com.alibaba.rsocket:alibaba-broker-server (>=1.0.0.m1, <=1.0.0), com.beirtipol:jfixtools-reporting (1.0-beta) +158 more potentially affected by CVE-2025-9467 via com.vaadin:vaadin-upload-flow (>=2.0.0, <=14.13.0)

com.vaadin:vaadin-upload-flow MAVEN version =2.0.0, =1.0.0.m1, =3.7.0, =2.9.3, =1.3.0, =1.0, =0.0.1, =14.0.0, =1.0.0, =0.3.1, =1.0.0, =1.0.0, =1.0.5.4 and more Source cves: CVE-2025-9467 Source advisory: SNYK:JAVA-COMVAADIN-12496926...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload via Vaadin Upload's start listener in the multi-upload mode. An attacker can upload unauthorized files by bypassing server-side metadata validation. Remediation Upgrade com.vaadin:vaadin-upload-flow to version...

ch.artaios:openchemlib-vaadin (>=1.0.0, <=2.4.1), ch.jubnl:vsecureflow (>=0.0.15, <=0.0.16) +185 more potentially affected by CVE-2025-9467 via com.vaadin:vaadin-upload-flow (>=24.0.0, <=24.7.6)

com.vaadin:vaadin-upload-flow MAVEN version =24.0.0, =1.0.0, =0.0.15, =1.1.5, =1.0.0, =24.3.0-alpha1, =24.4.0-beta1, =2.0.0-alpha1, =24.4.0-beta1, =24.4.0-beta1, =2.0.0-alpha1, =24.7.1 and more Source cves: CVE-2025-9467 Source advisory: SNYK:JAVA-COMVAADIN-12496926...

com.alibaba.rsocket:alibaba-broker-server (>=1.1.3, <=1.1.4), com.github.mcollovati.vertx:vertx-vaadin-flow (>=23.1.0, <=23.4.1) +130 more potentially affected by CVE-2025-9467 via com.vaadin:vaadin-upload-flow (>=23.0.0, <=23.6.1)

com.vaadin:vaadin-upload-flow MAVEN version =23.0.0, =1.1.3, =23.1.0, =1.0.0-alpha1, =1.0.0-alpha1, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.1 and more Source cves: CVE-2025-9467 Source advisory:...

CVE-2025-9467

When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 7.0.0 -...

com.alibaba.rsocket:alibaba-broker-server (>=1.0.0.m1, <=1.0.0), com.beirtipol:jfixtools-reporting (1.0-beta) +158 more potentially affected by CVE-2025-9467 via com.vaadin:vaadin-upload-flow (>=2.0.0, <=14.13.0)

com.vaadin:vaadin-upload-flow MAVEN version =2.0.0, =1.0.0.m1, =3.7.0, =2.9.3, =1.3.0, =1.0, =0.0.1, =14.0.0, =1.0.0, =0.3.1, =1.0.0, =1.0.0, =1.0.5.4 and more Source cves: CVE-2025-9467 Source advisory: MEND:CVE-2025-9467...

ch.artaios:openchemlib-vaadin (>=1.0.0, <=2.4.1), ch.jubnl:vsecureflow (>=0.0.15, <=0.0.16) +185 more potentially affected by CVE-2025-9467 via com.vaadin:vaadin-upload-flow (>=24.0.0, <=24.7.6)

com.vaadin:vaadin-upload-flow MAVEN version =24.0.0, =1.0.0, =0.0.15, =1.1.5, =1.0.0, =24.3.0-alpha1, =24.4.0-beta1, =2.0.0-alpha1, =24.4.0-beta1, =24.4.0-beta1, =2.0.0-alpha1, =24.7.1 and more Source cves: CVE-2025-9467 Source advisory: MEND:CVE-2025-9467...

com.alibaba.rsocket:alibaba-broker-server (>=1.1.3, <=1.1.4), com.github.mcollovati.vertx:vertx-vaadin-flow (>=23.1.0, <=23.4.1) +130 more potentially affected by CVE-2025-9467 via com.vaadin:vaadin-upload-flow (>=23.0.0, <=23.6.1)

com.vaadin:vaadin-upload-flow MAVEN version =23.0.0, =1.1.3, =23.1.0, =1.0.0-alpha1, =1.0.0-alpha1, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.1 and more Source cves: CVE-2025-9467 Source advisory:...

A heap-buffer-overflow vulnerability has been identified in ntopng 6.2 in the Flow::dissectMDNS function.

...

CVE-2025-9636: Origin Validation Error

pgAdmin = 9.7 is affected by a Cross-Origin Opener Policy COOP vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation...

CVE-2025-9467: Improper Input Validation

When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 7.0.0 -...

CVE-2025-58625

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Spiffy Plugins WP Flow Plus wp-imageflow2 allows Stored XSS.This issue affects WP Flow Plus: from n/a through = 5.2.5...

CVE-2025-58625 WordPress WP Flow Plus Plugin <= 5.2.5 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Spiffy Plugins WP Flow Plus wp-imageflow2 allows Stored XSS.This issue affects WP Flow Plus: from n/a through = 5.2.5...

CVE-2025-58625 WordPress WP Flow Plus Plugin <= 5.2.5 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Spiffy Plugins WP Flow Plus wp-imageflow2 allows Stored XSS.This issue affects WP Flow Plus: from n/a through = 5.2.5...

CVE-2025-58625

CVE-2025-58625 – WP Flow Plus stored XSS A cross-site scripting vulnerability exists in the WordPress plugin WP Flow Plus (Spiffy Plugins) affecting versions up to 5.2.5. The flaw stems from improper input neutralization during web page generation, enabling stored XSS. The CVSS v3.1 base score is...

PT-2025-35758

Name of the Vulnerable Software and Affected Versions: WP Flow Plus versions through 5.2.5 Description: The software contains an Improper Neutralization of Input During Web Page Generation issue, which allows for Stored Cross-site Scripting XSS. Recommendations: Update WP Flow Plus to a version...

WordPress plugin WP Flow Plus has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

Possibility to bypass file upload validation on the server-side

When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. See CWE-20 Improper Input Validation Description When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is...

CVE-2025-58625: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Spiffy Plugins WP Flow Plus wp-imageflow2 allows Stored XSS.This issue affects WP Flow Plus: from n/a through = 5.2.5...

Linux Distros Unpatched Vulnerability : CVE-2020-13292

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In GitLab before 13.0.12, 13.1.6 and 13.2.3, it is possible to bypass E-mail verification which is required for OAuth Flow. CVE-2020-13292 Note that Nessus reli...