12913 matches found
PT-2025-36108
Name of the Vulnerable Software and Affected Versions: Flatsome Theme for WordPress versions prior to 3.20.0 Description: The Flatsome Theme for WordPress is susceptible to Stored Cross-Site Scripting through its shortcodes. This is due to inadequate input sanitization and output escaping of...
PT-2025-45525
Name of the Vulnerable Software and Affected Versions SuiteCRM versions 8.0.0 through 8.9.0 Description SuiteCRM is an open-source Customer Relationship Management CRM software application. A time-based blind SQL Injection flaw exists in versions 8.9.0 and below. This issue allows an authenticate...
Linux Distros Unpatched Vulnerability : CVE-2022-21713
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle use...
CVE-2025-20287 Cisco Evolved Programmable Network Manager Arbitrary File Upload Vulnerability
A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager EPNM could allow an authenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to improper validation of files that are uploaded to the web-based...
CVE-2025-55373
Incorrect access control in Beakon Application before v5.4.3 allows authenticated attackers with low-level privileges to escalate privileges and execute commands with Administrator rights...
CVE-2025-55373
Beakon Application before v5.4.3 has an incorrect access control vulnerability that lets authenticated low-privilege users escalate to Administrator rights by exploiting weak authorization (e.g., crafting requests to elevate a user’s role). Root cause: missing/insufficient access checks. Impact: ...
PT-2025-35581
Name of the Vulnerable Software and Affected Versions: Beakon Application versions prior to 5.4.3 Description: An incorrect access control issue exists in Beakon Application. Authenticated attackers with low-level privileges can escalate their privileges and execute commands with Administrator...
PT-2025-35188
Name of the Vulnerable Software and Affected Versions: The List Subpages plugin for WordPress versions up to and including 1.0.6 Description: The List Subpages plugin for WordPress is susceptible to Stored Cross-Site Scripting through the title parameter. Insufficient input sanitization and outpu...
CVE-2025-9352
CVE-2025-9352 covers the Pronamic Google Maps plugin for WordPress. The vulnerability is a Stored Cross-Site Scripting (XSS) in the description field across all versions up to 2.4.1, caused by insufficient input sanitization and output escaping. Exploitation requires authenticated access at Contr...
CVE-2025-57425
A Stored Cross-Site Scripting XSS vulnerability in SourceCodester FAQ Management System 1.0 allows an authenticated attacker to inject malicious JavaScript into the 'question' and 'answer' fields via the update-faq.php endpoint...
CVE-2025-8208
The Spexo Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 1.0.23 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2025-51281
D-Link DI-8100 16.07.26A1 is vulnerable to Buffer Overflow via the en, val and id parameters in the qjasp function. This vulnerability allows authenticated attackers to cause a Denial of Service DoS by sending crafted GET requests with overly long values for these parameters...
CVE-2025-51281
D-Link DI-8100 16.07.26A1 is vulnerable to Buffer Overflow via the en, val and id parameters in the qjasp function. This vulnerability allows authenticated attackers to cause a Denial of Service DoS by sending crafted GET requests with overly long values for these parameters...
CVE-2025-29520
Incorrect access control in the Maintenance module of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows authenticated attackers with low-level privileges to arbitrarily change the high-privileged account passwords and escalate privileges...
PT-2025-34661 · D Link · Di-8100
Name of the Vulnerable Software and Affected Versions: D-Link DI-8100 version 16.07.26A1 Description: The D-Link DI-8100 version 16.07.26A1 is susceptible to a buffer overflow issue. This occurs through the qj asp function when processing crafted GET requests containing excessively long values fo...
CVE-2025-29520
Incorrect access control in the Maintenance module of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows authenticated attackers with low-level privileges to arbitrarily change the high-privileged account passwords and escalate privileges...
CVE-2025-50858
Reflected Cross-Site Scripting in the List MySQL Databases function in Easy Hosting Control Panel EHCP 20.04.1.b allows authenticated attackers to execute arbitrary JavaScript via the action parameter...
CVE-2025-7957 ShortcodeHub <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via author_link_target Parameter
The ShortcodeHub plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘authorlinktarget’ parameter in all versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-leve...
CVE-2025-8062 WS Theme Addons <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ws_weather Shortcode
The WS Theme Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wsweather shortcode in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
CVE-2025-50860
SQL Injection in the listdomains function in Easy Hosting Control Panel EHCP 20.04.1.b allows authenticated attackers to access or manipulate database contents via the arananalan POST parameter...