6757 matches found
PT-2025-2013 · Unknown · Crelly Slider
Name of the Vulnerable Software and Affected Versions: Crelly Slider versions prior to 1.4.7 Description: The issue arises from the plugin not sanitizing and escaping some of its settings, potentially allowing high-privilege users, such as administrators, to perform Stored Cross-Site Scripting...
PT-2025-1987
Name of the Vulnerable Software and Affected Versions Dyn Business Panel WordPress plugin version 1.0.0 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. This...
PT-2025-2617 · Microsoft +1 · Windows +1
Name of the Vulnerable Software and Affected Versions: GRAU DATA Blocky versions prior to 3.1 Description: The issue is related to a Client-Side Enforcement of Server-Side Security vulnerability in Blocky-Gui. An attacker with Windows administrative or debugging privileges can patch a binary in...
SAP NetWeaver Application Server 安全漏洞
SAP NetWeaver Application Server is an application server from SAP, Germany. An information disclosure vulnerability exists in SAP NetWeaver Application Server ABAP, which can be exploited by an attacker with administrative or user directory privileges to disclose data and compromise program...
MegaBIP 安全漏洞
MegaBIP is a software for creating BIP websites from MegaBIP Inc. A security vulnerability exists in MegaBIP versions prior to 5.15 that stems from susceptibility to cross-site request forgery attacks, resulting in logged-in administrator users potentially being tricked into visiting malicious...
CVE-2024-55225
An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including Administrators, via a crafted authorization request...
PT-2025-1941 · WordPress · Bu Section Editing Wordpress Plugin
Name of the Vulnerable Software and Affected Versions: BU Section Editing WordPress plugin versions 0.9.9 and earlier Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. Thi...
PT-2025-1940 · WordPress · Aklamator Infeed
Name of the Vulnerable Software and Affected Versions: Aklamator INfeed WordPress plugin versions through 2.0.0 Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This coul...
CVE-2025-20123
Multiple vulnerabilities in the web-based management interface of Cisco Crosswork Network Controller could allow an authenticated, remote attacker to conduct cross-site scripting XSS attacks against users of the interface of an affected system. These vulnerabilities exist because the web-based...
Cross-site Scripting (XSS)
Overview backdrop/backdrop is a CMS that helps you build websites for businesses and non-profits. Affected versions of this package are vulnerable to Cross-site Scripting XSS in ckeditor5.js, which does not sufficiently isolate ckeditor rich text objects. A user with the ability to input long tex...
PT-2025-20833
Name of the Vulnerable Software and Affected Versions: GNUScreen version 5.0.1 and earlier Description: The issue affects Linux administrators, cloud engineers, and developers. It is related to a root privilege escalation flaw. Recommendations: For versions prior to 5.0.1, update to version 5.0.1...
Misconfigured Kubernetes RBAC in Azure Airflow Could Expose Entire Cluster to Exploitation
Cybersecurity researchers have uncovered three security weaknesses in Microsoft's Azure Data Factory Apache Airflow integration that, if successfully exploited, could have allowed an attacker to gain the ability to conduct various covert actions, including data exfiltration and malware deployment...
PT-2024-17757 · Cgfido · Cgfido
Name of the Vulnerable Software and Affected Versions: CGFIDO affected versions not specified Description: The passwordless login mechanism in CGFIDO has an Authentication Bypass issue, allowing remote attackers with regular privileges to send a crafted request to switch to the identity of any...
CVE-2024-46542
Veritas / Arctera Data Insight before 7.1.1 allows Application Administrators to conduct SQL injection attacks...
CVE-2024-46542
Veritas / Arctera Data Insight before 7.1.1 allows Application Administrators to conduct SQL injection attacks...
CVE-2024-46542
Veritas / Arctera Data Insight before 7.1.1 allows Application Administrators to conduct SQL injection attacks...
CVE-2024-50702
TeamPass before 3.1.3.1 does not properly check whether a mailme aka actionmail operation is on behalf of an administrator or manager...
CVE-2024-46542
CVE-2024-46542 affects Veritas / Arctera Data Insight versions prior to 7.1.1. The root cause is improper neutralization of SQL commands, allowing Application Administrators to perform SQL injection. Impact described: potential information disclosure. Remediation: upgrade to 7.1.1 or later; as a ...
PT-2024-36337 · Kurmi · Kurmi Provisioning Suite
Name of the Vulnerable Software and Affected Versions: Kurmi Provisioning Suite versions 7.9.0.38 and earlier Kurmi Provisioning Suite versions 7.10.x through 7.10.0.18 Kurmi Provisioning Suite versions 7.11.x through 7.11.0.15 Description: A cross-site scripting XSS vulnerability in the...