PT-2025-34486

Name of the Vulnerable Software and Affected Versions Easy Hosting Control Panel EHCP version 20.04.1.b Description A reflected Cross-Site Scripting issue exists in the Change Template function. Authenticated attackers can execute arbitrary JavaScript code through the template parameter. The issu...

PT-2025-34458 · Reolink · Reolink Smart 2K+ Plug-In Wi-Fi Video Doorbell With Chime

Name of the Vulnerable Software and Affected Versions: Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime version 3.0.0.4662 2503122283 Description: The device suffers from insufficient privilege verification. Authenticated attackers can create accounts with elevated privileges...

CVE-2025-55103

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in th...

Cross-site Scripting (XSS)

Overview com.liferay:com.liferay.layout.admin.web is a portal for Liferay. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the type parameter. An authenticated attacker can execute arbitrary JavaScript code in the context of other users by injecting malicious...

CVE-2025-8064

The CVE describes a Stored Cross-Site Scripting vulnerability in the Bible SuperSearch WordPress plugin (

CVE-2025-8064 Bible SuperSearch <= 6.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via selector_height Parameter

The Bible SuperSearch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘selectorheight’ parameter in all versions up to, and including, 6.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-50860

A SQL Injection vulnerability exists in the listdomains function of the Easy Hosting Control Panel (EHCP) version 20.04.1.b . This flaw allows authenticated attackers to access or manipulate database contents by leveraging the arananalan POST parameter. No information regarding a patch or newer v...

CVE-2025-47184

An XML external entities XXE injection vulnerability in the /init API endpoint in Exagid EX10 before 6.4.0 P20, 7.0.1 P12, and 7.2.0 P08 allows an authenticated, unprivileged attacker to achieve information disclosure and privilege escalation via a crafted ISys XML message...

CVE-2025-55521

An issue in the component /settings/localisation of Akaunting v3.1.18 allows authenticated attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2025-55521

The software Akaunting version v3.1.18 is vulnerable to a Denial of Service (DoS) attack. The flaw exists within the /settings/localisation component, where an authenticated attacker can trigger the vulnerability by sending a crafted POST request . This issue is categorized as Uncontrolled Resour...

PT-2025-34190 · WordPress +1 · Slingblocks – Gutenberg Blocks By Funnelkit +1

Name of the Vulnerable Software and Affected Versions: SlingBlocks – Gutenberg Blocks by FunnelKit Formerly WooFunnels versions prior to 1.6.1 Description: The SlingBlocks – Gutenberg Blocks by FunnelKit Formerly WooFunnels plugin for WordPress is susceptible to Stored Cross-Site Scripting throug...

CVE-2025-55521

An issue in the component /settings/localisation of Akaunting v3.1.18 allows authenticated attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2025-55521

An issue in the component /settings/localisation of Akaunting v3.1.18 allows authenticated attackers to cause a Denial of Service DoS via a crafted POST request...

PT-2025-34253 · Akaunting · Akaunting

Name of the Vulnerable Software and Affected Versions: Akaunting version 3.1.18 Description: An issue in the /settings/localisation component allows authenticated attackers to cause a Denial of Service DoS via a crafted POST request. Recommendations: At the moment, there is no information about a...

CVE-2025-6181

The StrongDM Windows service incorrectly handled input validation. Authenticated attackers could potentially exploit this leading to privilege escalation...

CVE-2025-6181

The StrongDM Windows service incorrectly handled input validation. Authenticated attackers could potentially exploit this leading to privilege escalation...

CVE-2025-6181

The CVE-2025-6181 affects the StrongDM Windows service, where input validation is incorrectly handled. The root cause is input validation failures that could allow an authenticated local attacker to escalate privileges. The CVSSv4 vector indicates a HIGH-severity, local attack with low complexity...

CVE-2025-1142

Summary: CVE-2025-1142 affects IBM Edge Application Manager 4.5. The Red Hat, NVD, and IBM bulletin entries corroborate a server-side request forgery (SSRF) vulnerability in IBM Edge Application Manager 4.5, enabling an authenticated attacker to issue unauthorized requests from the vulnerable sys...

CVE-2025-54927

CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists that could cause unauthorized access to sensitive files when an authenticated attackers uses a crafted path input that is processed by the system...

CVE-2025-54927

CVE-2025-54927 concerns Schneider Electric EcoStruxure Power Monitoring Expert. The issue is a directory traversal via the HttpPostedFile module that could enable remote code execution. Exploitation requires authentication and is demonstrated in public advisories (e.g., ZDI-25-828) with attacker-...