CVE-2024-13999: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose the server's Active Directory AD or LDAP authentication token to an authenticated user. Exposure of the server’s AD/LDAP token could allow domain-wide authentication misuse, escalation of privileges, or further compromi...

CVE-2023-53690: Improper Neutralization of Input During Web Page Generation

Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting XSS vulnerability in the LDAP/AD authentication-server configuration. Unsanitized user input can be stored and later rendered in the administrative UI, causing JavaScript to execute in the browser of any user who views th...

CVE-2025-52179

Zucchetti Ad Hoc Revolution versions 4.1 and earlier are vulnerable to a Cross-site scripting (XSS) vulnerability. The root cause is an unvalidated pHtmlSource parameter within the /ahrw/jsp/gsfr_feditorHTML.jsp API endpoint. This flaw allows remote unauthenticated attackers to inject arbitrary J...

CVE-2025-52180

Cross-site scripting XSS vulnerability in Zucchetti Ad Hoc Infinity 4.2 and earlier allows remote unauthenticated attackers to inject arbitrary JavaScript via the pHtmlSource parameter of the /ahi/jsp/gsfrfeditorHTML.jsp?pHtmlSource endpoint...

PT-2025-44444

Name of the Vulnerable Software and Affected Versions Zucchetti Ad Hoc Revolution versions 4.1 and earlier Description A cross-site scripting XSS issue exists in Zucchetti Ad Hoc Revolution. This allows attackers to inject arbitrary JavaScript code. The issue is present in the /ahrw/jsp/gsfr...

Zucchetti Ad Hoc Revolution 安全漏洞

Zucchetti Ad Hoc Revolution is a business data processing system from Zucchetti, Italy. A security vulnerability exists in Zucchetti Ad Hoc Revolution 4.1 and earlier versions, which stems from an unvalidated pHtmlSource parameter that could lead to a cross-site scripting attack...

CVE-2025-52180: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Zucchetti Ad Hoc Infinity 4.2 and earlier allows remote unauthenticated attackers to inject arbitrary JavaScript via the pHtmlSource parameter of the /ahi/jsp/gsfrfeditorHTML.jsp?pHtmlSource endpoint...

CVE-2025-52180

A Cross-site scripting (XSS) vulnerability exists in Zucchetti Ad Hoc Infinity versions 4.2 and earlier . The flaw stems from an unvalidated pHtmlSource parameter within the /ahi/jsp/gsfr_feditorHTML.jsp?pHtmlSource endpoint. This allows remote unauthenticated attackers to inject arbitrary JavaSc...

PT-2025-44447

Name of the Vulnerable Software and Affected Versions Zucchetti Ad Hoc Infinity versions prior to 4.2 Description A cross-site scripting issue exists in Zucchetti Ad Hoc Infinity. This allows attackers to inject arbitrary JavaScript code. The issue is present in the /ahi/jsp/gsfr feditorHTML.jsp...

CVE-2025-52180

Cross-site scripting XSS vulnerability in Zucchetti Ad Hoc Infinity 4.2 and earlier allows remote unauthenticated attackers to inject arbitrary JavaScript via the pHtmlSource parameter of the /ahi/jsp/gsfrfeditorHTML.jsp?pHtmlSource endpoint...

CVE-2025-11827

The Oboxmedia Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'beforewidget' and 'afterwidget' parameters of the oboxads-ad-widget shortcode in all versions up to, and including, 1.9.8. This is due to insufficient input sanitization and output escaping. This makes it...

CVE-2025-11834

The WP AD Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'startindex' parameter of the ad-gallery shortcode in all versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2025-11834

The CVE CVE-2025-11834 (WP AD Gallery) affects WordPress WP AD Gallery plugin versions ≤ 1.3, with stored XSS via the startindex parameter in the ad-gallery shortcode. Root cause: insufficient input sanitization and output escaping; authenticated attackers with contributor-level access can inject...

CVE-2025-11834 WP AD Gallery <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WP AD Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'startindex' parameter of the ad-gallery shortcode in all versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

EUVD-2025-35326

The WP AD Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'startindex' parameter of the ad-gallery shortcode in all versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

WordPress plugin WP AD Gallery 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-11834: Improper Neutralization of Input During Web Page Generation

The WP AD Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'startindex' parameter of the ad-gallery shortcode in all versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2025-10750: Exposure of Sensitive Information to an Unauthorized Actor

The PowerBI Embed Reports plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 1.2.0. This is due to missing capability checks and authentication verification on the 'testUser' endpoint accessible via the moepbradminobserver function hooked ...

CVE-2017-20202

Web Developer for Chrome v0.4.9 contained malicious code that generated a domain via a DGA and fetched a remote script. The fetched script conditionally loaded follow-on modules that performed extensive ad substitution and malvertising, displayed fake “repair” alerts that redirected users to...

DEBIAN-CVE-2025-11561

A flaw was found in the integration of Active Directory and the System Security Services Daemon SSSD on Linux systems. In default configurations, the Kerberos local authentication plugin sssdkrb5localauthplugin is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an...