CVE-2025-36437: Generation of Error Message Containing Sensitive Information

IBM Planning Analytics Local 2.1.0 - 2.1.15 could disclose sensitive information about server architecture that could aid in further attacks against the system...

CVE-2025-13292

A vulnerability in Apigee-X allowed an attacker to gain unauthorized read and write access to Apigee Analytics AX data and access logs belonging to other Apigee customer organizations. Apigee-X was found to be vulnerable. This vulnerability was patched in version 1-16-0-apigee-3. No user action i...

EUVD-2025-201511

A vulnerability in Apigee-X allowed an attacker to gain unauthorized read and write access to Apigee Analytics AX data and access logs belonging to other Apigee customer organizations. Apigee-X was found to be vulnerable. This vulnerability was patched in version 1-16-0-apigee-3. No user action i...

CVE-2025-13292

A vulnerability in Apigee-X allowed an attacker to gain unauthorized read and write access to Apigee Analytics AX data and access logs belonging to other Apigee customer organizations. Apigee-X was found to be vulnerable. This vulnerability was patched in version 1-16-0-apigee-3. No user action i...

CVE-2025-13292

CVE-2025-13292 affects Google Apigee-X, enabling cross-tenant unauthorized read/write access to Apigee Analytics data and logs due to improper access control. Patched in version 1-16-0-apigee-3; no user action required. Evidence confirms affected product, impact, and patch; exploitation details a...

CVE-2025-13292 Improper access control in Google Cloud Apigee-X allows cross-tenant Analytics modification and log data access.

A vulnerability in Apigee-X allowed an attacker to gain unauthorized read and write access to Apigee Analytics AX data and access logs belonging to other Apigee customer organizations. Apigee-X was found to be vulnerable. This vulnerability was patched in version 1-16-0-apigee-3. No user action i...

CVE-2025-13292 Improper access control in Google Cloud Apigee-X allows cross-tenant Analytics modification and log data access.

A vulnerability in Apigee-X allowed an attacker to gain unauthorized read and write access to Apigee Analytics AX data and access logs belonging to other Apigee customer organizations. Apigee-X was found to be vulnerable. This vulnerability was patched in version 1-16-0-apigee-3. No user action i...

PT-2025-49328

Name of the Vulnerable Software and Affected Versions Apigee-X versions prior to 1-16-0-apigee-3 Description A security issue in Apigee-X could allow an attacker to gain unauthorized read and write access to Apigee Analytics AX data and access logs belonging to other Apigee customer organizations...

CVE-2025-13292: Improper Privilege Management

A vulnerability in Apigee-X allowed an attacker to gain unauthorized read and write access to Apigee Analytics AX data and access logs belonging to other Apigee customer organizations. Apigee-X was found to be vulnerable. This vulnerability was patched in version 1-16-0-apigee-3. No user action i...

CVE-2025-13796

A security vulnerability has been detected in deco-cx apps up to 0.120.1. Affected by this vulnerability is the function AnalyticsScript of the file website/loaders/analyticsScript.ts of the component Parameter Handler. Such manipulation of the argument url leads to server-side request forgery. T...

WordPress WP Google Analytics Events plugin <= 2.8.2 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Legion Hunter in WordPress Plugin WP Google Analytics Events versions = 2.8.2...

PT-2025-50029

Name of the Vulnerable Software and Affected Versions WP Google Analytics Events versions prior to 2.8.3 Description The WP Google Analytics Events plugin for WordPress allows unauthenticated attackers to retrieve embedded sensitive data. This issue results in the exposure of sensitive system...

CVE-2025-13796

A security vulnerability has been detected in deco-cx apps up to 0.120.1. Affected by this vulnerability is the function AnalyticsScript of the file website/loaders/analyticsScript.ts of the component Parameter Handler. Such manipulation of the argument url leads to server-side request forgery. T...

Exploit for CVE-2025-13796

CVE-2025-13796-PoC deco-cx apps Parameter analyticsScr...

Deco Apps Library / MCP Server Code Issues and Vulnerabilities

Deco Apps Library / MCP Servers is a content management system from deco.cx open source. A code issue vulnerability exists in Deco Apps Library / MCP Servers version 0.120.1 and earlier, which stems from incorrect manipulation of the parameter url in the file website/loaders/analyticsScript.ts,...

CVE-2025-13796

CVE-2025-13796 affects deco-cx apps up to 0.120.1, specifically the AnalyticsScript function in website/loaders/analyticsScript.ts of the Parameter Handler component. The issue arises from improper handling of the url argument, enabling server-side request forgery (SSRF) and remote exploitation. ...

CVE-2025-13796 deco-cx apps Parameter analyticsScript.ts AnalyticsScript server-side request forgery

A security vulnerability has been detected in deco-cx apps up to 0.120.1. Affected by this vulnerability is the function AnalyticsScript of the file website/loaders/analyticsScript.ts of the component Parameter Handler. Such manipulation of the argument url leads to server-side request forgery. T...

PT-2025-48399

Name of the Vulnerable Software and Affected Versions deco-cx apps versions up to 0.120.1 Description A security issue exists in deco-cx apps. Manipulation of the url argument within the AnalyticsScript function, located in the website/loaders/analyticsScript.ts file of the Parameter Handler...

WordPress Analytics Germanized for Google Analytics plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by zaim in WordPress Plugin Analytics Germanized for Google Analytics versions = 1.6.2...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. The package was flagged as malicious during the Sha1-hulud supply chain attack. Although the Sha1-hulud IoCs are not present within the package, the contents of the affected version were removed from the officia...