MAL-2025-48546 Malicious code in integration-date (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a2e54fa8253e6821f9fb22a4f137efeb0d32a0b8836faefa95df004781dfce8e The OpenSSF Package Analysis project identified 'integration-date' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands are vulnerable to denial of service [CVE-2025-8885], [CVE-2025-8916]

Summary Bouncycastle bcprov is used by IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands are vulnerable to denial of service. This bulletin provides patch information to address the reported...

CISO’s Checklist: 3 Steps to Beating Alert Fatigue

CISOs fight alert fatigue with real-time visibility, automation, and integration. Learn how ANY.RUN helps teams speed detection, cut false positives, and boost SOC efficiency...

Newforma Project Center Server Information Disclosure Vulnerability (CNVD-2025-25476)

Newforma Project Center Server is a project information management solution for the Architecture, Engineering and Construction AEC industry from Newforma for centralized storage and management of project documents and collaboration. An information disclosure vulnerability exists in Newforma Proje...

CVE-2025-11857

The XX2WP Integration Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mxpfb2wpdisplayembed' shortcode in all versions up to, and including, 1.9.9. This is due to the plugin not properly sanitizing user input and output of the 'postid' parameter. This makes it...

CVE-2025-11857

The XX2WP Integration Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mxpfb2wpdisplayembed' shortcode in all versions up to, and including, 1.9.9. This is due to the plugin not properly sanitizing user input and output of the 'postid' parameter. This makes it...

CVE-2025-11857 XX2WP Integration Tools <= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

The XX2WP Integration Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mxpfb2wpdisplayembed' shortcode in all versions up to, and including, 1.9.9. This is due to the plugin not properly sanitizing user input and output of the 'postid' parameter. This makes it...

CVE-2025-11857

The CVE-2025-11857 entry pertains to the XX2WP Integration Tools WordPress plugin. Affected versions are all up to and including 1.9.9, with a Stored Cross-Site Scripting (Stored XSS) flaw in the mxp_fb2wp_display_embed shortcode caused by improper sanitization of the post_id parameter. This allo...

WordPress PPOM – Product Addons & Custom Fields for WooCommerce plugin <= 33.0.15 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Talal Nasraddeen in WordPress Plugin PPOM for WooCommerce versions = 33.0.15...

CVE-2025-11857: Improper Neutralization of Input During Web Page Generation

The XX2WP Integration Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mxpfb2wpdisplayembed' shortcode in all versions up to, and including, 1.9.9. This is due to the plugin not properly sanitizing user input and output of the 'postid' parameter. This makes it...

PT-2025-42691

Name of the Vulnerable Software and Affected Versions XX2WP Integration Tools versions prior to 1.9.9 Description The XX2WP Integration Tools plugin for WordPress is susceptible to Stored Cross-Site Scripting through the mxp fb2wp display embed shortcode. This occurs because the plugin does not...

WordPress plugin XX2WP Integration Tools: Cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...

org.keycloak:keycloak-dependencies-admin-ui-wrapper (21.0.2), org.keycloak:keycloak-quarkus-integration-tests (21.0.2) +3 more potentially affected by CVE-2025-10044 via org.keycloak:keycloak-admin-ui (21.0.2)

org.keycloak:keycloak-admin-ui MAVEN version 21.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-admin-ui and may be impacted: - org.keycloak:keycloak-dependencies-admin-ui-wrapper 21.0.2 -...

The Foundation Modern AppSec Is Still Missing: Code to Cloud, Rebuilt the Right Way

See every risk, from the first line of code to what’s running in production. No resource tagging. No CI/CD hacks. Just automatic, reliable traceability both developers and security teams can act on...

Hexstrike-redteam

HexStrike AI RED-TEAM AI-Powered MCP Cybersecurity Automat...

VulnCheck KEV: CVE-2023-39143

PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files. This leads to remote code execution when external device integration is enabled a very common configuration...

Towards a Blockchain-Based CI/CD Framework to Enhance Security in Cloud Environments

Security is becoming a pivotal point in cloud platforms. Several divisions, such as business organisations, health care, government, etc., have experienced cyber-attacks on their infrastructures. This research focuses on security issues within Continuous Integration and Deployment CI/CD pipelines...

CVE-2025-62418 bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG)

Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges e.g. admin to upload a crafted SVG file containing embedded JavaScript. When viewed, the malicious code executes in the context of the...

de.fhg.fokus.nubomedia:nubomedia-media-client (>=1.0, <=6.6.0), org.springframework.boot:spring-boot-starter-websocket (1.2.7.release) +1 more potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.1.8.release)

org.springframework:spring-websocket MAVEN version 4.1.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - de.fhg.fokus.nubomedia:nubomedia-media-client =1.0, =4.1.7.release,...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=2.0, <=2.2), com.ahome-it:ahome-tooling-server-core (>=1.1.4-release, <=1.1.9-release) +12 more potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.3.1.release)

org.springframework:spring-websocket MAVEN version 4.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base =2.0, =1.1.4-release, =1.1.4-release,...