WordPress plugin WoodMart 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin Grid Plus 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-62415

Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges e.g. admin to upload a crafted HTML file containing embedded JavaScript. When viewed, the malicious code executes in the context of the...

CVE-2025-62415 bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (HTML)

Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges e.g. admin to upload a crafted HTML file containing embedded JavaScript. When viewed, the malicious code executes in the context of the...

CVE-2025-62418 bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG)

Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges e.g. admin to upload a crafted SVG file containing embedded JavaScript. When viewed, the malicious code executes in the context of the...

EUVD-2025-34796

IBM MQ 9.1, 9.2, 9.3, 9.4 LTS and 9.3, 9.4 CD is vulnerable to a denial of service, caused by improper enforcement of the timeout on individual read operations. By conducting slowloris-type attacks, a remote attacker could exploit this vulnerability to cause a denial of service...

CVE-2025-2138

IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete comments from other users due to client-side enforcement of server-side security...

PT-2025-41630

Name of the Vulnerable Software and Affected Versions Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin versions prior to 2.3.6 Description The Everest Backup plugin for WordPress allows unauthorized access to data due to a missing capability check on the everest proces...

SUSE SLES15 Security Update : kernel (Live Patch 54 for SLE 15 SP3) (SUSE-SU-2025:03528-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03528-1 advisory. This update for the Linux Kernel 5.3.18-15030059195 fixes several issues. The following security issues were fixed: - CVE-2024-53168: sunrpc:...

WordPress WoodMart theme < 8.3.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme WoodMart versions 8.3.2...

PT-2025-41348

Name of the Vulnerable Software and Affected Versions Versions prior to 2.3 Description A memory corruption issue exists when processing an image encoding completion event. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability...

PT-2025-41345

Name of the Vulnerable Software and Affected Versions Versions prior to 2.3 Description A memory corruption issue exists when processing System Configuration Manager SCM calls with improperly formed inputs. This can lead to unpredictable behavior or potential compromise of the system...

EUVD-2025-32906

Malicious code in v0-core npm...

EUVD-2025-32912

Malicious code in v0-components npm...

EUVD-2020-21403

Malware in sbrugna...

PT-2025-41144

Name of the Vulnerable Software and Affected Versions B Industrial Automation Automation Runtime versions prior to 6.4 Description An issue exists in B Industrial Automation Automation Runtime that allows for improper neutralization of input during web page generation, potentially leading to...

Unity Linux 20.1070e Security Update: springframework (UTSA-2025-680594)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-680594 advisory. n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a...

EUVD-2025-32435

A vulnerability has been found in SeriaWei ZKEACMS up to 4.3. This affects the function Delete of the file src/ZKEACMS.Redirection/Controllers/UrlRedirectionController.cs of the component POST Request Handler. The manipulation leads to improper authorization. Remote exploitation of the attack is...

CVE-2025-11272

CVE-2025-11272 affects SeriaWei ZKEACMS up to version 4.3. The issue resides in the Delete function of src/ZKEACMS.Redirection/Controllers/UrlRedirectionController.cs (POST Request Handler) and results in improper authorization with remote exploitation possible. Public exploit details have been d...

ZKEACMS 授权问题漏洞

ZKEACMS is a visually designed, WYSIWYG content management system from ZKEASOFT open source. An authorization issue vulnerability exists in ZKEACMS 4.3 and earlier versions, which stems from improper authorization of the Delete function in the file...