MAL-2025-39052 Malicious code in webtask-sequence-editor (npm)

The package webtask-sequence-editor was found to contain malicious code...

Malicious code in ory-editor-core-hubside (npm)

The package ory-editor-core-hubside was found to contain malicious code...

Malicious code in rule-editor (npm)

The package rule-editor was found to contain malicious code...

Malicious code in three-editor-release (npm)

The package three-editor-release was found to contain malicious code...

WordPress RSS Feed Pro Plugin <= 1.1.8 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nabil Irawan in WordPress Plugin RSS Feed Pro versions = 1.1.8...

CVE-2025-55672 Apache Superset: Stored XSS on charts metadata

A stored Cross-Site Scripting XSS vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they...

CVE-2025-52712 WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.27.8 - Path Traversal Vulnerability

Path Traversal: '.../...//' vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Path Traversal.This issue affects Post and Page Builder by BoldGrid: from n/a through = 1.27.8...

CVE-2025-52712

CVE-2025-52712 is a Path Traversal vulnerability in WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor, affecting versions up to 1.27.8. Technical details across sources confirm the issue is a path traversal flaw (root cause: improper handling of file paths) that could enab...

CVE-2025-54739: Missing Authorization

Missing Authorization vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nexter Blocks: from n/a through = 4.5.4...

CVE-2012-10054

Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRScript operation that permits arbitrary file uploads without authentication. By exploiting a path traversal flaw in the fileName parameter,...

CVE-2012-10054 Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE

Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRScript operation that permits arbitrary file uploads without authentication. By exploiting a path traversal flaw in the fileName parameter,...

CVE-2012-10054

Umbraco CMS

CVE-2025-51691

Cross-Site Scripting XSS vulnerability found in MarkTwo commit e3a1d3f90cce4ea9c26efcbbf3a1cbfb9dcdb298 May 2025 allows a remote attacker to execute arbitrary code via a crafted script input to the editor interface. The application does not properly sanitize user-supplied Markdown before renderin...

WordPress WP Airdrop Manager plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nabil Irawan Patchstack Alliance in WordPress Plugin WP Airdrop Manager versions = 1.0.5...

K000151782: BIG-IP APM VPN browser client for macOS vulnerability CVE-2025-48500

Security Advisory Description A missing file integrity check vulnerability exists on the macOS F5 VPN browser client installer that may allow a local, authenticated attacker with access to the local file system to replace it with a malicious package installer. CVE-2025-48500 Impact A local,...

CVE-2025-51691: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting XSS vulnerability found in MarkTwo commit e3a1d3f90cce4ea9c26efcbbf3a1cbfb9dcdb298 May 2025 allows a remote attacker to execute arbitrary code via a crafted script input to the editor interface. The application does not properly sanitize user-supplied Markdown before renderin...

Rockwell Automation Arena Simulation DOE File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Rockwell Automation Arena Simulation. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists with...

Umbraco CMS security vulnerabilities

Umbraco CMS is a content management system from Umbraco, Denmark. A security vulnerability exists in Umbraco CMS versions prior to 4.7.1, which stems from the presence of path traversal in the codeEditorSave.asmx endpoint, which could lead to remote code execution...

CVE-2025-51691

Cross-Site Scripting XSS vulnerability found in MarkTwo commit e3a1d3f90cce4ea9c26efcbbf3a1cbfb9dcdb298 May 2025 allows a remote attacker to execute arbitrary code via a crafted script input to the editor interface. The application does not properly sanitize user-supplied Markdown before renderin...

PT-2025-32991 · Marktwo · Marktwo

Name of the Vulnerable Software and Affected Versions: MarkTwo versions prior to commit e3a1d3f90cce4ea9c26efcbbf3a1cbfb9dcdb298 May 2025 Description: A Cross-Site Scripting XSS issue exists in MarkTwo. The application does not properly sanitize user-supplied Markdown before rendering it, allowin...