CVE-2026-85414 Gallery : FooGallery <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute

The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'customsettings' Shortcode Attribute in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-41555

A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions FGAP v2 are turned on, an administrator who is allowed to see a specific "role" can...

EUVD-2023-41042

Malicious code in bioql PyPI...

EUVD-2025-17661

Malicious code in bioql PyPI...

EUVD-2023-27892

Malicious code in bioql PyPI...

CVE-2025-43701

Improper Preservation of Permissions vulnerability in Salesforce OmniStudio FlexCards allows exposure of Custom Settings data. This impacts OmniStudio: before version 254...

CVE-2025-43701

Improper Preservation of Permissions vulnerability in Salesforce OmniStudio FlexCards allows exposure of Custom Settings data. This impacts OmniStudio: before version 254...

CVE-2025-43701

Improper Preservation of Permissions vulnerability in Salesforce OmniStudio FlexCards allows exposure of Custom Settings data. This impacts OmniStudio: before version 254...

CVE-2025-43701

An Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows for the exposure of Custom Settings data. This issue impacts OmniStudio versions prior to 254 . The root cause stems from improper privilege retention, which could allow unauthorized internal or exte...

CVE-2025-43701

Improper Preservation of Permissions vulnerability in Salesforce OmniStudio FlexCards allows exposure of Custom Settings data. This impacts OmniStudio: before version 254...

CVE-2025-43701: Improper Preservation of Permissions

Improper Preservation of Permissions vulnerability in Salesforce OmniStudio FlexCards allows exposure of Custom Settings data. This impacts OmniStudio: before version 254...

PT-2025-22121 · Salesforce · Omnis Studio

Name of the Vulnerable Software and Affected Versions: Salesforce OmniStudio versions prior to 254 Description: The issue is related to an Improper Preservation of Permissions vulnerability in Salesforce OmniStudio FlexCards, which allows exposure of Custom Settings data. Recommendations: For...

Design/Logic Flaw

Jenkins Pipeline Maven Integration Plugin 1330.v18e473854496 and earlier does not properly mask i.e., replace with asterisks usernames of credentials specified in custom Maven settings in Pipeline build logs if "Treat username as secret" is checked...

CVE-2023-41934

Jenkins Pipeline Maven Integration Plugin 1330.v18e473854496 and earlier does not properly mask i.e., replace with asterisks usernames of credentials specified in custom Maven settings in Pipeline build logs if "Treat username as secret" is checked...

BageCMS Cross-Site Scripting Vulnerability

BageCMS is a cross-platform content management system CMS based on PHP and MySQL by the BageCMS team in China. A cross-site scripting vulnerability exists in BageCMS v3.1.0, which stems from the lack of effective filtering and escaping of user-supplied data in the custom settings module, and can ...

CVE-2023-37122

A stored cross-site scripting XSS vulnerability in Bagecms v3.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Settings module...

CVE-2023-37122

A stored cross-site scripting XSS vulnerability in Bagecms v3.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Settings module...

CVE-2023-37122

A stored cross-site scripting XSS vulnerability in Bagecms v3.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Settings module...

Cross site scripting

A stored cross-site scripting XSS vulnerability in Bagecms v3.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Settings module...

CVE-2023-37122

A stored cross-site scripting XSS vulnerability in Bagecms v3.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Settings module...