CVE-2025-53287

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Robert Cummings Quick Favicon quick-favicon allows Stored XSS.This issue affects Quick Favicon: from n/a through = 0.22.8...

CVE-2025-53287

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Robert Cummings Quick Favicon quick-favicon allows Stored XSS.This issue affects Quick Favicon: from n/a through = 0.22.8...

CVE-2025-53287 WordPress Quick Favicon plugin <= 0.22.8 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Robert Cummings Quick Favicon quick-favicon allows Stored XSS.This issue affects Quick Favicon: from n/a through = 0.22.8...

CVE-2025-53287 WordPress Quick Favicon plugin <= 0.22.8 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Robert Cummings Quick Favicon quick-favicon allows Stored XSS.This issue affects Quick Favicon: from n/a through = 0.22.8...

CVE-2025-53287

CVE-2025-53287 affects the WordPress Quick Favicon plugin. It is a stored XSS due to improper input neutralization during web-page generation, impacting versions up to 0.22.8. Exploitation details or exact patched version are not provided in the documents; remediation is to upgrade to a version t...

WordPress plugin Quick Favicon 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin ... A cross-site scripting...

PT-2025-27192 · Unknown · Quick Favicon

Name of the Vulnerable Software and Affected Versions: Quick Favicon versions through 0.22.8 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This enables an attacker to inject malicious...

SUSE CVE-2023-32209

A maliciously crafted favicon could have led to an out of memory crash. This vulnerability affects Firefox 113...

CVE-2025-28964

Cross-Site Request Forgery CSRF vulnerability in mangup Personal Favicon personal-favicon allows Stored XSS.This issue affects Personal Favicon: from n/a through = 2.0...

CVE-2025-46339

FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to poison feed favicons by adding a given URL as a feed with the proxy set to an attacker-controlled one and disabled SSL verifying. The favicon hash is computed by hashing the feed URL and the salt, whilst not...

CVE-2025-28964

Cross-Site Request Forgery CSRF vulnerability in mangup Personal Favicon personal-favicon allows Stored XSS.This issue affects Personal Favicon: from n/a through = 2.0...

CVE-2025-28964 WordPress Personal Favicon plugin <= 2.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in mangup Personal Favicon personal-favicon allows Stored XSS.This issue affects Personal Favicon: from n/a through = 2.0...

CVE-2025-28964

CVE-2025-28964 describes a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Personal Favicon , which enables a Stored XSS condition. Affected: Personal Favicon, potentially up to version 2.0 (no lower bound provided). The CVSS 3.1 metrics indicate a base score of 7.1 (High)...

CVE-2025-28964 WordPress Personal Favicon plugin <= 2.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in mangup Personal Favicon personal-favicon allows Stored XSS.This issue affects Personal Favicon: from n/a through = 2.0...

PT-2025-24127 · Unknown · Mangup Personal Favicon

Name of the Vulnerable Software and Affected Versions: mangup Personal Favicon versions n/a through 2.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application...

WordPress plugin Personal Favicon 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

WordPress Personal Favicon plugin <= 2.0 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Personal Favicon versions = 2.0...

CVE-2025-46339

FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to poison feed favicons by adding a given URL as a feed with the proxy set to an attacker-controlled one and disabled SSL verifying. The favicon hash is computed by hashing the feed URL and the salt, whilst not...

CVE-2025-46339

FreshRSS prior to version 1.26.2 is vulnerable to favicon cache poisoning via a manipulated feed URL and an attacker-controlled proxy with SSL verification disabled. The underlying issue is the favicon hash computation, which hashes the feed URL and a salt but omits proxy address, proxy protocol,...

CVE-2025-46339 FreshRSS vulnerable to favicon cache poisoning via proxy

FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to poison feed favicons by adding a given URL as a feed with the proxy set to an attacker-controlled one and disabled SSL verifying. The favicon hash is computed by hashing the feed URL and the salt, whilst not...