CVE-2025-8097 WoodMart - Multipurpose WooCommerce Theme <= 8.2.6 - Improper Input Validation Leading to Unauthenticated Cart Manipulation

The WoodMart theme for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 8.2.6. This is due to insufficient validation of the qty parameter in the woodmartupdatecartitem function. This makes it possible for unauthenticated attackers to manipulate cart...

CVE-2025-8097

CVE-2025-8097 affects WoodMart, a WordPress theme, with versions up to 8.2.6. Wordfence/NVD describe an Improper Input Validation in woodmart_update_cart_item, enabling unauthenticated users to manipulate cart quantities using fractional values and potentially drive totals to $0.00, effectively b...

CVE-2025-8097 WoodMart - Multipurpose WooCommerce Theme <= 8.2.6 - Improper Input Validation Leading to Unauthenticated Cart Manipulation

The WoodMart theme for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 8.2.6. This is due to insufficient validation of the qty parameter in the woodmartupdatecartitem function. This makes it possible for unauthenticated attackers to manipulate cart...

CVE-2025-5254

CVE-2025-5254 describes a Stored XSS flaw in Kron Technologies’ Kron PAM (pre-3.7) caused by improper neutralization of input during web page generation. Affected: Kron PAM versions before 3.7. Impact: potential execution of malicious scripts in a user’s browser when data is stored and later rend...

Cisco Unified Intelligence Center Server-Side Request Forgery Vulnerability

Cisco Unified Intelligence Center is the United States Cisco Cisco company's set of Web-based reporting platform. The platform provides reports related to business data and call center data presentation capabilities. A server-side request forgery vulnerability exists in Cisco Unified Intelligence...

Improper Input Validation

org.apache.jena, jena is vulnerable to Improper Input Validation. The vulnerability is due to lack of validation on file access paths in configuration files uploaded by administrators, which allows an attacker to upload arbitrary configurations and potentially manipulate system behavior...

Improper Input Validation

@haxtheweb/haxcms-nodejs is vulnerable to improper input validation. The vulnerability is due to the application not properly handling exceptions when required URL parameters are missing in authenticated API requests, which allows an attacker to crash the application via the listFiles and saveFil...

Security Bulletin: Vulnerability in com.google.protobuf_protobuf-java affects IBM Db2 Data Management Console (CVE-2024-7254)

Summary com.google.protobufprotobuf-java dependency package is used by IBM Db2 Data Management Console . This bulletin describes the upgrades necessary to address the vulnerability. Vulnerability Details CVEID:CVE-2024-7254 DESCRIPTION: Any project that parses untrusted Protocol Buffers data...

Security Bulletin: Netty SslHandler Vulnerability Leads to Native Crash via Crafted Packet

Summary Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which...

Cross-Site Scripting (XSS)

Liferay Portal Frontend Taglib module is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper sanitization of user-supplied input in the keywords parameter of the management toolbar search, which allows an attacker to inject arbitrary web scripts or HTML...

Real-time Bus Tracking System vulnerable to improper validation of specified quantity in input

Overview Real-time Bus Tracking System provided by SYNCK GRAPHICA contains the following vulnerability. Improper validation of specified quantity in input CWE-1284 - CVE-2025-43881 n3ddih reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early...

WordPress JetBlocks For Elementor Cross-Site Scripting Vulnerability

WordPress JetBlocks For Elementor is an enhancement plugin designed specifically for Elementor to extend the functionality of your WordPress website. WordPress JetBlocks For Elementor suffers from a cross-site scripting vulnerability that stems from improper input neutralization, which can be...

IBM Operations Analytics-Log Analysis 安全漏洞

IBM Operations Analytics-Log Analysis is a suite of semi-structured data analysis solutions from International Business Machines IBM. The product is primarily used for application log analysis and problem diagnosis, among other things. A security vulnerability exists in IBM Operations Analytics-L...

WordPress SMTP for Amazon SES SQL Injection Vulnerability

WordPress SMTP for Amazon SES is a plugin or configuration solution for sending emails via Amazon Simple Email Service in WordPress sites. WordPress SMTP for Amazon SES suffers from a SQL injection vulnerability that stems from improper input neutralization, and no detailed vulnerability details...

WordPress Responsive Addons for Elementor Cross-Site Scripting Vulnerability

WordPress Responsive Addons for Elementor is a free plugin that provides 80+ Elementor widgets and 150+ templates with support for 250+ pre-built page modules. WordPress Responsive Addons for Elementor suffers from a cross-site scripting vulnerability that stems from improper input neutralization...

CVE-2025-4284

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Rolantis Information Technologies Agentis allows Reflected XSS, DOM-Based XSS. This issue affects Agentis: before 4.32...

Rolantis Agentis 跨站脚本漏洞

Rolantis Agentis is a software for enterprise information management and automated processing from the Turkish company Rolantis. A cross-site scripting vulnerability exists in Rolantis Agentis versions prior to 4.32, which stems from improper input neutralization during web page generation and...

CVE-2025-41681 Persistent Cross-Site Scripting via POST Requests Due to Improper Neutralization of Input

A high privileged remote attacker can gain persistent XSS via POST requests due to improper neutralization of special elements used to create dynamic content...

CVE-2025-41675 Remote Command Injection via GET in Cloud Server Communication Script Due to Improper Input Neutralization

A high privileged remote attacker can execute arbitrary system commands via GET requests in the cloud server communication script due to improper neutralization of special elements used in an OS command...

CVE-2025-41674

The CVE-2025-41674 entry matches an OS command injection in MB CONNECT LINE mbNET.mini (industrial router) and Helmholz REX100/mbNET.mini family where improper neutralization of special elements in OS commands enables remote execution of commands via POST to a diagnostic action. Connected sources...