CVE-2025-58033 WordPress Draft Plugin <= 3.0.9 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in leeshadle Draft website-builder allows Stored XSS.This issue affects Draft: from n/a through = 3.0.9...

CVE-2025-58684

CVE-2025-58684 : Stored XSS in WordPress plugin Logo Showcase (Logo Showcase – Responsive Logo Carousel, Grid, List & Ticker). Affected component/issue: improper neutralization of input during web page generation. Impact: stored XSS vulnerability in logos/grid rendering. Affected versions: up to ...

CVE-2025-58684 WordPress Logo Showcase plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Themepoints Logo Showcase logo-showcase allows Stored XSS.This issue affects Logo Showcase: from n/a through = 4.0.1...

WordPress plugin Logo Showcase 跨站脚本漏洞

WordPress and the WordPress plugin are products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin Draft 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-38972

Name of the Vulnerable Software and Affected Versions Themepoints Logo Showcase versions through 3.0.9 Description The software contains a flaw related to improper input handling during web page generation, which allows for Stored Cross-site Scripting XSS. This means that malicious code can be...

WordPress Savoy Theme <= 3.0.8 is vulnerable to Sensitive Data Exposure

Software Savoy Type Theme Vulnerable versions = 3.0.8 Fixed in 3.0.9 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2025-54736 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID f4b4625ac3c8 Credits Ananda Dhakal Patchstack Required...

tar-fs 路径遍历漏洞

tar-fs is a tar-stream filesystem bundle by the individual developer Mathias Buus. A path traversal vulnerability exists in tar-fs versions prior to 3.0.9, which stems from the ability to write outside of a specified directory when extracting, potentially leading to arbitrary file writes...

CVE-2024-52306

FileManager provides a Backpack admin interface for files and folder. Prior to 3.0.9, deserialization of untrusted data from the mimes parameter could lead to remote code execution. This vulnerability is fixed in 3.0.9...

CVE-2024-28754

RaspAP aka raspap-webgui through 3.0.9 allows remote attackers to cause a persistent denial of service bricking via a crafted request...

CVE-2024-38764

Cross-Site Request Forgery CSRF vulnerability in Marsian allows Cross Site Request Forgery.This issue affects i-transform: from n/a through 3.0.9...

CVE-2024-36622

In RaspAP raspap-webgui 3.0.9 and earlier, a command injection vulnerability exists in the clearlog.php script. The vulnerability is due to improper sanitization of user input passed via the logfile parameter...

CVE-2024-9347

The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpext-export' parameter in all versions up to, and including, 3.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2023-3083

Cross-site Scripting XSS - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9...

CVE-2023-2859

Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.9...

CVE-2023-3190

Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.9...

CVE-2021-25342

Calling of non-existent provider in SMP sdk prior to version 3.0.9 allows unauthorized actions including denial of service attack by hijacking the provider...

WordPress Taskbuilder plugin < 3.0.9 - Admin+ SQL Injection vulnerability

Admin+ SQL Injection vulnerability discovered by Bob Matyas in WordPress Plugin Taskbuilder versions 3.0.9...

CVE-2024-9831

The Taskbuilder WordPress plugin before 3.0.9 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...

CVE-2024-9831

CVE-2024-9831 affects the WordPress Taskbuilder plugin prior to version 3.0.9. The issue is a SQL injection vulnerability caused by not sanitizing/escaping a parameter before it is used in an SQL statement. Impact is admin-level, enabling attacker-controlled SQL actions as described in the source...