely over the network. The exploit has been discl...

CVE-2025-2132 ftcms Search ajax_all_lists sql injection

A vulnerability classified as critical has been found in ftcms 2.1. Affected is an unknown function of the file /admin/index.php/web/ajaxalllists of the component Search. The manipulation of the argument name leads to sql injection. It is possible to launch the attack remotely. The exploit has be...

CVE-2025-2132 ftcms Search ajax_all_lists sql injection

A vulnerability classified as critical has been found in ftcms 2.1. Affected is an unknown function of the file /admin/index.php/web/ajaxalllists of the component Search. The manipulation of the argument name leads to sql injection. It is possible to launch the attack remotely. The exploit has be...

Linux Distros Unpatched Vulnerability : CVE-2022-43045

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a segmentation violation via the function gfdumpvrmlsffield at /scenemanager/scenedump.c...

PT-2025-9694

Name of the Vulnerable Software and Affected Versions hzmanyun Education and Training System version 2.1 Description A critical issue was found in the function exportPDF of the file /user/exportPDF, where the manipulation of the argument id leads to command injection. This issue can be exploited...

CVE-2025-25108

CVE-2025-25108 describes a reflected XSS vulnerability in the WordPress SW Plus plugin (versions up to 2.1). The issue arises from improper input neutralization during web page generation, enabling an attacker-controlled input to be reflected in the page. Affected product: WordPress SW Plus plugin

WordPress plugin SW Plus 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

1 Click WordPress Migration Plugin – 100% FREE for a limited time <= 2.2 - Unauthenticated Sensitive Information Exposure via Database Backup in class-ocm-backup.php

Description The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 via the class-ocm-backup.php. This makes it possible for unauthenticated attackers to extract sensitive...

CVE-2025-26543

Cross-Site Request Forgery CSRF vulnerability in Pukhraj Suthar Simple Responsive Menu simple-responsive-menu allows Stored XSS.This issue affects Simple Responsive Menu: from n/a through = 2.1...

CVE-2025-26538

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Dan Rossiter Prezi Embedder prezi-embedder allows Stored XSS.This issue affects Prezi Embedder: from n/a through = 2.1...