JLSEC-2025-39 Possible XSS in HTMLSanitizer when using svg elements

Description When adding the style tag to the whitelist, content inside the tag is incorrectly unescaped, and closing tags injected as content are interpreted as real HTML, enabling tag injection and JavaScript execution. This behavior is similar to the sanitization bypass described in CVE-2020-40...

PT-2025-41894

Name of the Vulnerable Software and Affected Versions Winsure versions through August 21, 2025 Description A flaw exists in Winsure that allows for Blind SQL Injection due to improper neutralization of special elements used in SQL commands. This could allow an attacker to execute arbitrary SQL co...

The vulnerability of the ssh component in the OpenSSH cryptographic security tool allows a hacker to execute arbitrary code.

The vulnerability of the ssh component in the OpenSSH cryptographic protection mechanism is related to improper handling of special elements. Exploiting this vulnerability allows an attacker to execute arbitrary code...

SUSE CVE-2025-52885

Poppler ia a library for rendering PDF files, and examining or modifying their structure. A use-after-free write vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a std::vector, which...

WordPress TheGem Theme Elements (for WPBakery) plugin <= 5.10.5.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by ? in WordPress Plugin TheGem Theme Elements for WPBakery versions = 5.10.5.1...

CVE-2025-52885

Poppler ia a library for rendering PDF files, and examining or modifying their structure. A use-after-free write vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a std::vector, which...

CVE-2025-0636 Arbitrary Code Execution vulnerability in Ericsson RAN Compute and Site Controller

EMCLI contains a high severity vulnerability where improper neutralization of special elements used in an OS command could be exploited leading to Arbitrary Code Execution...

Huawei EulerOS: Security Advisory for polkit (EulerOS-SA-2025-2208)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress TheGem Theme Elements (for Elementor) plugin <= 5.10.5.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by an unknown individual in WordPress Plugin TheGem Theme Elements for Elementor versions = 5.10.5.1...

WordPress TheGem Theme Elements (for Elementor) plugin <= 5.10.5.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by an unknown individual in WordPress Plugin TheGem Theme Elements for Elementor versions = 5.10.5.1...

CVE-2025-41088

Stored Cross-Site Scripting XSS in Xibo Signage's Xibo CMS v4.1.2, due to a lack of proper validation of user input. To exploit the vulnerability, the attacker must create a template in the 'Templates' section, then add a text element in the 'Global Elements' section, and finally modify the 'Text...

DEBIAN-CVE-2025-52885

Poppler ia a library for rendering PDF files, and examining or modifying their structure. A use-after-free write vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a std::vector, which...

UBUNTU-CVE-2025-52885

Poppler ia a library for rendering PDF files, and examining or modifying their structure. A use-after-free write vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a std::vector, which...

CVE-2025-52885

Poppler ia a library for rendering PDF files, and examining or modifying their structure. A use-after-free write vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a std::vector, which...

CVE-2025-41088

Stored Cross-Site Scripting XSS in Xibo Signage's Xibo CMS v4.1.2, due to a lack of proper validation of user input. To exploit the vulnerability, the attacker must create a template in the 'Templates' section, then add a text element in the 'Global Elements' section, and finally modify the 'Text...

CVE-2025-41088 Stored Cross-Site Scripting (XSS) in CMS

Stored Cross-Site Scripting XSS in Xibo Signage's Xibo CMS v4.1.2, due to a lack of proper validation of user input. To exploit the vulnerability, the attacker must create a template in the 'Templates' section, then add a text element in the 'Global Elements' section, and finally modify the 'Text...

CVE-2025-41088

CVE-2025-41088 affects Xibo CMS v4.1.2. A stored XSS flaw arises from insufficient validation of user input, exploited by creating a template in Templates, adding a text element in Global Elements, then altering the Text field with malicious payload. Impact described as cross-site script executio...

wifi: mac80211: increase scan_ies_len for S1G

...

PT-2025-41536

Name of the Vulnerable Software and Affected Versions Xibo CMS version 4.1.2 Description A stored Cross-Site Scripting XSS issue exists due to insufficient validation of user input. An attacker can exploit this by creating a template in the 'Templates' section, adding a text element in the 'Globa...

CVE-2025-41088: Improper Neutralization of Input During Web Page Generation

Stored Cross-Site Scripting XSS in Xibo Signage's Xibo CMS v4.1.2, due to a lack of proper validation of user input. To exploit the vulnerability, the attacker must create a template in the 'Templates' section, then add a text element in the 'Global Elements' section, and finally modify the 'Text...