WordPress Digital Events Calendar plugin <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via column Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via column Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Digital Events Calendar versions = 1.0.8...

MAL-2025-47046 Malicious code in @self-sell/self-sell-amplitude-events (npm)

The package @self-sell/self-sell-amplitude-events was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ae064f7137baf9c1292997ecd4204537d8011af89721c3d0878247049cd7a20f Any computer that has this package installed or running should be...

Malicious code in @self-sell/self-sell-amplitude-events (npm)

The package @self-sell/self-sell-amplitude-events was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ae064f7137baf9c1292997ecd4204537d8011af89721c3d0878247049cd7a20f Any computer that has this package installed or running should be...

WordPress plugin Digital Events Calendar 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-37274

Name of the Vulnerable Software and Affected Versions: The Events Calendar plugin for WordPress versions through 6.15.1 Description: The Events Calendar plugin for WordPress is susceptible to a time-based SQL Injection issue due to insufficient escaping of user-supplied parameters and inadequate...

PT-2025-37121

The Digital Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘column’ parameter in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-lev...

CVE-2025-10155

creationtimestamp| type| source ---|---|--- 2025-09-10 19:51:37+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-jgw4-cr84-mqxg 2025-09-17 10:31:59+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3lyzmzk6thf2o 2025-09-17 11:32:14+00:00| seen|...

CVE-2025-59045

Stalwart is a mail and collaboration server. Starting in version 0.12.0 and prior to version 0.13.3, a memory exhaustion vulnerability exists in Stalwart's CalDAV implementation that allows authenticated attackers to cause denial-of-service by triggering unbounded memory consumption through...

CVE-2025-59045 Stalwart vulnerable to Memory Exhaustion via CalDAV Event Expansion

Stalwart is a mail and collaboration server. Starting in version 0.12.0 and prior to version 0.13.3, a memory exhaustion vulnerability exists in Stalwart's CalDAV implementation that allows authenticated attackers to cause denial-of-service by triggering unbounded memory consumption through...

CVE-2025-59045

CVE-2025-59045 affects Stalwart mail/collaboration server in its CalDAV implementation. Vulnerable in versions 0.12.0 through 0.13.2 due to a memory exhaustion flaw in ArchivedCalendarEventData.expand when processing CalDAV REPORT requests with event expansion (e.g., expanded recurring events). A...

CVE-2025-59045 Stalwart vulnerable to Memory Exhaustion via CalDAV Event Expansion

Stalwart is a mail and collaboration server. Starting in version 0.12.0 and prior to version 0.13.3, a memory exhaustion vulnerability exists in Stalwart's CalDAV implementation that allows authenticated attackers to cause denial-of-service by triggering unbounded memory consumption through...

CVE-2025-59045 Stalwart vulnerable to Memory Exhaustion via CalDAV Event Expansion

Stalwart is a mail and collaboration server. Starting in version 0.12.0 and prior to version 0.13.3, a memory exhaustion vulnerability exists in Stalwart's CalDAV implementation that allows authenticated attackers to cause denial-of-service by triggering unbounded memory consumption through...

CVE-2025-56405

An issue was discovered in litmusautomation litmus-mcp-server thru 0.0.1 allowing unauthorized attackers to control the target's MCP service through the SSE protocol...

CVE-2025-56404

An issue was discovered in MariaDB MCP 0.1.0 allowing attackers to gain sensitive information via the SSE service as the SSE service lacks user validation...

CVE-2025-56405

An issue was discovered in litmusautomation litmus-mcp-server thru 0.0.1 allowing unauthorized attackers to control the target's MCP service through the SSE protocol...

Linux Distros Unpatched Vulnerability : CVE-2024-55227

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A cross-site scripting XSS vulnerability in the Events/Agenda module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a...

PT-2025-37076

Name of the Vulnerable Software and Affected Versions: Stalwart versions 0.12.0 through 0.13.2 Description: Stalwart is a mail and collaboration server. A memory exhaustion vulnerability exists in Stalwart’s CalDAV implementation that allows authenticated attackers to cause a denial-of-service by...

PT-2025-37049

Name of the Vulnerable Software and Affected Versions: MariaDB MCP version 0.1.0 Description: An issue was discovered in the MariaDB MCP software where attackers can gain sensitive information via the SSE service due to a lack of user validation within the service. Recommendations: Ensure proper...

CVE-2025-56406

An issue was discovered in mcp-neo4j 0.3.0 allowing attackers to obtain sensitive information or execute arbitrary commands via the SSE service. NOTE: the Supplier's position is that authentication is not mandatory for MCP servers, and the mcp-neo4j MCP server is only intended for use in a local...

CVE-2025-56406

An issue was discovered in mcp-neo4j 0.3.0 allowing attackers to obtain sensitive information or execute arbitrary commands via the SSE service. NOTE: the Supplier's position is that authentication is not mandatory for MCP servers, and the mcp-neo4j MCP server is only intended for use in a local...