CVE-2020-26799

LuxSoft Luxcal 4.5.2 is affected by a reflected XSS in index.php that could allow an unauthenticated attacker to steal other users’ data. Reported as CVE-2020-26799, the issue is confirmed across multiple sources (NVD/Red Hat/CVElist entries) and linked advisories indicate the affected version is...

PT-2025-30328 · Luxcal · Luxcal

Name of the Vulnerable Software and Affected Versions: Luxcal version 4.5.2 Description: A reflected cross-site scripting XSS vulnerability exists in index.php that allows an unauthenticated attacker to steal other users' data. Recommendations: Update to a newer version that contains a fix for th...

Exploit for Path Traversal in Yeswiki

Blackash-CVE-2025-31131 CVE-2025-31131 - YesWiki 4.5.2 Path...

CVE-2023-51420

Improper Control of Generation of Code 'Code Injection' vulnerability in Soft8Soft LLC Verge3D Publishing and E-Commerce.This issue affects Verge3D Publishing and E-Commerce: from n/a through 4.5.2...

[SECURITY] [DLA 4125-1] twitter-bootstrap4 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4125-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès April 13, 2025 https://wiki.debian.org/LTS -...

CVE-2025-32238 WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5.5 - Sensitive Data Exposure vulnerability

Generation of Error Message Containing Sensitive Information vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Retrieve Embedded Sensitive Data.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n...

CVE-2025-31131

YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server. This vulnerability is fixed in 4.5.2...

CVE-2025-31626

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in M. Ali Saleem Support Helpdesk Ticket System Lite ticket-help-desk-system-lite allows Reflected XSS.This issue affects Support Helpdesk Ticket System Lite: from n/a through = 4.5.2...

CVE-2025-31626 WordPress Support Helpdesk Ticket System Lite plugin <= 4.5.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in M. Ali Saleem Support Helpdesk Ticket System Lite ticket-help-desk-system-lite allows Reflected XSS.This issue affects Support Helpdesk Ticket System Lite: from n/a through = 4.5.2...

CVE-2025-31626 WordPress Support Helpdesk Ticket System Lite plugin <= 4.5.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in M. Ali Saleem Support Helpdesk Ticket System Lite ticket-help-desk-system-lite allows Reflected XSS.This issue affects Support Helpdesk Ticket System Lite: from n/a through = 4.5.2...

CVE-2025-31626

CVE-2025-31626 is a reflected Cross-Site Scripting vulnerability affecting the WordPress plugin Support Helpdesk Ticket System Lite (≤ 4.5.2). The CVE entry indicates an input neutralization issue during web page generation leading to reflected XSS. Current connected data confirms the issue is re...

CVE-2025-31131 Path Traversal allowing arbitrary read of files in Yeswiki

YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server. This vulnerability is fixed in 4.5.2...

CVE-2025-31131 Path Traversal allowing arbitrary read of files in Yeswiki

YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server. This vulnerability is fixed in 4.5.2...

CVE-2025-31131

YesWiki before 4.5.2 is vulnerable to an unauthenticated path traversal via the squelette parameter, allowing read access to arbitrary server files (e.g., /etc/passwd). Root cause: unsafe handling of user-controllable squelette input leading to directory traversal. Impact: potential data exposure...

YesWiki 路径遍历漏洞

YesWiki is a wiki system written in PHP by the French organization YesWiki. It is used to create and manage websites in a collaborative manner. A path traversal vulnerability exists in YesWiki versions prior to 4.5.2, which stems from the squelette parameter being vulnerable to a path traversal...

SUSE CVE-2025-30204

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose...

AZL-59229 CVE-2025-30204 affecting package prometheus for versions less than 2.37.9-3

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose...

AZL-59217 CVE-2025-30204 affecting package moby-engine for versions less than 24.0.9-16

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose...

Asymmetric Resource Consumption (Amplification)

Overview Affected versions of this package are vulnerable to Asymmetric Resource Consumption Amplification through the parse.ParseUnverified function. An attacker can cause excessive memory allocation by sending a crafted request with many period characters in the Authorization header. Remediatio...

CVE-2025-30204 jwt-go allows excessive memory allocation during header parsing

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose...