WordPress plugin Block for Font Awesome Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress...

WordPress plugin Heateor Social Login Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

PT-2024-26705 · Unknown · Woody Ad Snippets

Name of the Vulnerable Software and Affected Versions: Woody ad snippets versions n/a through 2.4.10 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. No information is...

WordPress plugin Colibri Page Builder security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

VulnCheck KEV: CVE-2024-35693

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list.This issue affects 12 Step Meeting List: from n/a through = 3.14.33...

VulnCheck KEV: CVE-2024-35679

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in StellarWP GiveWP give.This issue affects GiveWP: from n/a through = 3.12.0...

PT-2025-7446 · Hitachi Vantara · Pentaho Data Integration & Analytics

Name of the Vulnerable Software and Affected Versions: Hitachi Vantara Pentaho Data Integration & Analytics versions prior to 10.2.0.0 and 9.3.0.9, including 8.3.x Description: The product receives input from an upstream component but does not restrict or incorrectly restricts the input before it...

CVE-2024-35649

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Pdfcrowd Save as PDF plugin by Pdfcrowd allows Stored XSS.This issue affects Save as PDF plugin by Pdfcrowd: from n/a through 3.2.3...

datatables.net: contents of array not escaped by HTML escape entities function

An improper neutralization of input vulnerability was found in datatables.net. If an array is passed to the HTML escape entities function, it does not have its contents escaped, possibly leading to cross site scripting XSS...

Cross-site Scripting (XSS)

ansibleguy-webui is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper handling of user input in multiple forms, allowing injection of HTML elements which are then executed by the browser after job actions...

USN-6803-1 ffmpeg vulnerabilities

Zeng Yunxiang and Song Jiaxuan discovered that FFmpeg incorrectly handled certain input files. An attacker could possibly use this issue to cause FFmpeg to crash, resulting in a denial of service, or potential arbitrary code execution. This issue only affected Ubuntu 24.04 LTS. CVE-2023-49501 Zen...

CVE-2024-4330

A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to improper handling of user-supplied input in the 'listpersonalities' endpoint. By crafting a malicious HTTP request, an attacker can traverse the...

CVE-2024-4330 Path Traversal in parisneo/lollms-webui

A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to improper handling of user-supplied input in the 'listpersonalities' endpoint. By crafting a malicious HTTP request, an attacker can traverse the...

CVE-2024-4330 Path Traversal in parisneo/lollms-webui

A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to improper handling of user-supplied input in the 'listpersonalities' endpoint. By crafting a malicious HTTP request, an attacker can traverse the...

Text Generation Inference 安全漏洞

Text Generation Inference is a Rust, Python and gRPC server for text generation inference. A security vulnerability exists in Text Generation Inference version 2.0.0 and earlier, which stems from insecure handling of user input and a code injection vulnerability that could be exploited by an...

AnythingLLM 安全漏洞

AnythingLLM is a document chatbot that meets business requirements. A security vulnerability exists in AnythingLLM that stems from vulnerability to improper neutralization in the use of special elements in expression language statements, allowing all existing attributes of a database entity to be...

OESA-2024-1655 python-idna security update

A library to support the Internationalised Domain Names in Applications IDNA protocol as specified in RFC 5891 http://tools.ietf.org/html/rfc5891. This version of the protocol is often referred to as “IDNA2008” and can produce different results from the earlier standard from 2003. Security Fixes:...

CVE-2024-5165

In Eclipse Ditto versions 3.0.0 to 3.5.5, the user input of several input fields of the Eclipse Ditto Explorer User Interface https://eclipse.dev/ditto/user-interface.html was not properly neutralized and thus vulnerable to both Reflected and Stored XSS Cross Site Scripting. Several inputs were n...

PT-2024-18331 · WordPress · Spectra

Name of the Vulnerable Software and Affected Versions: Spectra – WordPress Gutenberg Blocks plugin versions up to, and including, 2.12.8 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's Image Gallery block, allowing...

Eclipse Ditto 安全漏洞

Eclipse Ditto is an open source framework from the Eclipse Foundation for creating and managing digital twins in the Internet of Things. A security vulnerability exists in Eclipse Ditto versions 3.0.0 through 3.5.5, which stems from user input not being properly neutralized in multiple input fiel...