CVE-2025-7761

CVE-2025-7761 – Reflected XSS in Lepszy BIP : The vulnerability arises from improper input validation in the index.php form parameter, allowing arbitrary JavaScript to execute in a victim’s browser when a specially crafted URL is opened. Affected: Lepszy BIP (potentially all versions). Root cause...

CVE-2025-7761 Reflected XSS in Lepszy BIP

Lepszy BIP is vulnerable to Reflected Cross-Site Scripting XSS. Improper input validation in index.php form in one of the parameters allows arbitrary JavaScript to be executed on victim's browser when specially crafted URL is opened. The vendor was contacted early about this disclosure but did no...

SUSE CVE-2025-54801

Fiber is an Express inspired web framework written in Go. In versions 2.52.8 and below, when using Fiber's Ctx.BodyParser to parse form data containing a large numeric key that represents a slice index e.g., test.18446744073704, the application crashes due to an out-of-bounds slice allocation in...

PT-2025-33245

Name of the Vulnerable Software and Affected Versions: epiphyt Form Block versions n/a through 1.5.5 Description: An unrestricted file upload issue exists in epiphyt Form Block, allowing the upload of a web shell to a web server. This enables malicious actors to potentially gain control of the...

PT-2025-33293 · Unknown · Hospital Management System +1

Name of the Vulnerable Software and Affected Versions: code-projects Hostel Management System version 1.0 Description: A vulnerability exists in an unknown functionality of the hostel manage.exe file within the Login Form component. Manipulation of the uname argument results in a stack-based buff...

WordPress plugin Integration for Contact Form 7 and Constant Contact 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

WordPress plugin Form Block 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...

PT-2025-33230 · Unknown · Easy Form Builder

Name of the Vulnerable Software and Affected Versions: Easy Form Builder versions through 3.8.15 Description: The software contains an improper neutralization of special elements used in an SQL command, resulting in a blind SQL injection issue. Recommendations: Update Easy Form Builder to a versi...

PT-2025-33236 · WordPress · Crm Perks Integration For Contact Form 7/Constant Contact

Name of the Vulnerable Software and Affected Versions: CRM Perks Integration for Contact Form 7 and Constant Contact versions through 1.1.7 Description: The CRM Perks Integration for Contact Form 7 and Constant Contact is susceptible to a stored cross-site scripting XSS issue due to improper...

WordPress plugin Easy Form Builder SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

PT-2025-33164 · WordPress · Alvind Billplz Addon For Contact Form 7

Name of the Vulnerable Software and Affected Versions: Alvind Billplz Addon for Contact Form 7 versions through 1.2.0 Description: The software contains an Improper Neutralization of Input During Web Page Generation issue, leading to Reflected Cross-site Scripting XSS. This allows for the executi...

WordPress plugin Billplz Addon for Contact Form 7 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. The WordPress Billplz Addon for Contact Form 7 plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escapin...

WordPress Billplz Addon for Contact Form 7 Plugin <= 1.2.0 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Peter Thaleikis in WordPress Plugin Billplz Addon for Contact Form 7 versions = 1.2.0...

CVE-2025-7384

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.3 via deserialization of untrusted input in the getleaddetail function. This makes it possible for unauthenticated attackers to inject a P...

CVE-2025-7384

CVE-2025-7384 affects the WordPress plugins Database for Contact Form 7, WPforms, and Elementor forms (up to version 1.4.3). The root cause is PHP Object Injection via deserialization of untrusted input in the get_lead_detail function, enabling unauthenticated attackers to inject PHP objects. The...

PT-2025-33019 · Totolink · Totolink Ex1200T

Name of the Vulnerable Software and Affected Versions: TOTOLINK EX1200T firmware version 4.1.2cu.5215 Description: An attacker can bypass login by sending a specific request through the formLoginAuth.htm endpoint. Recommendations: Apply a firmware update that addresses this login bypass issue. As...

WordPress plugin Database for Contact Form 7, WPforms, Elementor forms 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in...

CVE-2025-51452

In TOTOLINK A7000R firmware 9.1.0u.6115B20201022, an attacker can bypass login by sending a specific request through formLoginAuth.htm...

TOTOLINK EX1200T 安全漏洞

The TOTOLINK EX1200T is a Wi-Fi range extender from China's Gion Electronics TOTOLINK. The TOTOLINK EX1200T suffers from an authentication bypass vulnerability that originates from formLoginAuth.htm not properly validating the login request, which can be exploited by an attacker to gain system...

The vulnerability of the algDisable() function in the mod_form.so script of Linksys routers such as RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the algDisable function in the modform.so script of Linksys routers such as RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 lies in the fact that the operation’s output escapes the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrar...