MAL-2025-31786 Malicious code in react-flex-dropdowns (npm)

The package react-flex-dropdowns was found to contain malicious code...

CVE-2025-9042 Rockwell Automation FLEX 5000 I/O - Module Fault

A security issue exists due to improper handling of CIP Class 32’s request when a module is inhibited on the 5094-IY8 device. It causes the module to enter a fault state with the Module LED flashing red. Upon un-inhibiting, the module returns a connection fault Code 160010, and the module cannot...

CVE-2025-9042 Rockwell Automation FLEX 5000 I/O - Module Fault

A security issue exists due to improper handling of CIP Class 32’s request when a module is inhibited on the 5094-IY8 device. It causes the module to enter a fault state with the Module LED flashing red. Upon un-inhibiting, the module returns a connection fault Code 160010, and the module cannot...

CVE-2025-9041 Rockwell Automation FLEX 5000 I/O - Module Fault

A security issue exists due to improper handling of CIP Class 32’s request when a module is inhibited on the 5094-IF8 device. It causes the module to enter a fault state with the Module LED flashing red. Upon un-inhibiting, the module returns a connection fault Code 160010, and the module cannot...

Rockwell Automation FLEX 5000 I/O (Update A)

RISK EVALUATION Successful exploitation of these vulnerabilities could create a denial-of-service condition. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize network exposure for all control...

Rockwell Automation FLEX 5000 安全漏洞

Rockwell Automation FLEX 5000 is a high-speed counter module from Rockwell Automation. A resource management error vulnerability exists in the Rockwell Automation FLEX 5000 that stems from incorrect processing of a CIP Class 32 request causing the module to enter a fault state. No details of the...

Rockwell Automation FLEX 5000 安全漏洞

The Rockwell Automation FLEX 5000 is a high-speed counter module from Rockwell Automation. A security vulnerability exists in the Rockwell Automation FLEX 5000 that stems from incorrect handling of a CIP Class 32 request causing the module to enter a fault state...

WordPress Flex Guten Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress plugin Flex Guten, which stems from insufficient input cleanup and escaping, and can be exploited by an attacke...

CVE-2025-6256

The Flex Guten plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘thumbnailHoverEffect’ parameter in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-6256

The Flex Guten plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘thumbnailHoverEffect’ parameter in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-6256 Flex Guten <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via thumbnailHoverEffect Parameter

The Flex Guten plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘thumbnailHoverEffect’ parameter in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-6256

Flex Guten — Multile Blocks (WordPress plugin) versions up to 1.2.5 are affected by Stored Cross-Site Scripting via the thumbnailHoverEffect parameter, caused by insufficient input sanitization and output escaping. Exploitation requires Contributor-level access or higher from authenticated users,...

WordPress plugin Flex Guten 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress plugin Flex Guten, which stems from insufficient input cleanup and escaping, and can be exploited by an attacke...

PT-2025-32031 · WordPress · Flex Guten

Name of the Vulnerable Software and Affected Versions: Flex Guten plugin for WordPress versions up to and including 1.2.5 Description: The Flex Guten plugin for WordPress is susceptible to Stored Cross-Site Scripting via the thumbnailHoverEffect parameter due to insufficient input sanitization an...

WordPress Flex Guten plugin <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via thumbnailHoverEffect Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via thumbnailHoverEffect Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Flex Guten versions = 1.2.5...

CVE-2025-54564

uploadsm in ChargePoint Home Flex 5.5.4.13 does not validate a user-controlled string for bz2 decompression, which allows command execution as the nobody user...

CVE-2025-54564

uploadsm in ChargePoint Home Flex 5.5.4.13 does not validate a user-controlled string for bz2 decompression, which allows command execution as the nobody user...

CVE-2025-54564

uploadsm in ChargePoint Home Flex 5.5.4.13 does not validate a user-controlled string for bz2 decompression, which allows command execution as the nobody user...

CVE-2025-54564

The CVE-2025-54564 entry affects ChargePoint Home Flex 5.5.4.13. It stems from the uploadsm component failing to validate a user-controlled string during bz2 decompression, enabling command execution as the nobody user. According to the initial data, this is a local vulnerability with a CVSS 3.1 ...

ChargePoint Home Flex 安全漏洞

ChargePoint Home Flex is a series of electric vehicle charging devices from ChargePoint USA. A security vulnerability exists in ChargePoint Home Flex version 5.5.4.13, which originates from an unauthenticated user-controlled bz2 decompression string that could lead to command execution...