VMware vCenter 安全漏洞

VMware vCenter is a virtualization management software from VMware. A security vulnerability exists in VMware vCenter that originates from an authenticated attacker that could trigger a denial of service condition...

CVE-2025-2297

Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user registry under certain conditions. This allows users with the ability to edit their user profile files to elevate their privileges to...

CVE-2025-53695

OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access 'root' user to the device firmware...

CVE-2025-53695

OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access 'root' user to the device firmware...

CVE-2025-53695

CVE-2025-53695 affects Johnson Controls’ iSTAR Ultra family (Ultra, Ultra SE, Ultra G2, Ultra G2 SE, Edge G2). The vulnerability is an OS command injection in the web application that, when exploited by an authenticated attacker, can grant root-level access to the device firmware. Public sources ...

CVE-2025-27800

The Episerver Content Management System CMS by Optimizely was affected by multiple Stored Cross-Site Scripting XSS vulnerabilities. This allowed an authenticated attacker to execute malicious JavaScript code in the victim's browser. The Admin dashboard offered the functionality to add gadgets to...

CVE-2025-27802

The Episerver Content Management System CMS by Optimizely was affected by multiple Stored Cross-Site Scripting XSS vulnerabilities. This allowed an authenticated attacker to execute malicious JavaScript code in the victim's browser. RTE properties text fields, which could be used in the "Edit"...

CVE-2025-27802

CVE-2025-27802: Stored XSS in Optimizely Episerver CMS (EPiServer.CMS.Core/UI) via Rich Text Editor fields in the Edit/Preview flow. An authenticated user with WebEditor role could inject JavaScript that runs when a page is previewed. Affected: Episerver CMS 11.x (<11.21.4 core with UI <11....

CVE-2025-27802 Stored Cross-Site Scripting in Episerver Content Management System (CMS) Edit Preview

The Episerver Content Management System CMS by Optimizely was affected by multiple Stored Cross-Site Scripting XSS vulnerabilities. This allowed an authenticated attacker to execute malicious JavaScript code in the victim's browser. RTE properties text fields, which could be used in the "Edit"...

CVE-2025-27802 Stored Cross-Site Scripting in Episerver Content Management System (CMS) Edit Preview

The Episerver Content Management System CMS by Optimizely was affected by multiple Stored Cross-Site Scripting XSS vulnerabilities. This allowed an authenticated attacker to execute malicious JavaScript code in the victim's browser. RTE properties text fields, which could be used in the "Edit"...

CVE-2025-27801 Stored Cross-Site Scripting in Episerver Content Management System (CMS) Media Selection Preview

The Episerver Content Management System CMS by Optimizely was affected by multiple Stored Cross-Site Scripting XSS vulnerabilities. This allowed an authenticated attacker to execute malicious JavaScript code in the victim's browser. ContentReference properties, which could be used in the "Edit"...

CVE-2025-27801 Stored Cross-Site Scripting in Episerver Content Management System (CMS) Media Selection Preview

The Episerver Content Management System CMS by Optimizely was affected by multiple Stored Cross-Site Scripting XSS vulnerabilities. This allowed an authenticated attacker to execute malicious JavaScript code in the victim's browser. ContentReference properties, which could be used in the "Edit"...

CVE-2025-27800

CVE-2025-27800 corresponds to multiple stored XSS flaws in Optimizely Episerver CMS (EPiServer.CMS.Core/UI) affecting 11.x (<11.21.4 core and <11.37.5 UI) and 12.x (<12.22.1 core and

CVE-2025-27800 Stored Cross-Site Scripting in Episerver Content Management System (CMS) Admin Dashboard

The Episerver Content Management System CMS by Optimizely was affected by multiple Stored Cross-Site Scripting XSS vulnerabilities. This allowed an authenticated attacker to execute malicious JavaScript code in the victim's browser. The Admin dashboard offered the functionality to add gadgets to...

CVE-2025-7501

The Wonder Slider Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image title and description DOM in all versions up to, and including, 14.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-6987

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advancediframe' shortcode in all versions up to, and including, 2025.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

Optimizely Episerver Content Management System 安全漏洞

Optimizely Episerver Content Management System is an enterprise-class content management system from Optimizely, Inc. A security vulnerability exists in the Optimizely Episerver Content Management System that stems from stored cross-site scripting that allows an authenticated attacker to execute...

Optimizely Episerver Content Management System 安全漏洞

Optimizely Episerver Content Management System is an enterprise-class content management system from Optimizely, Inc. A security vulnerability exists in the Optimizely Episerver Content Management System that stems from stored cross-site scripting that allows an authenticated attacker to execute...

Optimizely Episerver Content Management System 安全漏洞

Optimizely Episerver Content Management System is an enterprise-class content management system from Optimizely, Inc. A security vulnerability exists in the Optimizely Episerver Content Management System that stems from stored cross-site scripting that allows an authenticated attacker to execute...

CVE-2025-5529

The Educenter theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Circle Counter Block in all versions up to, and including, 1.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...