Malicious code in ui-fields (npm)

The package ui-fields was found to contain malicious code...

MAL-2025-37594 Malicious code in ui-fields (npm)

The package ui-fields was found to contain malicious code...

CVE-2025-8947

A vulnerability was found in projectworlds Visitor Management System 1.0. This issue affects some unknown processing of the file /querydata.php. The manipulation of the argument dateF/dateP leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public...

CVE-2025-8947 projectworlds Visitor Management System query_data.php sql injection

A vulnerability was found in projectworlds Visitor Management System 1.0. This issue affects some unknown processing of the file /querydata.php. The manipulation of the argument dateF/dateP leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public...

CVE-2025-50611

A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN00473154 function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of wlsecset5g and wlsecrpset5g in the payload, which can cause the program to crash and potentially...

CVE-2025-50611

Netis WF2880 vulnerability CVE-2025-50611: A buffer overflow in the FUN_00473154 function of the cgitest.cgi file in firmware version 2.1.40207 can be triggered by crafted payloads that set wl_sec_set_5g and wl_sec_rp_set_5g, causing the program to crash and potentially leading to a Denial of Ser...

Cross-site Scripting (XSS)

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Cross-site Scripting XSS via form fields. An attacker can execute arbitrary scripts in the context of other users by injecting malicious code, potentially escalating...

CVE-2025-49557

Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form fields. A successful attacker...

CVE-2025-49557 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form fields. A successful attacker...

CVE-2025-49557 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form fields. A successful attacker...

CVE-2025-49557 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form fields. A successful attacker...

PT-2025-32866 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.4-p14 and earlier Adobe Commerce versions 2.4.5-p13 Adobe Commerce versions 2.4.6-p11 Adobe Commerce versions 2.4.7-p6 Adobe Commerce versions 2.4.8-p1 Adobe Commerce versions 2.4.9-alpha1 Description: The...

CVE-2025-54940

An HTML injection vulnerability exists in WordPress plugin "Advanced Custom Fields" prior to 6.4.3. If this vulnerability is exploited, crafted HTML code may be rendered and page display may be tampered...

curl: Heap Buffer Overflow in Curl_memdup0() via CURLOPT_COPYPOSTFIELDS/CURLOPT_POSTFIELDSIZE Mismatch

Summary A heap buffer overflow vulnerability exists in libcurl's Curlmemdup0 function when handling CURLOPTCOPYPOSTFIELDS operations. The vulnerability occurs when libcurl internally processes POST data where the specified CURLOPTPOSTFIELDSIZE exceeds the actual buffer size of data set via...

CVE-2012-10043 ActFax 4.32 Client Importer Buffer Overflow

A stack-based buffer overflow vulnerability exists in ActFax Server version 4.32, specifically in the "Import Users from File" functionality of the client interface. The application fails to properly validate the length of tab-delimited fields in .exp files, leading to unsafe usage of strcpy duri...

WordPress plugin "Advanced Custom Fields" vulnerable to HTML injection

Overview Advanced Custom Fields provided by WPEngine, Inc. contains the following vulnerability. HTML injection WE-94 - CVE-2025-54940 Shogo Kumamaru of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership...

CVE-2025-54940

An HTML injection vulnerability exists in WordPress plugin "Advanced Custom Fields" prior to 6.4.3. If this vulnerability is exploited, crafted HTML code may be rendered and page display may be tampered...

CVE-2025-54940

Summary of CVE-2025-54940 : A HTML injection vulnerability exists in WordPress plugin Advanced Custom Fields prior to version 6.4.3 . Attackers may have crafted HTML that is rendered, potentially tampering with page display. This vulnerability is evidenced across multiple feeds (NVD, RH, JVN, CNV...

CVE-2025-54940

An HTML injection vulnerability exists in WordPress plugin "Advanced Custom Fields" prior to 6.4.3. If this vulnerability is exploited, crafted HTML code may be rendered and page display may be tampered...

CVE-2025-54940

An HTML injection vulnerability exists in WordPress plugin "Advanced Custom Fields" prior to 6.4.3. If this vulnerability is exploited, crafted HTML code may be rendered and page display may be tampered...