CVE-2025-0984

Netoloji Software E-Flow is affected (versions before 3.23.00). The vulnerability is an Unrestricted Upload of File with Dangerous Type combined with improper input neutralization during web page generation, enabling Stored XSS and File Content Injection. The issue can allow an attacker to access...

Netoloji E-Flow 代码问题漏洞

Netoloji E-Flow is an application from the Turkish company Netoloji. A code issue vulnerability exists in Netoloji E-Flow versions prior to 3.23.00, which stems from an unrestricted upload of dangerous types of files and improper input neutralization during web page generation, which could lead t...

CVE-2025-0984: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Netoloji Software E-Flow allows Accessing Functionality Not Properly Constrained by ACLs, Stored XSS, File Content Injection. This issue...

WordPress LayoutBoxx plugin <= 0.3.1 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Avraham Shemesh in WordPress Plugin LayoutBoxx versions = 0.3.1...

WordPress Motors Theme <= 5.6.65 is vulnerable to Content Injection

Software Motors Type Theme Vulnerable versions = 5.6.65 Fixed in 5.6.66 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-13738 Patch priority Medium CVSS severity Medium 7.3 Developer Claim ownership PSID 81285145e079 Credits Lucio Sá Required privilege Unauthenticated...

Cross-Site Scripting (XSS)

github.com/songquanpeng/one-api is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper input validation and sanitization of the argument "Homepage Content/About System/Footer.", allows malicious content to be injected and executed in the user's browser...

WordPress Anps Theme plugin plugin <= 1.1.1 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Lucio Sá in WordPress Plugin Anps Theme versions = 1.1.1...

WordPress Form Builder plugin <= 1.2.4 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Avraham Shemesh in WordPress Plugin Form Builder versions = 1.2.4...

WordPress Ocean Extra plugin <= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by stealthcopter in WordPress Plugin Ocean Extra versions = 2.4.6...

WordPress Sign-up Sheets plugin <= 2.3.0.1 - Shortcode Injection vulnerability

Shortcode Injection vulnerability discovered by Phan Trong Quan - VNPT Cyber Immunity in WordPress Plugin Sign-up Sheets versions = 2.3.0.1...

WordPress Everest Forms plugin <= 3.1.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by mikemyers in WordPress Plugin Everest Forms versions = 3.1.1...

WordPress azurecurve Shortcodes in Comments plugin <= 2.0.2 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Avraham Shemesh in WordPress Plugin azurecurve Shortcodes in Comments versions = 2.0.2...

WordPress ORDER POST plugin <= 2.0.2 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Avraham Shemesh in WordPress Plugin ORDER POST versions = 2.0.2...

tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

A flaw was found in Apache Tomcat. In certain conditions and configurations, this vulnerability allows a remote attacker to exploit a path equivalence flaw to view file system contents and add malicious content via a write-enabled Default Servlet in Apache Tomcat. For the vulnerability to be...

tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

A flaw was found in Apache Tomcat. In certain conditions and configurations, this vulnerability allows a remote attacker to exploit a path equivalence flaw to view file system contents and add malicious content via a write-enabled Default Servlet in Apache Tomcat. For the vulnerability to be...

WordPress Tutor LMS plugin <= 3.4.0 - HTML Injection vulnerability

HTML Injection vulnerability discovered by Revan Arifio in WordPress Plugin Tutor LMS versions = 3.4.0...

CVE-2025-32200

...

CVE-2025-32200

...

CVE-2025-32200

This CVE entry has been rejected and does not represent an active vulnerability.

CVE-2025-31729 WordPress WooTumblog plugin <= 2.1.4 - Content Injection vulnerability

Missing Authorization vulnerability in jeffikus WooTumblog allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WooTumblog: from n/a through 2.1.4...