PT-2025-51462

Name of the Vulnerable Software and Affected Versions Meks Meks Quick Plugin Disabler versions through 1.0 Description The Meks Quick Plugin Disabler software contains a Cross-Site Request Forgery issue. An attacker could potentially perform actions on behalf of an authenticated user without thei...

CVE-2025-67727 Parse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Management

Parse Server is an open source backend that can be deployed to any infrastructure that runs Node.js. In versions prior to 8.6.0-alpha.2, a GitHub CI workflow is triggered in a way that grants the GitHub Actions workflow elevated permissions, giving it access to GitHub secrets and write permission...

PT-2025-50954

Name of the Vulnerable Software and Affected Versions RuoYi versions 4.8.1 and earlier Description The software contains a stored cross-site scripting XSS issue in the /system/menu/edit API endpoint. The existing XSS filter can be bypassed, allowing for exploitation. Because the menu is shared...

CVE-2025-67342

The RuoYi backend management system (versions 4.8.1 and earlier ) is vulnerable to a stored cross-site scripting (XSS) flaw in the /system/menu/edit endpoint. Although an XSS filter is present, it can be bypassed, allowing an attacker with menu modification permissions to impact all users because...

CVE-2025-63070

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Shahjada Download Manager download-manager allows Retrieve Embedded Sensitive Data.This issue affects Download Manager: from n/a through = 3.3.32...

CVE-2025-62733 WordPress Custom Sidebars by ProteusThemes plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in ProteusThemes Custom Sidebars by ProteusThemes custom-sidebars-by-proteusthemes allows Cross Site Request Forgery.This issue affects Custom Sidebars by ProteusThemes: from n/a through = 1.0.3...

PT-2026-5200

Name of the Vulnerable Software and Affected Versions Drupal AI versions 0.0.0 through 1.0.6 Drupal AI versions 1.1.0 through 1.1.6 Drupal AI versions 1.2.0 through 1.2.3 Description A flaw exists in Drupal AI that allows for Cross-Site Scripting XSS. This issue is due to improper neutralization ...

CVE-2025-13835

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Stored XSS.This issue affects Arconix Shortcodes: from n/a through = 2.1.20...

CVE-2025-13296

CVE-2025-13296 is a Cross-Site Request Forgery (CSRF) vulnerability in Tekrom Technology Inc. T-Soft E-Commerce. Affected versions are T-Soft E-Commerce up to 28112025 (inclusive). The CVSS 3.1 vector from the provided metrics is AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N with a base score of 5.4 (Mediu...

CVE-2025-0643

Pyxis Signage (Narkom Pyxis Signage) is affected by CVE-2025-0643 due to improper neutralization of input during web page generation, enabling stored XSS. Affected: Pyxis Signage up to 31012025. Impact notes from sources indicate High severity with full Impact on confidentiality, integrity, and a...

CVE-2025-13415

A vulnerability was identified in icret EasyImages up to 2.8.6. This affects an unknown part of the file /app/upload.php of the component SVG Image Handler. The manipulation of the argument File leads to cross site scripting. It is possible to initiate the attack remotely...

CVE-2025-12382

Improper Limitation of a Pathname 'Path Traversal' vulnerability in Algosec Firewall Analyzer on Linux, 64 bit allows an authenticated user to upload files to a restricted directory leading to code injection. This issue affects Algosec Firewall Analyzer: A33.0 up to build 320, A33.10 up to build...

MAL-2025-125503 Malicious code in citra-naget73-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd4752d31abc62f53447746146a9d93e37f33cbda1fc81113f3216dd48ba5b3b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-61815 InDesign Desktop | Use After Free (CWE-416)

InDesign Desktop versions 20.5, 19.5.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

DEBIAN-CVE-2025-12727

Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2025-7719 Smallworld SWMFS Arbitrary File Ops

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in GE Vernova Smallworld on Windows, Linux allows File Manipulation.This issue affects Smallworld: 5.3.5. and previous versions...

CVE-2025-49390

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in christophrado Cookie Notice & Consent cookie-notice-consent allows Stored XSS.This issue affects Cookie Notice & Consent: from n/a through = 1.6.4...

CVE-2025-60195

Incorrect Privilege Assignment vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Privilege Escalation.This issue affects Atarim: from n/a through = 4.2.1...

CVE-2025-62967 WordPress DirectoryPress plugin <= 3.6.25 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Designinvento DirectoryPress directorypress allows DOM-Based XSS.This issue affects DirectoryPress: from n/a through = 3.6.25...

Liferay Portal和Liferay DXP 跨站脚本漏洞

Liferay Portal and Liferay DXP are both products of Liferay, Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP...