CVE-2025-2314 User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.13.5 due to insufficient input sanitization and output escaping on...

PT-2025-16626 · Unknown · Yuya Hoshino Bulk Term Editor

Name of the Vulnerable Software and Affected Versions: Yuya Hoshino Bulk Term Editor versions 1.1.4 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations: For Yuya Hoshin...

WordPress plugin Bulk Term Editor 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site request forgery...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2025-932)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-932 advisory. A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown code of the file src/main.c. The manipulation of the argument --log leads to memory...

The vulnerability of the EMACS text editor arises from the lack of measures taken to eliminate special elements, allowing attackers to execute arbitrary commands.

The vulnerability of the EMACS text editor exists because measures to neutralize special elements have not been taken. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

PT-2026-60953

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 2.0.5 SurrealDB versions 2.1.x prior to 2.1.5 SurrealDB versions 2.2.x prior to 2.2.2 Description The command-line export command fails to properly escape table and field names. An authenticated System User with OWN...

EulerOS 2.0 SP11 : vim (EulerOS-SA-2025-1380)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow, because Vim does no...

The vulnerability of Visual Studio Code’s source editor, related to access control deficiencies, allows attackers to escalate their privileges.

The vulnerability of Visual Studio Code’s source editor is related to lack of access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

GHSA-RHX4-HVX9-J387 Silverstripe Framework has a XSS vulnerability in HTML editor

Impact A bad actor with access to edit content in the CMS could send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitised on the client-side, but server-side sanitisation doesn't catch...

Silverstripe Framework has a XSS vulnerability in HTML editor

Impact A bad actor with access to edit content in the CMS could send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitised on the client-side, but server-side sanitisation doesn't catch...

CVE-2025-30148 Silverstripe Framework has a XSS vulnerability in HTML editor

Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. Prior to 5.3.23, bad actor with access to edit content in the CMS could send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The...

ibexa/fieldtype-richtext allows access to external entities in XML

Impact This security advisory resolves a vulnerability in the RichText field type. By entering a maliciously crafted input into the RichText XML, an attacker could perform an attack using XML external entity XXE injection, which might be able to read files on the server. To exploit this...

CVE-2025-3064

The WPFront User Role Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.1. This is due to missing or incorrect nonce validation on the whitelistoptions function. This makes it possible for unauthenticated attackers to update the...

CVE-2025-30148 - XSS vulnerability in HTML editor

More info at https://www.silverstripe.org/download/security-releases/cve-2025-30148...

Malicious code in unreal-engine-material-editor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb5416560cfa4f934e2b9541b688b91c11edd2c04d167c8859641e58697d88ef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3202 Malicious code in unreal-engine-material-editor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb5416560cfa4f934e2b9541b688b91c11edd2c04d167c8859641e58697d88ef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress plugin WP Editor.md – The Perfect WordPress Markdown Editor 跨站脚本漏洞

WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in PHP. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. WordPress plugin WP Editor.md - A cross-site scripting...

📄 MaxTime Database Editor 1.9 Authentication Bypass

MaxTime Database Editor version 1.9 suffers from an authentication bypass vulnerability. This CVE also notes the same flow can be used to execute arbitrary code. Exploit Title: MaxTime Database Editor 1.9 Authentication Bypass Google Dork: N/A Date: 07/09/2024 Exploit Author: Andrew Lemon/Red...

CVE-2025-32018

Cursor is a code editor built for programming with AI. In versions 0.45.0 through 0.48.6, the Cursor app introduced a regression affecting the set of file paths the Cursor Agent is permitted to modify automatically. Under specific conditions, the agent could be prompted, either directly by the us...

CVE-2025-32018

Cursor is an AI-codeditor. Versions 0.45.0–0.48.6 contain a regression that broadens the Cursor Agent’s file-modification permissions, allowing, under deliberate prompting (user or crafted context), automatic writes to files outside the opened workspace. The vulnerability can manifest when the ag...