2481 matches found
CVE-2025-10138
CVE-2025-10138 affects the WordPress plugin This-or-That (versions up to and including 1.0.4). It enables stored XSS via the plugin’s thisorthat shortcode due to insufficient input sanitization and output escaping of user-supplied attributes. Impact: authenticated attackers with contributor-level...
EUVD-2025-35348
The This-or-That plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'thisorthat' shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
WordPress plugin This-or-That 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...
CVE-2025-10138: Improper Neutralization of Input During Web Page Generation
The This-or-That plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'thisorthat' shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
WordPress This-or-That plugin <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin This-or-That versions = 1.0.4...
CVE-2025-53069: Allocation of Resources Without Limits or Throttling
Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Components Services. Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to...
CVE-2025-61756: Missing Authentication for Critical Function
Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications component: System Configuration. Supported versions that are affected are 8.0.7.9, 8.0.8.7 and 8.1.2.5. Easily exploitable vulnerability allows unauthenticated...
CVE-2025-62666: Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling vulnerability in The Wikimedia Foundation Mediawiki - CirrusSearch Extension allows HTTP DoS.This issue affects Mediawiki - CirrusSearch Extension: from master before 1.43...
CVE-2025-41430: Allocation of Resources Without Limits or Throttling
When BIG-IP SSL Orchestrator is enabled, undisclosed traffic can cause the Traffic Management Microkernel TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...
CVE-2025-59483: External Control of File Name or Path
A validation vulnerability exists in an undisclosed URL in the Configuration utility. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...
CVE-2025-11832: Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling vulnerability in Azure Access Technology BLU-IC2, Azure Access Technology BLU-IC4 allows Flooding.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5...
CVE-2025-59292: External Control of File Name or Path
External control of file name or path in Confidential Azure Container Instances allows an authorized attacker to elevate privileges locally...
CVE-2025-11713: Improper Encoding or Escaping of Output
Insufficient escaping in the “Copy as cURL” feature could have been used to trick a user into executing unexpected code on Windows. This did not affect the application when running on other operating systems. This vulnerability was fixed in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and...
CVE-2025-59185: External Control of File Name or Path
External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network...
CVE-2025-11449
ServiceNow has addressed a reflected cross-site scripting vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could result in arbitrary code being executed within the browsers of ServiceNow users who click on a specially crafted link. ServiceNow has addressed this...
CVE-2025-61912: Improper Encoding or Escaping of Output
python-ldap is a lightweight directory access protocol LDAP client API for Python. In versions prior to 3.4.5, ldap.dn.escapednchars escapes \x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to...
Linux Distros Unpatched Vulnerability : CVE-2025-59728
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When calculating the content path in handling of MPEG-DASH manifests, there's an out-of-bounds NUL-byte write one byte past the end of the buffer.When we call...
EUVD-2003-0298
Malware in sbrugna...