PT-2025-12614

Name of the Vulnerable Software and Affected Versions Jahertor WP Featured Entries versions n/a through 1.0 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2025-12586

Name of the Vulnerable Software and Affected Versions gopiplus Message ticker versions n/a through 9.3 Description The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can inject maliciou...

CVE-2025-30570: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in AliRezaMohammadi دکمه، شبکه اجتماعی خرید dokme allows SQL Injection.This issue affects دکمه، شبکه اجتماعی خرید: from n/a through = 2.0.6...

CVE-2025-30553: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Z.com byGMO GMO Font Agent gmo-font-agent allows Stored XSS.This issue affects GMO Font Agent: from n/a through = 1.6...

CVE-2025-30536: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in zeitwesentech Beautiful Link Preview beautiful-link-preview allows Stored XSS.This issue affects Beautiful Link Preview: from n/a through = 1.5.0...

CVE-2025-30610: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in catchsquare WP Social Widget wp-social-widget allows Stored XSS.This issue affects WP Social Widget: from n/a through = 2.2.7...

CVE-2025-30597: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in iografica IG Shortcodes ig-shortcodes allows DOM-Based XSS.This issue affects IG Shortcodes: from n/a through = 3.1...

PT-2025-12645

Name of the Vulnerable Software and Affected Versions Easy Page Transition versions n/a through 1.0.1 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can injec...

CVE-2025-2610 MagnusBilling Stored Cross-Site Scripting in Alarm Module

Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling Alarm Module modules allows authenticated stored cross-site scripting. This vulnerability is associated with program files protected/components/MagnusLog.Php. This issue affects MagnusBilling...

CVE-2019-16151

An improper neutralization of input during web page generation vulnerability CWE-79 in FortiOS 6.4.1 and below, 6.2.9 and below may allow a remote unauthenticated attacker to either redirect users to malicious websites via a crafted "Host" header or to execute JavaScript code in the victim's...

PT-2025-12457

Name of the Vulnerable Software and Affected Versions MagnusBilling versions through 7.3.0 Description The issue is related to improper neutralization of input during web page generation in MagnusSolution MagnusBilling login logging, allowing unauthenticated users to store HTML content. This can...

CVE-2025-25035: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation Cross-site Scripting vulnerability in Jalios JPlatform 10 allows for Reflected XSS and Stored XSS.This issue affects JPlatform 10: before 10.0.8 SP8, before 10.0.7 SP7, before 10.0.6 SP6 and Jalios Workplace 6.2, Jalios Workplace 6.1,...

CVE-2025-27888

Affected software and issue: Apache Druid with the management proxy enabled is vulnerable to SSRF, XSS, and Open Redirect via specially crafted URLs. Root cause / vulnerability details: When a request is proxied through the Druid management proxy, a crafted URL can redirect to an arbitrary server...

Improper Output Neutralization for Logs

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Improper Output Neutralization for Logs due to the incomplete masking of API keys in the logging functionality. An attacker can expose sensitive information by accessing th...

CVE-2024-9606 Improper Output Neutralization for Logs in berriai/litellm

In berriai/litellm before version 1.44.12, the litellm/litellmcoreutils/litellmlogging.py file contains a vulnerability where the API key masking code only masks the first 5 characters of the key. This results in the leakage of almost the entire API key in the logs, exposing a significant amount ...

postgresql: PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation

A flaw was found in PostgreSQL. Due to improper neutralization of quoting syntax, affected versions potentially allow a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the application to use the affected function's result to constru...

CVE-2024-9606: Improper Output Neutralization for Logs

In berriai/litellm before version 1.44.12, the litellm/litellmcoreutils/litellmlogging.py file contains a vulnerability where the API key masking code only masks the first 5 characters of the key. This results in the leakage of almost the entire API key in the logs, exposing a significant amount ...

CVE-2024-12016: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in CM Informatics CM News allows SQL Injection. This issue affects CM News: through 6.0. NOTE: The vendor was contacted and it was learned that the product is not supported...

PT-2025-54401

Name of the Vulnerable Software and Affected Versions Omar Mohamed Mohamoud LIVE TV versions through 1.2 Description The software contains a flaw related to improper input handling during web page generation, specifically a Reflected Cross-site Scripting issue. This allows for the execution of...

CVE-2024-8997

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Vestel EVC04 Configuration Interface allows SQL Injection. This issue affects EVC04 Configuration Interface: before V3.187, V4.53...