CVE-2025-59417 Lobe Chat Desktop Vulnerable to Remote Code Execution via XSS in Chat Messages

Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.129.4, there is a a cross-site scripting XSS vulnerability when handling chat message in lobe-chat that can be escalated to remote code execution on the user’s machine. In lobe-chat, when the response from the...

Linux Distros Unpatched Vulnerability : CVE-2022-37426

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Content Injection. CVE-2022-37426 Note that...

WordPress Easy Appointments plugin <= 3.12.14 - Content Injection vulnerability

Content Injection vulnerability discovered by NAJIB Sinjari in WordPress Plugin Easy Appointments versions = 3.12.14...

WordPress WP-Members Membership Plugin plugin <= 3.5.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Profile Names vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution via Profile Names vulnerability discovered by Kishan Vyas in WordPress Plugin WP-Members versions = 3.5.4.2...

CVE-2025-58357

5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Version 0.13.2 contains a vulnerability in the chat page's script gadgets that enables content injection attacks through multiple vectors: malicious prompt injection pages, compromised MCP server...

CVE-2025-58827

CVE-2025-58827 concerns PickPlugins Job Board Manager (WordPress) with an Improper Control of Generation of Code (Code Injection) vulnerability. Affected versions are Job Board Manager up to 2.1.61. The issue stems from inadequate control over generated code, enabling potential code injection. Ex...

CVE-2025-58827 WordPress Job Board Manager Plugin <= 2.1.61 - Content Injection Vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in PickPlugins Job Board Manager job-board-manager allows Code Injection.This issue affects Job Board Manager: from n/a through = 2.1.61...

CVE-2025-58827 WordPress Job Board Manager Plugin <= 2.1.61 - Content Injection Vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in PickPlugins Job Board Manager job-board-manager allows Code Injection.This issue affects Job Board Manager: from n/a through = 2.1.61...

WordPress Job Board Manager Plugin <= 2.1.61 - Content Injection Vulnerability

Content Injection Vulnerability discovered by Kishan Vyas in WordPress Plugin Job Board Manager versions = 2.1.61...

WordPress Rehub Theme <= 19.9.7 is vulnerable to Content Injection

Software Rehub Type Theme Vulnerable versions = 19.9.7 Fixed in 19.9.8 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2025-7366 Patch priority Medium CVSS severity Medium 7.3 Developer Claim ownership PSID ebd91ec5bebd Credits stealthcopter Required privilege Unauthenticated...

Linux Distros Unpatched Vulnerability : CVE-2025-55173

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization i...

CVE-2025-58357

5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Version 0.13.2 contains a vulnerability in the chat page's script gadgets that enables content injection attacks through multiple vectors: malicious prompt injection pages, compromised MCP server...

CVE-2025-58357 5ire Chat Message XSS Vulnerability Enables Remote Code Execution

5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Version 0.13.2 contains a vulnerability in the chat page's script gadgets that enables content injection attacks through multiple vectors: malicious prompt injection pages, compromised MCP server...

CVE-2025-58357 5ire Chat Message XSS Vulnerability Enables Remote Code Execution

5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Version 0.13.2 contains a vulnerability in the chat page's script gadgets that enables content injection attacks through multiple vectors: malicious prompt injection pages, compromised MCP server...

PT-2025-35861

Name of the Vulnerable Software and Affected Versions: 5ire version 0.13.2 5ire versions prior to 0.14.0 Description: 5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. A flaw exists in the chat page's script gadgets that allows content injection...

CVE-2025-55173

A vulnerability in Next.js Image Optimization allowed attacker-controlled image servers to trigger arbitrary file downloads with custom content and filenames. Exploitation required permissive images.domains or images.remotePatterns and user interaction. Binary-Affected: Next.js...

Linux Distros Unpatched Vulnerability : CVE-2022-2527

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in Incident Timelines has been discovered in GitLab CE/EE affecting all versions starting from 14.9 before 15.1.6, all versions starting from 15.2 befo...

CVE-2025-55173

Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization is vulnerable to content injection. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary...

CVE-2025-55173 Next.js Content Injection Vulnerability for Image Optimization

Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization is vulnerable to content injection. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary...

CVE-2025-55173 Next.js Content Injection Vulnerability for Image Optimization

Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization is vulnerable to content injection. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary...