23601 matches found
CVE-2024-13730
CVE-2024-13730 affects the WordPress Podlove Podcast Publisher plugin prior to 4.2.1. The issue arises from insufficient sanitization and escaping of certain settings, enabling stored Cross-Site Scripting by high-privilege users (e.g., admins), even when unfiltered_html is disallowed (such as in ...
CVE-2024-13729
CVE-2024-13729 affects the Podlove Podcast Publisher WordPress plugin prior to version 4.1.24. The vulnerability arises because certain settings are not properly sanitized and escaped, which could allow high-privilege users (e.g., admins) to perform Stored Cross-Site Scripting (Stored XSS) even w...
CVE-2024-13482 Icegram Engage < 3.1.32 - Admin+ Stored XSS
The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-12732
CVE-2024-12732 concerns the WordPress plugin AffiliateImporterEb up to version 1.0.6. A reflected XSS exists because a parameter is output without proper sanitisation/escaping, enabling script execution in admin/high-privilege users’ browsers when a crafted request is made. The issue is supported...
CVE-2024-12722 Twitter Bootstrap Collapse aka Accordian Shortcode <= 1.0 - Stored XSS via Shortcode
The Twitter Bootstrap Collapse aka Accordian Shortcode WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored...
CVE-2024-10107 Giveaways and Contests by RafflePress < 1.12.17 - Admin+ Stored XSS
The Giveaways and Contests by RafflePress WordPress plugin before 1.12.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...
CVE-2024-10143 MB Custom Post Types & Custom Taxonomies < 2.7.7 - Admin+ Stored XSS
The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...
CVE-2025-47789 Horilla Open Redirect Vulnerability in Login
Horilla is a free and open source Human Resource Management System HRMS. In versions up to and including 1.3, an attacker can craft a Horilla URL that refers to an external domain. Upon clicking and logging in, the user is redirected to an external domain. This allows the redirection to any...
CVE-2025-47785
creationtimestamp| type| source ---|---|--- 2025-05-15 19:33:05+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/16545 2025-05-15 22:37:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpalbvpgyj2p...
CVE-2025-47784 Emlog vulnerable to Deserialization of Untrusted Data
Emlog is an open source website building system. Versions 2.5.13 and prior have a deserialization vulnerability. A user who creates a carefully crafted nickname can cause strreplace to replace the value of nameorig with empty, causing deserialization to fail and return false. Commit...
CVE-2025-4705
creationtimestamp| type| source ---|---|--- 2025-05-15 19:03:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpa7cwioog2h...
CVE-2025-4706
creationtimestamp| type| source ---|---|--- 2025-05-15 19:02:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpa7b76c2o2n...
CVE-2025-30420
creationtimestamp| type| source ---|---|--- 2025-05-15 19:02:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpa7b6xeah2e 2025-05-20 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-02...
CVE-2025-4713
Summary: CVE-2025-4713 affects Campcodes Sales and Inventory System 1.0, with a SQL injection vulnerability in the /pages/print.php handler. The root cause is improper handling of the sid parameter, enabling remote exploitation. Public exploit exposure is noted in several references (NVD/Red Hat/...
CVE-2025-47279
Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, th...
CVE-2025-47285
CVE-2025-47285 affects Vyper up to and including 0.4.2rc1, where the built-in concat() may skip evaluation of side effects when an argument has zero length due to a fastpath in the implementation. The issue arises because argument expressions with zero length may bypass evaluation, which could su...
CVE-2025-30394
Sensitive data storage in improperly locked memory in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network...
CVE-2025-29960
Out-of-bounds read in Windows Routing and Remote Access Service RRAS allows an unauthorized attacker to disclose information over a network...