CVE-2025-47916

Invision Community 5.0.0–5.0.6 (and up to 5.0.7 fixed) contains an unauthenticated RCE in the themeeditor.php controller, via the customCss() method. The content parameter is passed to Theme::makeProcessFunction(), allowing the template engine to evaluate crafted template expressions, enabling ar...

CVE-2024-8492

The Hustle WordPress plugin through 7.8.5 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2024-10631

The Countdown Timer for WordPress Block Editor WordPress plugin through 1.0.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site...

CVE-2024-7761 Simple Job Board < 2.12.2 - Admin+ Stored XSS

In the process of testing the Simple Job Board WordPress plugin before 2.12.2, a vulnerability was found that allows you to implement Stored XSS on behalf of the editor by embedding malicious script, which entails account takeover backdoor...

CVE-2025-30420

There is a memory corruption vulnerability due to an out of bounds read in Bitmap::InternalDraw when using the SymbolEditor in NI Circuit Design Suite. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user t...

CVE-2025-30418

There is a memory corruption vulnerability due to an out of bounds write in CheckPins when using the SymbolEditor in NI Circuit Design Suite. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a...

CVE-2025-30417

There is a memory corruption vulnerability due to an out of bounds write in Library!DecodeBase64 when using the SymbolEditor in NI Circuit Design Suite. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user...

Malicious code in @support-editor/mts-editor-dist (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cc17d9c05726e2b0a933d0dcd274b122d296191b9b2c1ad6ebbc29ef48c2f527 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in @support-editor/a0e50092.fcs.pw

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @support-editor/mts-editor-dist

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2025-4126

The EG-Series plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's series shortcode in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes in the shortcodetitle function. This makes it possib...

CVE-2025-4126 EG-Series <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The EG-Series plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's series shortcode in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes in the shortcodetitle function. This makes it possib...

CVE-2024-10631: Improper Neutralization of Input During Web Page Generation

The Countdown Timer for WordPress Block Editor WordPress plugin through 1.0.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site...

CVE-2025-4126: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

The EG-Series plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's series shortcode in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes in the shortcodetitle function. This makes it possib...

WordPress Plugin Countdown Timer for WordPress Block Editor has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...

PT-2025-21502 · WordPress · Simple Job Board

Name of the Vulnerable Software and Affected Versions: Simple Job Board WordPress plugin versions prior to 2.12.2 Description: A vulnerability was found in the Simple Job Board WordPress plugin that allows Stored XSS on behalf of the editor by embedding malicious script. This can lead to account...

📄 Invision Community 5.0.6 Remote Code Execution

Invision Community versions 5.0.0 through 5.0.6 suffer from a customCss related remote code execution vulnerability. --------------------------------------------------------------------------- Invision Community = 5.0.6 customCss Remote Code Execution Vulnerability...

Low: Red Hat Security Advisory: vim security update

An update for vim is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE lin...

vim: use-after-free in function ins_compl_get_exp in vim/vim

A flaw was found in Vim, where it is vulnerable to a use-after-free in the inscomplgetexp function. This flaw allows a specially crafted file to crash software, use unexpected values, or possibly execute code when opened in Vim...

ChurchCRM EventEditor.php Page SQL Injection Vulnerability

ChurchCRM is an open source church management system. ChurchCRM suffers from a SQL injection vulnerability that stems from a time-based SQL blind injection vulnerability in the EID POST parameter of the EventEditor.php page. No detailed vulnerability details are provided at this time...