CVE-2025-27531

Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 before 2.1.0, this issue would allow an authenticated attacker to read arbitrary files by double writing the param. Users are recommended to upgrade to version 2.1.0, which fixes the...

CVE-2025-27531

Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 before 2.1.0, this issue would allow an authenticated attacker to read arbitrary files by double writing the param. Users are recommended to upgrade to version 2.1.0, which fixes the...

CVE-2025-27531

Apache InLong versions 1.13.0 through 2.1.0 are vulnerable to a deserialization of untrusted data flaw (CWE-502). The root cause is the improper handling of input parameters, specifically allowing an authenticated attacker to read arbitrary files by double writing the param used during deserializ...

CVE-2025-27531 Apache InLong: An arbitrary file read vulnerability for JDBC

Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 before 2.1.0, this issue would allow an authenticated attacker to read arbitrary files by double writing the param. Users are recommended to upgrade to version 2.1.0, which fixes the...

CVE-2025-5760

The Simple History plugin for WordPress is vulnerable to sensitive data exposure via Detective Mode due to improper sanitization within the appenddebuginfotocontext function in versions prior to 5.8.1. When Detective Mode is enabled, the plugin’s logger captures the entire contents of $POST and...

CVE-2025-5760

CVE-2025-5760 (WordPress Simple History plugin) exposes passwords via logs when Detective Mode is on. In affected versions prior to 5.8.1, append_debug_info_to_context() sanitization is insufficient, causing the plugin to log entire $_POST (and sometimes raw request bodies or $_GET) including pas...

CVE-2025-5760 Simple History <= 5.8.1 - Authenticated (Administrator+) Sensitive Information Exposure via Detective Mode

The Simple History plugin for WordPress is vulnerable to sensitive data exposure via Detective Mode due to improper sanitization within the appenddebuginfotocontext function in versions prior to 5.8.1. When Detective Mode is enabled, the plugin’s logger captures the entire contents of $POST and...

CVE-2025-5699

The Developer Formatter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS in all versions up to, and including, 2015.0.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2025-5565

The Hide It plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hideit' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

CVE-2025-5538

The CVE-2025-5538 entry corresponds to a Stored Cross-Site Scripting vulnerability in the WordPress plugin BNS Featured Category, affecting all versions up to 2.8.2. The flaw arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin’s bnsfc shortcod...

CVE-2025-4964

CVE-2025-4964 applies to WP Online Users Stats for WordPress, with a time-based SQL Injection via the table_name parameter in all versions up to 1.0.0. The root cause is insufficient escaping and lack of proper preparation in the existing SQL query, enabling authenticated attackers with Editor-le...

CVE-2025-5699 Developer Formatter <= 2015.0.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom CSS

The Developer Formatter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS in all versions up to, and including, 2015.0.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

Cisco Unified Communications Manager Command Injection (cisco-sa-vos-command-inject-65s2UCYy)

According to its self-reported version, Cisco Unified Communications Manager is affected by a command injection vulnerability. - A vulnerability in the CLI of multiple Cisco Unified Communications products could allow an authenticated, local attacker to execute arbitrary commands on the underlyin...

Cisco Integrated Management Controller Privilege Escalation (cisco-sa-ucs-ssh-priv-esc-2mZDtdjM)

According to its self-reported version, Cisco Integrated Management Controller Privilege Escalation is affected by a vulnerability. - A vulnerability in the SSH connection handling of Cisco Integrated Management Controller IMC for Cisco UCS B-Series, UCS C-Series, UCS S-Series, and UCS X-Series...

CVE-2025-5533: Improper Neutralization of Input During Web Page Generation

The Knowledge Base plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'kbalert' shortcode in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-27531: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 before 2.1.0, this issue would allow an authenticated attacker to read arbitrary files by double writing the param. Users are recommended to upgrade to version 2.1.0, which fixes the...

CVE-2025-4964: Improper Neutralization of Special Elements used in an SQL Command

The WP Online Users Stats plugin for WordPress is vulnerable to time-based SQL Injection via the ‘tablename’ parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes i...

Exploit for Cross-site Scripting in Devaslanphp Project_Management

Exploit Title: Project Management - Stored XSS Google Do...

CVE-2025-27753 Extension - rsjoomla.com - A SQLi vulnerability RSMediaGallery component 1.7.4 - 2.1.6 for Joomla

A SQLi vulnerability in RSMediaGallery component 1.7.4 - 2.1.6 for Joomla was discovered. The vulnerability is due to the use of unescaped user-supplied parameters in SQL queries within the dashboard component. This allows an authenticated attacker to inject malicious SQL code through unsanitized...

CVE-2025-20277

A vulnerability in the web-based management interface of Cisco Unified CCX could allow an authenticated, local attacker to execute arbitrary code on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to improper...