1076 matches found
GitLab 跨站脚本漏洞
GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery and other features. A cross-site scripting vulnerability exists in GitLab CE/EE versions prior to...
Linux Distros Unpatched Vulnerability : CVE-2025-5271
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Previewing a response in Devtools ignored CSP headers, which could have allowed content injection attacks. This vulnerability was fixed in Firefox 139 and...
WordPress Eventer plugin < 3.9.9.1 - Content Injection vulnerability
Content Injection vulnerability discovered by Bonds in WordPress Plugin Eventer versions 3.9.9.1...
WordPress Doctreat theme <= 1.6.7 - Content Injection vulnerability
Content Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Doctreat versions = 1.6.7...
WordPress Classified Listing Plugin plugin <= 5.0.0 - Content Injection Vulnerability
Content Injection Vulnerability discovered by Denver Jackson in WordPress Plugin Classified Listing versions = 5.0.0...
WordPress MinimogWP Theme <= 3.9.0 is vulnerable to Content Injection
Software MinimogWP Type Theme Vulnerable versions = 3.9.0 Fixed in 3.9.1 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2025-8198 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID d80fff95e821 Credits Valatty Required privilege Unauthenticated Published ...
CVE-2025-6948
An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2 that, under certain conditions, could have allowed a successful attacker to execute actions on behalf of users by injecting malicious content...
UBUNTU-CVE-2025-6948
An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2 that, under certain conditions, could have allowed a successful attacker to execute actions on behalf of users by injecting malicious content...
CVE-2025-45479
Insufficient security mechanisms for created containers in educoder challenges v1.0 allow attackers to execute arbitrary code via injecting crafted content into a container...
The Hidden Threat in Plain Text: Attacking RAG Data Loaders
Large Language Models LLMs have transformed human-machine interaction since ChatGPT's 2022 debut, with Retrieval-Augmented Generation RAG emerging as a key framework that enhances LLM outputs by integrating external knowledge. However, RAG's reliance on ingesting external documents introduces new...
WordPress WoodMart Theme <= 8.2.3 is vulnerable to Content Injection
Software WoodMart Type Theme Vulnerable versions = 8.2.3 Fixed in 8.2.4 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2025-6744 Patch priority Medium CVSS severity Medium 7.3 Developer Xtemos PSID 56c1aba7e1f2 Credits stealthcopter Required privilege Unauthenticated Publishe...
WordPress Frontend File Manager plugin <= 23.6 - Content Injection vulnerability
Content Injection vulnerability discovered by PARKGyunDeuk in WordPress Plugin Frontend File Manager versions = 23.6...
CVE-2025-27358 WordPress Frontend File Manager plugin <= 23.6 - Content Injection vulnerability
Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in N-Media Frontend File Manager nmedia-user-file-uploader allows Code Injection.This issue affects Frontend File Manager: from n/a through = 23.6...
WordPress Frontend File Manager Plugin <= 23.2 is vulnerable to Content Injection
Software Frontend File Manager Type Plugin Vulnerable versions = 23.2 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Content Injection CVE CVE-2025-27358 Patch priority Low CVSS severity Low 4.6 Developer Claim ownership PSID 0793a304d7eb Credits PARKGyunDeuk Required privileg...
HTML Injection
starcitizentools/citizen-skin is vulnerable to Arbitrary HTML injection. The vulnerability is due to system messages being inserted into the DOM as raw HTML, allowing users with editinterface rights to inject content without needing editsitejs permissions...
TencentOS Server 3: mailman:2.1 (TSSA-2022:0093)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0093 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...
WordPress Team Showcase plugin < 25.05.13 - Arbitrary Shortcode Execution vulnerability
Arbitrary Shortcode Execution vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Team Showcase versions 25.05.13...
Mind the Gap: a Practical Attack on GGUF Quantization
With the increasing size of frontier LLMs, post-training quantization has become the standard for memory-efficient deployment. Recent work has shown that basic rounding-based quantization schemes pose security risks, as they can be exploited to inject malicious behaviors into quantized models tha...
FreeBSD : Firefox -- content injection attack (a3291f81-3d7c-11f0-9a55-b42e991fc52e)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a3291f81-3d7c-11f0-9a55-b42e991fc52e advisory. [email protected] reports: Previewing a response in Devtools ignored CSP headers, which could have...