CVE-2025-26908

CVE-2025-26908 (Kargo Entegratör – WooCommerce Kargo Entegrasyon Eklentisi) authenticates as Shop Manager+ and suffers SQL Injection due to improper neutralization. Affected versions: up to 1.1.14. Red Hat entry confirms the vulnerability and notes a patch has been applied; Wordfence WordPress pl...

WordPress plugin Kargo Entegratör SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A SQL injection...

WordPress Kargo Entegratör plugin <= 1.1.14 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Le Ngoc Anh Patchstack Alliance in WordPress Plugin Kargo Entegratör versions = 1.1.14...

GHSA-265R-HFXG-FHMG vulnerabilities

Vulnerabilities for packages: fuse-overlayfs-snapshotter, skaffold, grype, dagger, docker-cli-buildx, cilium-cli, nerdctl, spegel, neuvector-scanner, kubescape, chartmuseum, opa-envoy, k3s, trivy, kots, helm-push, docker, envoy-gateway, rancher, xeol, kaniko, datadog-agent, zarf,...

CVE-2025-27144 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, dagger, goreleaser, gatus, nerdctl, grafana-mimir, kubescape, traefik, flyte, grafana-alloy, pulumi, tflint, cert-manager-istio-csr, octo-sts, melange, dex, gomplate, ksops, harbor-registry, hydra, rabbitmq-messaging-topology-operator, buildah,...

GHSA-C6GW-W398-HV78 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, dagger, goreleaser, gatus, nerdctl, grafana-mimir, kubescape, traefik, flyte, grafana-alloy, pulumi, tflint, cert-manager-istio-csr, octo-sts, melange, dex, gomplate, ksops, harbor-registry, hydra, rabbitmq-messaging-topology-operator, buildah,...

CVE-2024-29018 vulnerabilities

Vulnerabilities for packages: grype, kubescape, conftest, up, buf, aactl, buildkitd, melange, ko, spire-server-fips, datadog-agent, ctop, trivy, cadvisor, cadvisor-fips, zot, docker-compose, wolfictl, crossplane, dagger, kaniko, tkn, syft, cilium-cli, datadog-agent-fips, spire-server,...

GHSA-MQ39-4GV4-MVPX vulnerabilities

Vulnerabilities for packages: grype, kubescape, conftest, up, buf, aactl, buildkitd, melange, ko, spire-server-fips, datadog-agent, ctop, trivy, cadvisor, cadvisor-fips, zot, docker-compose, wolfictl, crossplane, dagger, kaniko, tkn, syft, cilium-cli, datadog-agent-fips, spire-server,...

CVE-2024-28180 vulnerabilities

Vulnerabilities for packages: bank-vaults, kubernetes-dashboard, cloudflared, skaffold, oauth2-proxy, fulcio, step-ca, rook, goreleaser, nerdctl, vexctl, flux-kustomize-controller, kubescape, policy-controller, timestamp-authority, sops, grpc-health-probe, temporal-ui-server, dgraph, apko, ko,...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Biteship Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo allows Reflected XSS.This issue affects Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo: from n/a through 2.2.24...

GHSA-XW73-RW38-6VJC vulnerabilities

Vulnerabilities for packages: kubescape, falcoctl-fips, up, chartmuseum, aactl, argo-workflows-fips, buildkitd, scorecard, kubeflow-katib, kpt, gitsign, newrelic-infrastructure-agent, zarf, flux-image-reflector-controller, helm-operator, skopeo, datadog-agent, cert-manager, tekton-chains,...

CVE-2024-24557 vulnerabilities

Vulnerabilities for packages: kubescape, falcoctl-fips, up, chartmuseum, aactl, argo-workflows-fips, buildkitd, scorecard, kubeflow-katib, kpt, gitsign, newrelic-infrastructure-agent, zarf, flux-image-reflector-controller, helm-operator, skopeo, datadog-agent, cert-manager, tekton-chains,...

CVE-2023-6278

CVE-2023-6278 affects the Biteship for WooCommerce WordPress plugin prior to 2.2.25. The issue is a reflected XSS caused by unsanitized and unescaped biteship_error and biteship_message parameters, displayed back on the page and exploitable against high-privilege admins. Remediation: upgrade to v...

CVE-2023-49767

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Biteship Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo allows Stored XSS.This issue affects Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo: from n/a through 2.2.24...

CVE-2023-49767

CVE-2023-49767 affects WordPress plugin Biteship (Ongkos Kirim Kurir Instant, Reguler, Kargo). A Stored XSS vulnerability exists in versions up to 2.2.24 (patched in 2.2.28). Exploitation requires authenticated access by Shop Manager or higher, enabling stored script execution via plugin settings...

Unfixed XSS vulnerability at www.mngkargo.com.tr

Security researcher TurKPoweR, has submitted on 19/07/2008 a cross-site-scripting XSS vulnerability affecting www.mngkargo.com.tr, which at the time of submission ranked 118609 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 10/11/2008. It is...