8631 matches found
Metasploit Wrap-Up 05/16/2025
New modules for everyone This week’s release is packed with new module content. We have RCE modules for Car Rental System 1.0, Wordpress plugins SureTriggers, User Registration and Membership. We also have a persistence module for LINQPad software and an auxiliary module for POWERCOM UPSMON PRO. ...
CVE-2025-48132 WordPress X Addons for Elementor <= 1.0.14 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in pencilwp X Addons for Elementor allows Stored XSS. This issue affects X Addons for Elementor: from n/a through 1.0.14...
MAL-2025-3891 Malicious code in grew-plugins (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d4ee10df9b214f88ce9a202b5f7cc418a407053cc3ef0518b2751e4dbe7d06c4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in grew-plugins (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d4ee10df9b214f88ce9a202b5f7cc418a407053cc3ef0518b2751e4dbe7d06c4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-3890 Malicious code in flow-plugins (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8cf17ab0e3206656aa1196545f14592f01b8a02353963e6c158dbb80af69dc75 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in flow-plugins (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8cf17ab0e3206656aa1196545f14592f01b8a02353963e6c158dbb80af69dc75 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in beautiful-plugins (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 366a123a150cfa4f12f17cdb337ca0d39a1b8c22e7d861302e8632619e51bf4f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-3874 Malicious code in beautiful-plugins (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 366a123a150cfa4f12f17cdb337ca0d39a1b8c22e7d861302e8632619e51bf4f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2022-32149 affecting package containernetworking-plugins for versions less than 1.6.1-4
CVE-2022-32149 affecting package containernetworking-plugins for versions less than 1.6.1-4. An upgraded version of the package is available that resolves this issue...
CVE-2022-29526 affecting package containernetworking-plugins for versions less than 1.6.1-4
CVE-2022-29526 affecting package containernetworking-plugins for versions less than 1.6.1-4. An upgraded version of the package is available that resolves this issue...
CVE-2021-38561 affecting package containernetworking-plugins for versions less than 1.6.1-4
CVE-2021-38561 affecting package containernetworking-plugins for versions less than 1.6.1-4. An upgraded version of the package is available that resolves this issue...
CVE-2024-9645
The Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry WordPress plugin before 2.2.93 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform...
CVE-2023-2334
The edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector WordPress plugin before 1.6.6 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a...
CVE-2024-6712 MapFig Studio <= 0.2.1 - Stored XSS via CSRF
The MapFig Studio WordPress plugin through 0.2.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...
CVE-2024-10076 Jetpack < 13.8, Boost < 3.4.8 - Contributor+ Stored XSS
The Jetpack WordPress plugin before 13.8, Jetpack Boost WordPress plugin before 3.4.8 use regexes in the Site Accelerator features when switching image URLs to their CDN counterpart. Unfortunately, some of them may match patterns it shouldn’t, ultimately making it possible for contributor and abo...
Important: Red Hat Security Advisory: Red Hat Developer Hub 1.6.0 release.
Red Hat Developer Hub 1.6.0 has been released. Red Hat Developer Hub RHDH is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters AKS, EKS, GKE. The core features of RHDH include a single...
Security update for rabbitmq-server313
This update for rabbitmq-server313 fixes the following issues: CVE-2025-30219: incorrectly escaped virtual hostname present in error message could lead to XSS attack. bsc1240071 Non-security fixes: Require rabbitmq-server313-plugins rather then rabbitmq-server-plugins. bsc1231656, bsc1234763 Patc...
Jenkins plugins Multiple Vulnerabilities (2025-05-14)
According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Critical In WSO2 Oauth Plugin 1.0 and earlier authentication claims are accepted without validation by the WSO2 Oauth security realm. This...