CVE-2025-24910

Overview XML documents optionally contain a Document Type Definition DTD, which, among other features, enables the definition of XML entities. It is possible to define an entity by providing a substitution string in the form of a URI. Once the content of the URI is read, it is fed back into the...

CVE-2025-24911

Overview XML documents optionally contain a Document Type Definition DTD, which, among other features, enables the definition of XML entities. It is possible to define an entity by providing a substitution string in the form of a URI. Once the content of the URI is read, it is fed back into the...

CVE-2024-12862

Incorrect Authorization vulnerability in the OpenText Content Server REST API on Windows, Linux allows users without the appropriate permissions to remove external collaborators.This issue affects Content Server: 20.2-24.4...

Malicious code in dowload_ebok_si_la_verdad_te_incomoda_no_leas_este_libro_by_armando_r_manjarres_0qwta (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 423ed02534dc5f69e700f584aa2650eeb9221a31037dbeb366660c166801552d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the Proself Enterprise/Standard Edition, Proself Gateway Edition, and Proself Mail Sanitize Edition software lies in the improper limitation of XML references to external objects. This allows attackers to carry out XXE attacks.

The vulnerability of Proself Enterprise/Standard Edition, Proself Gateway Edition, and Proself Mail Sanitize Edition software products is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability allows a malicious actor to perform XXE attacks remotely...

Malicious code in bytedmemfdd345 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 19705d4db8178a4b1dd1282ded6d73256dc10b22125280c241524ec3e9e274af During installation, a website with the current working dir is being called. It looks like something between spam and pentest as the website is most probably n...

WordPress External Markdown plugin <= 0.0.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by johska in WordPress Plugin External Markdown versions = 0.0.1...

CVE-2025-46445

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in pReya External Markdown external-markdown allows Stored XSS.This issue affects External Markdown: from n/a through = 0.0.1...

CVE-2025-46445 WordPress External Markdown plugin <= 0.0.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in pReya External Markdown external-markdown allows Stored XSS.This issue affects External Markdown: from n/a through = 0.0.1...

CVE-2025-46445 WordPress External Markdown plugin <= 0.0.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in pReya External Markdown external-markdown allows Stored XSS.This issue affects External Markdown: from n/a through = 0.0.1...

CVE-2025-46445

CVE-2025-46445 affects the WordPress External Markdown plugin, with a Stored XSS in the plugin’s web page generation for versions n/a through 0.0.1. The connected sources confirm the issue and indicate the vulnerable range but do not specify a fixed version or patch details. No exploit specifics ...

New whitepaper outlines the taxonomy of failure modes in AI agents

We are releasing a taxonomy of failure modes in AI agents to help security professionals and machine learning engineers think through how AI systems can fail and design them with safety and security in mind. The taxonomy continues Microsoft AI Red Team's work to lead the creation of systematizati...

XML External Entity (XXE) Injection

RichText is vulnerable to XML External Entity XXE Injection. The vulnerability is due to improper input validation due to unsafe XML elements being processed in user-editable RichText fields, allowing attackers with edit permissions to read server files...

WordPress plugin External Markdown 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-17770 · Unknown · Preya External Markdown

Name of the Vulnerable Software and Affected Versions: pReya External Markdown versions n/a through 0.0.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS in pReya External Markdown...

CVE-2025-2763

CarlinKit CPC200-CCPA Improper Verification of Cryptographic Signature Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of CarlinKit CPC200-CCPA devices. Authentication is not required to exploit this...

SUSE CVE-2025-43920

GNU Mailman 2.1.39, as bundled in cPanel and WHM, in certain external archiver configurations, allows unauthenticated attackers to execute arbitrary OS commands via shell metacharacters in an email Subject line. NOTE: multiple third parties report that they are unable to reproduce this, regardles...

VulnCheck KEV: CVE-2024-9234

The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the installandactivatepluginfromexternal function install-active-plugin REST API endpoint in all...

PT-2025-17619 · Microsoft · Azure Ad Authentication

Name of the Vulnerable Software and Affected Versions: Microsoft Azure AD Authentication affected versions not specified Description: The issue concerns Microsoft Azure AD Authentication. No specific details about the nature of the issue are provided, but it is mentioned that more information, su...

USN-7444-1: Synapse vulnerabilities

It was discovered that Synapse network policies could be bypassed via specially crafted URLs. An attacker could possibly use this issue to bypass authentication mechanisms. CVE-2023-32683 It was discovered that Synapse exposed cached device information. An attacker could possibly use this issue t...