CVE-2025-31687 SpamSpan filter - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-016

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal SpamSpan filter allows Cross-Site Scripting XSS.This issue affects SpamSpan filter: from 0.0.0 before 3.2.1...

CVE-2025-2974

A vulnerability has been found in CodeCanyon Perfex CRM up to 3.2.1 and classified as problematic. This vulnerability affects unknown code of the file /contract of the component Contracts. The manipulation of the argument content leads to cross site scripting. The attack can be initiated remotely...

CodeCanyon Perfex CRM 代码注入漏洞

CodeCanyon Perfex CRM is a self-hosted customer relationship management software from CodeCanyon. A code injection vulnerability exists in CodeCanyon Perfex CRM 3.2.1 and prior versions, which stems from the fact that incorrect manipulation of the parameter content can lead to cross-site scriptin...

Drupal SpamSpan filter 跨站脚本漏洞

Drupal SpamSpan filter is a Drupal community module for spam prevention. A cross-site scripting vulnerability exists in Drupal SpamSpan filter versions prior to 3.2.1, which stems from improper input neutralization and could lead to cross-site scripting attacks...

CVE-2025-26898 WordPress Traveler theme < 3.2.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in shinetheme Traveler traveler.This issue affects Traveler: from n/a through 3.2.1...

WordPress Traveler theme < 3.2.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Theme Traveler versions 3.2.1...

WordPress Traveler theme < 3.2.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Theme Traveler versions 3.2.1...

WordPress Traveler theme < 3.2.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Rafie Muhammad Patchstack in WordPress Theme Traveler versions 3.2.1...

WordPress Traveler theme <= 3.1.8 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Rafie Muhammad Patchstack in WordPress Theme Traveler versions 3.2.1...

PT-2025-13400 · Unknown · Shinetheme Traveler

Name of the Vulnerable Software and Affected Versions: Shinetheme Traveler versions prior to 3.2.1 Description: The issue is related to the deserialization of untrusted data, which can lead to remote code execution. This is a critical severity issue. It is mentioned that there is a potential for...

CVE-2024-50631

Improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability in the system syncing daemon in Synology Drive Server before 3.0.4-12699, 3.2.1-23280, 3.5.0-26085 and 3.5.1-26102 allows remote attackers to inject SQL commands, limited to write operations, via...

Linux Distros Unpatched Vulnerability : CVE-2016-8688

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The mtree bidder in libarchive 3.2.1 does not keep track of line sizes when extending the read-ahead, which allows remote attackers to cause a denial of service...

CVE-2025-26751 WordPress Alphabetic Pagination Plugin <= 3.2.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Fahad Mahmood Alphabetic Pagination alphabetic-pagination allows Reflected XSS.This issue affects Alphabetic Pagination: from n/a through = 3.2.1...

PT-2025-7826 · Unknown · Alphabetic Pagination

Name of the Vulnerable Software and Affected Versions: Alphabetic Pagination versions 3.2.1 and earlier Description: The issue is related to improper neutralization of input during web page generation, which leads to a Cross-site Scripting XSS vulnerability. Specifically, it allows for Reflected...

PT-2025-13577 · Leantime · Leantime

Name of the Vulnerable Software and Affected Versions: Leantime versions 3.2.1 and earlier Description: The issue allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in the processMentions function. This is a Cross Site Scripting...

WordPress Alphabetic Pagination Plugin <= 3.2.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Alphabetic Pagination versions = 3.2.1...

CVE-2024-23320

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. This issue is a legacy of CVE-2023-49299. We didn't fix it completely in CVE-2023-49299, and we added one more patch to fix it. This...

PT-2025-6729 · Unknown · Perfex Crm

Name of the Vulnerable Software and Affected Versions: Perfex Crm versions prior to 3.2.1 Description: The issue allows an authenticated attacker to send a crafted HTTP POST request to the "upload sales file" endpoint. By providing malicious input in the rel id parameter, combined with improper...

CVE-2024-13658

The NGG Smart Image Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hrSISnextgensearchbox' shortcode in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

WordPress plugin NGG Smart Image Search 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...