CVE-2025-53487

The ApprovedRevs extension for MediaWiki is vulnerable to stored XSS in multiple locations where system messages are inserted into raw HTML without proper escaping. Attackers can exploit this by injecting JavaScript payloads via the uselang=x-xss language override, which causes crafted message ke...

Microsoft MPEG-2 Video Extension 安全漏洞

Microsoft MPEG-2 Video Extension is a Microsoft Corporation USA playback of MPEG video in popular video applications on Windows 10 devices. A security vulnerability exists in Microsoft MPEG-2 Video Extension. An attacker could exploit the vulnerability to remotely execute code. The following...

CVE-2025-53481 Denial of service vector on ipinfo/v0/norevision

Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - IPInfo Extension allows Excessive Allocation.This issue affects Mediawiki - IPInfo Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2...

Wikimedia Mediawiki GoogleDocs4MW Extension 安全漏洞

The Wikimedia Mediawiki GoogleDocs4MW Extension is a Wikimedia Foundation extension for wiki projects. A security vulnerability in Wikimedia Mediawiki GoogleDocs4MW Extension version 1.42.7 prior to 1.42.x and 1.43.2 prior to 1.43.x, which stems from improper input neutralization, could lead to a...

CVE-2025-53492

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - MintyDocs Extension allows Stored XSS.This issue affects Mediawiki - MintyDocs Extension: from 1.43.X before 1.43.2...

CVE-2025-6435 Save as in Devtools could download files without sanitizing the extension

If a user saved a response from the Network tab in Devtools using the Save As context menu option, that file may not have been saved with the .download file extension. This could have led to the user inadvertently running a malicious executable. This vulnerability was fixed in Firefox 140 and...

CVE-2025-6435 Save as in Devtools could download files without sanitizing the extension

If a user saved a response from the Network tab in Devtools using the Save As context menu option, that file may not have been saved with the .download file extension. This could have led to the user inadvertently running a malicious executable. This vulnerability was fixed in Firefox 140 and...

CVE-2023-23554

Uncontrolled search path element vulnerability exists in pgivm versions prior to 1.5.1. When refreshing an IMMV, pgivm executes functions without specifying schema names. Under certain conditions, pgivm may be tricked to execute unexpected functions from other schemas with the IMMV owner's...

CVE-2022-29602

The gridelements aka Grid Elements extension through 7.6.1, 8.x through 8.7.0, 9.x through 9.7.0, and 10.x through 10.2.0 extension for TYPO3 allows XSS...

CVE-2021-29261

The unofficial Svelte extension before 104.8.0 for Visual Studio Code allows attackers to execute arbitrary code via a crafted workspace configuration...

CVE-2020-25778

Trend Micro Antivirus for Mac 2020 Consumer has a vulnerability in a specific kernel extension where an attacker could supply a kernel pointer and leak several bytes of memory. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this...

CVE-2012-1077

SQL injection vulnerability in the Post data records to facebook bcpost2facebook extension before 0.2.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2011-5080

Cross-site scripting XSS vulnerability in lib/class.txjftcaformstceFunc.php in the Additional TCA Forms jftcaforms extension before 0.2.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-20524

The Chat Anywhere extension 2.4.0 for Chrome allows XSS via crafted use of in a message, because a danmuWrapper DIV element in chatbox-only\danmu.js is outside the scope of a Content Security Policy CSP...

CVE-2010-4950

SQL injection vulnerability in the Event event extension before 0.3.7 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2016-1000271

Joomla extension DT Register version before 3.1.12 Joomla 3.x / 2.8.18 Joomla 2.5 contains an SQL injection in "/index.php?controller=calendar=raw0=SQLi=events". This attack appears to be exploitable if the attacker can reach the web server...

CVE-2025-48201

The nsbackup extension through 13.0.0 for TYPO3 has a Predictable Resource Location...

CVE-2025-48205

The CVE-2025-48205 entry concerns the sr_feuser_register extension for TYPO3 (up to version 12.4.8). The root cause is an Insecure Direct Object Reference that allows attackers to read arbitrary files. Impact is a high-severity exposure of potentially sensitive information. Public references in c...

PT-2025-16139 · Mediawiki · Mediawiki - Tabs Extension

Name of the Vulnerable Software and Affected Versions: Mediawiki - Tabs Extension versions 1.39 through 1.43 Description: The issue is related to an Improper Input Validation vulnerability that allows Code Injection in the Mediawiki - Tabs Extension. Recommendations: For versions 1.39 through 1.4...

The vulnerability of the Clickstorm SEO (cs_seo) extension of the TYPO3 content management system, which exists due to the lack of measures taken to protect the structure of web pages, allows attackers to perform cross-site scripting attacks.

The vulnerability of the Clickstorm SEO csseo extension of the TYPO3 content management system exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...