EUVD-2022-52314

Malicious code in bioql PyPI...

CVE-2025-9204

The X Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Youtube Video ID field in all versions up to, and including, 1.0.16. This is due to insufficient input sanitization and output escaping on the Youtube Video ID parameter. This makes it possible fo...

CVE-2025-10311

The Comment Info Detector plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.5. This is due to missing nonce validation on the options.php file when handling form submissions. This makes it possible for unauthenticated attackers to modify...

CVE-2025-9697 Ajax WooSearch <= 1.0.0 - Unauthenticated SQL Injection

The Ajax WooSearch WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2025-39692 affecting package kernel for versions less than 6.6.104.2-1

CVE-2025-39692 affecting package kernel for versions less than 6.6.104.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-10196

The Survey Anyplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'surveyanyplaceembed' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-56514

Cross Site Scripting XSS vulnerability in Fiora chat application 1.0.0 allows executes arbitrary JavaScript when malicious SVG files are rendered by other users...

PT-2025-40248

Name of the Vulnerable Software and Affected Versions Fiora chat application version 1.0.0 Description A Cross Site Scripting XSS issue exists in the Fiora chat application. The application allows the execution of arbitrary JavaScript code when malicious SVG files are rendered by other users...

PT-2025-39935

Name of the Vulnerable Software and Affected Versions BP Direct Menus plugin for WordPress versions prior to 1.0.1 Description The BP Direct Menus plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'bpdm login' shortcode. Insufficient input sanitization and output...

IBM Planning Analytics Local 安全漏洞

IBM Planning Analytics Local is a web-based local architecture from International Business Machines IBM. A security vulnerability exists in IBM Planning Analytics Local versions 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13, which stems from improper input validation and could result in...

CVE-2025-11101

A security flaw has been discovered in itsourcecode Open Source Job Portal 1.0. This impacts an unknown function of the file /jobportal/admin/company/index.php?view=edit. Performing manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has bee...

CVE-2025-11079

A security flaw has been discovered in Campcodes Farm Management System 1.0. Affected by this issue is some unknown functionality. The manipulation results in file and directory information exposure. The attack may be performed from remote. The exploit has been released to the public and may be...

CVE-2025-9944

CVE-2025-9944 affects the Professional Contact Form plugin for WordPress (all versions up to 1.0.0). Root cause: missing/invalid nonce validation in the watch_for_contact_form_submit function, enabling CSRF. Impact: unauthenticated attackers can trigger test emails by tricking an admin into perfo...

PT-2025-39717

Name of the Vulnerable Software and Affected Versions Trust Reviews plugin for WordPress versions prior to 1.0 Description The software is susceptible to Cross-Site Request Forgery CSRF. This is due to missing or incorrect nonce validation in the feed save function. An unauthenticated attacker ca...

school-management-system SQL注入漏洞

school-management-system is a PHP school management system for schools or small organizations developed by Shubham kumar, an individual developer. A SQL injection vulnerability exists in school-management-system version 1.0, which stems from incorrect manipulation of the parameter select in the...

Sourcecodester Employee Management System 安全漏洞

SourceCodester Employee Management System is a SourceCodester open source php-based system for employee performance management. A security vulnerability exists in Sourcecodester Employee Management System version 1.0, which originates from a cross-site scripting vulnerability in the Add Designati...

CVE-2025-10799

A security flaw has been discovered in code-projects Hostel Management System 1.0. The affected element is an unknown function of the file /justines/admin/modreservation/index.php?view=view. Performing manipulation of the argument ID results in sql injection. Remote exploitation of the attack is...

CVE-2025-10796

A vulnerability was found in code-projects Hostel Management System 1.0. This vulnerability affects unknown code of the file /justines/admin/login.php. The manipulation of the argument email results in sql injection. The attack can be launched remotely. The exploit has been made public and could ...

Dotnetnuke < 10.1.0 Stored XSS Using Backend Admin Credentials (CVE-2025-59546)

According to its self-reported version, the instance of Dotnetnuke running on the remote web server is prior to 10.1.0. It is, therefore, affected by a vulnerability. - DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Prior to version 10.1....

CVE-2025-4993

Untrusted Pointer Dereference vulnerability in RTI Connext Professional Core Libraries allows Pointer Manipulation.This issue affects Connext Professional: from 7.4.0 before 7.6.0, from 7.0.0 before 7.3.0.10, from 6.1.0 before 6.1.2.27, from 6.0.0 before 6.0., from 5.3.0 before 5.3., from 4.4a...