CVE-2025-27802

The Episerver Content Management System CMS by Optimizely was affected by multiple Stored Cross-Site Scripting XSS vulnerabilities. This allowed an authenticated attacker to execute malicious JavaScript code in the victim's browser. RTE properties text fields, which could be used in the "Edit"...

CVE-2025-27800

The Episerver Content Management System CMS by Optimizely was affected by multiple Stored Cross-Site Scripting XSS vulnerabilities. This allowed an authenticated attacker to execute malicious JavaScript code in the victim's browser. The Admin dashboard offered the functionality to add gadgets to...

CVE-2025-6348

The Smart Slider 3 plugin for WordPress is vulnerable to time-based SQL Injection via the ‘sliderid’ parameter in all versions up to, and including, 3.5.1.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2025-8196

The Magical Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Custom Attributes in all versions up to, and including, 1.3.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-6681

CVE-2025-6681 refers to a Stored Cross‑Site Scripting vulnerability in the WordPress plugin Fan Page (versions up to 1.0.1). The issue arises from insufficient input sanitization and output escaping on the width parameter, allowing authenticated users with Contributor-level access or higher to in...

CVE-2025-53079

Absolute Path Traversal in Samsung DMSData Management Server allows authenticated attacker Administrator to read sensitive files...

CVE-2025-53079

Absolute Path Traversal in Samsung DMSData Management Server allows authenticated attacker Administrator to read sensitive files...

CVE-2025-53079

Absolute Path Traversal in Samsung DMSData Management Server allows authenticated attacker Administrator to read sensitive files...

CVE-2025-53079

Samsung DMS (Data Management Server) is affected by an Absolute Path Traversal vulnerability (CVE-2025-53079). The issue allows an authenticated administrator to read sensitive files, due to a path traversal flaw in Samsung DMS. The CVSS 3.1 base score is 4.9 (Medium) with Attack Vector Network, ...

PT-2025-31171 · Samsung · Samsung Dms

Name of the Vulnerable Software and Affected Versions: Samsung DMSData Management Server affected versions not specified Description: An absolute path traversal issue exists in Samsung DMSData Management Server. An authenticated attacker with Administrator privileges can read sensitive files...

VMware vCenter 安全漏洞

VMware vCenter is a virtualization management software from VMware. A security vulnerability exists in VMware vCenter that originates from an authenticated attacker that could trigger a denial of service condition...

PT-2025-31262 · Elementor +1 · Elementor +1

Name of the Vulnerable Software and Affected Versions: MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress versions up to and including 4.0.1 Description: The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress ...

CVE-2025-6681: Improper Neutralization of Input During Web Page Generation

The Fan Page plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-53079: Absolute Path Traversal

Absolute Path Traversal in Samsung DMSData Management Server allows authenticated attacker Administrator to read sensitive files...

CVE-2025-6692: Improper Neutralization of Input During Web Page Generation

The YouTube Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘instance’ parameter in all versions up to, and including, 10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2025-2297

Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user registry under certain conditions. This allows users with the ability to edit their user profile files to elevate their privileges to...

CVE-2025-53695

OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access 'root' user to the device firmware...

CVE-2025-53695

OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access 'root' user to the device firmware...

CVE-2025-53695

CVE-2025-53695 affects Johnson Controls’ iSTAR Ultra family (Ultra, Ultra SE, Ultra G2, Ultra G2 SE, Edge G2). The vulnerability is an OS command injection in the web application that, when exploited by an authenticated attacker, can grant root-level access to the device firmware. Public sources ...

CVE-2025-27800

The Episerver Content Management System CMS by Optimizely was affected by multiple Stored Cross-Site Scripting XSS vulnerabilities. This allowed an authenticated attacker to execute malicious JavaScript code in the victim's browser. The Admin dashboard offered the functionality to add gadgets to...