CVE-2025-10020

CVE-2025-10020 affects Zohocorp ManageEngine ADManager Plus prior to version 8024, with an authenticated command-injection in the Custom Script component caused by inadequate filtering of constructed command characters. Impact described across sources includes arbitrary command execution and pote...

CVE-2025-10612 XSS in GiSoft's City Guide

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in giSoft Information Technologies City Guide allows Reflected XSS. This issue affects City Guide: before 1.4.45...

CVE-2025-10916 FormGent < 1.0.4 - Unauthenticated Arbitrary File Deletion

The FormGent WordPress plugin before 1.0.4 is vulnerable to arbitrary file deletion due to insufficient file path validation. This makes it possible for unauthenticated attackers to delete arbitrary files on the server...

UBUNTU-CVE-2025-62702

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in The Wikimedia Foundation Mediawiki - PageTriage Extension allows Stored XSS.This issue affects Mediawiki - PageTriage Extension: from master before 1.44...

UBUNTU-CVE-2025-62701

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in The Wikimedia Foundation Mediawiki - Wikistories allows Stored XSS.This issue affects Mediawiki - Wikistories: from master before 1.44...

EUVD-2025-35129

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in The Wikimedia Foundation Mediawiki - PageTriage Extension allows Stored XSS.This issue affects Mediawiki - PageTriage Extension: from master before 1.44...

OpenEXR has an unspecified vulnerability (CNVD-2025-24792)

OpenEXR is an open standard for high dynamic range image HDR file formats. A security vulnerability exists in versions prior to OpenEXR 8.0, which can be exploited by an attacker to cause an out-of-bounds write...

CVE-2025-62663

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in The Wikimedia Foundation Mediawiki - UploadWizard Extension allows Stored XSS.This issue affects Mediawiki - UploadWizard Extension: from master before 1.39...

CVE-2025-62697

Summary (CVE-2025-62697) : A code injection vulnerability exists in the Wikimedia Foundation’s MediaWiki LanguageSelector Extension due to improper neutralization of special elements in output used by downstream components. Affected: LanguageSelector Extension for MediaWiki, specifically versions...

CVE-2025-62693

CVE-2025-62693 is a stored XSS vulnerability in the MediaWiki LastModified Extension (MediaWiki – LastModified). Multiple sources confirm that the issue arises from lack of proper escaping in system messages (e.g., lastmodified-* values), allowing injected HTML/script to be stored and served to u...

EUVD-2025-35054

Authorization Bypass Through User-Controlled Key vulnerability in VHS Electronic Software Ltd. Co. ACE Center allows Privilege Abuse, Exploitation of Trusted Identifiers.This issue affects ACE Center: from 3.10.100.1768 before 3.10.161.2255...

Taguette 跨站脚本漏洞

Taguette is a qualitative research tool by the individual developer Remi Rampin. A cross-site scripting vulnerability exists in Taguette versions prior to 1.5.0, which stems from a project member being able to insert JavaScript code into a name or description field, potentially leading to a...

CVE-2025-62662

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in The Wikimedia Foundation Mediawiki - AdvancedSearch Extension allows Stored XSS.This issue affects Mediawiki - AdvancedSearch Extension: from master before 1.39...

CVE-2025-62669 UserInfoCard: activeLocalBlocksAllWikis does not do permissions checks

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows Resource Leak Exposure.This issue affects Mediawiki - CentralAuth Extension: from master before 1.39...

CVE-2025-62665 Stored XSS through system messages in Skin:BlueSky

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - Skin:BlueSky allows Stored XSS.This issue affects Mediawiki - Skin:BlueSky: from master before 1.39...

libssh: out-of-bounds read in sftp_handle()

A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftphandle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, which is used in...

CVE-2025-11711

There was a way to change the value of JavaScript Object properties that were supposed to be non-writeable. This vulnerability was fixed in Firefox 144, Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4...

PT-2025-41863

A vulnerability has been identified in SIMATIC S7-1200 CPU V1 family incl. SIPLUS variants All versions V2.0.2, SIMATIC S7-1200 CPU V2 family incl. SIPLUS variants All versions V2.0.2. Affected controllers are vulnerable to capture-replay in the communication with the engineering software. This...

Siemens SiPass integrated 安全漏洞

Siemens SiPass Integrated is a powerful and extremely flexible access control system from Siemens, Germany. A security vulnerability exists in Siemens SiPass integrated prior to version V3.0, which stems from improper access control and could allow an attacker to manipulate other users' data...

PT-2025-41885

Name of the Vulnerable Software and Affected Versions SiPass integrated versions prior to 3.0 Description A broken access control issue exists in SiPass integrated server applications. The authorization mechanism does not have enough server-side checks, which allows an attacker to execute a...