PT-2025-39479

Name of the Vulnerable Software and Affected Versions Mega Elements – Addons for Elementor plugin for WordPress versions up to and including 1.3.2 Description The software contains a Stored Cross-Site Scripting issue within the Countdown Timer widget. Insufficient input sanitization and output...

WordPress plugin Mega Elements – Addons for Elementor 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...

WordPress Mega Elements plugin <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Countdown Timer Widget vulnerability discovered by zer0gh0st in WordPress Plugin Mega Elements versions = 1.3.2...

CVE-2025-29155: Improper Neutralization of Special Elements used in a Command

An issue in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via the DELETE endpoint...

CVE-2025-58220

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Techeshta Card Elements for WPBakery card-elements-for-wpbakery allows DOM-Based XSS.This issue affects Card Elements for WPBakery: from n/a through = 1.0.9...

The vulnerability of the microprogrammed software of Linksys routers such as E4200, E3200, E3000, E2500, E2100L, E2000, E1550, E1500, E1200, E1000, and E900 arises from the lack of measures to neutralize special elements, allowing attackers to execute arbitrary commands.

The vulnerability of the microprogrammed software of Linksys routers such as E4200, E3200, E3000, E2500, E2100L, E2000, E1550, E1500, E1200, E1000, and E900 is related to the lack of measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitra...

The vulnerability of the miniIGD component of the SOAP microprogramming system for routers WRH-733GBK and WRH-733GWH allows a hacker to execute arbitrary code.

The vulnerability of the miniIGD component in the SOAP microprogramming system of the WRH-733GBK and WRH-733GWH routers is related to the lack of measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the Zabbix universal monitoring system is related to the improper neutralization of special elements used in SQL commands, allowing attackers to execute arbitrary SQL queries in the database.

The vulnerability of the Zabbix universal monitoring system is related to the improper neutralization of special elements used in SQL commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries in the database remotely...

CVE-2025-45326: Improper Neutralization of Special Elements used in a Command

An issue in PocketVJ CP PocketVJ-CP-v3 pvj 3.9.1 allows remote attackers to execute arbitrary code via the submitsize.php component...

CVE-2025-58220

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Techeshta Card Elements for WPBakery card-elements-for-wpbakery allows DOM-Based XSS.This issue affects Card Elements for WPBakery: from n/a through = 1.0.8...

WordPress Card Elements for WPBakery Plugin <= 1.0.8 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by theviper17 in WordPress Plugin Card Elements for WPBakery versions = 1.0.8...

CVE-2025-58220 WordPress Card Elements for WPBakery Plugin <= 1.0.8 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Techeshta Card Elements for WPBakery card-elements-for-wpbakery allows DOM-Based XSS.This issue affects Card Elements for WPBakery: from n/a through = 1.0.8...

CVE-2025-58220

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Techeshta Card Elements for WPBakery card-elements-for-wpbakery allows DOM-Based XSS.This issue affects Card Elements for WPBakery: from n/a through = 1.0.8...

CVE-2025-58220

CVE-2025-58220 corresponds to Card Elements for WPBakery (WordPress) and is an XSS vulnerability (Stored Cross-Site Scripting) in Card Elements for WPBakery. Affected: Card Elements for WPBakery plugin, evidence shows vulnerable component is Card Elements for WPBakery

CVE-2025-58220 WordPress Card Elements for WPBakery Plugin <= 1.0.8 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Techeshta Card Elements for WPBakery card-elements-for-wpbakery allows DOM-Based XSS.This issue affects Card Elements for WPBakery: from n/a through = 1.0.8...

Ammonia incorrectly handles embedded SVG and MathML leading to mutation XSS after removal

Affected versions of this crate did not correctly strip namespace-incompatible tags in certain situations, causing it to incorrectly account for differences between HTML, SVG, and MathML. This vulnerability only has an effect when the svg or math tag is allowed, because it relies on a tag being...

GHSA-MM7X-QFJJ-5G2C Ammonia incorrectly handles embedded SVG and MathML leading to mutation XSS after removal

Affected versions of this crate did not correctly strip namespace-incompatible tags in certain situations, causing it to incorrectly account for differences between HTML, SVG, and MathML. This vulnerability only has an effect when the svg or math tag is allowed, because it relies on a tag being...

The vulnerability of the sub_478D28 function in D-Link DI-7400G+ router microprogramming software allows a hacker to gain unauthorized access to the administrator interface.

The vulnerability of function sub478D28 in the D-Link DI-7400G+ router’s microprogramming system is related to the lack of measures taken to neutralize certain special elements. Exploiting this vulnerability can allow an intruder to gain unauthorized access to the administrator interface...

The software-hardware complex for diagnosing and monitoring railway infrastructure, Frauscher FDS102, has vulnerabilities related to the failure to take measures to neutralize special elements. This allows a perpetrator to gain full control over the device.

The vulnerability of the software-hardware complex for diagnosing and monitoring railway infrastructure, the Frauscher FDS102, is related to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability can allow a perpetrator ...

The vulnerability of the Dell EMC Data Domain Operating System (DD OS) arises from the lack of measures taken to neutralize special elements used in the operating system commands. This allows attackers to execute arbitrary commands.

The vulnerability of the Dell EMC Data Domain Operating System DD OS is related to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...