CVE-2024-56903

Geovision GV-ASWeb with the version 6.1.1.0 or less allows attackers to modify POST request method with the GET against critical functionalities, such as account management. This vulnerability is used in chain with CVE-2024-56901 for a successful CSRF attack...

PT-2025-5927 · Reverbnation · Reverbnation Widgets

Name of the Vulnerable Software and Affected Versions: ReverbNation Widgets versions n/a through 2.1 Description: The issue is related to improper neutralization of input during web page generation, which leads to a Cross-site Scripting XSS vulnerability, specifically Stored XSS. This allows for...

CVE-2022-24872

Shopware is an open commerce platform based on Symfony Framework and Vue. Permissions set to sales channel context by admin-api are still usable within normal user session. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3, corresponding security...

CVE-2024-34351

Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery SSRF vulnerability was identified in Next.js Server Actions. If the Host header is modified, and the below conditions are also met, an attacker may be able to make requests that...

CVE-2024-6983

mudler/localai version 2.17.1 is vulnerable to remote code execution. The vulnerability arises because the localai backend receives inputs not only from the configuration file but also from other inputs, allowing an attacker to upload a binary file and execute malicious code. This can lead to the...

CVE-2024-31106

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Yooslider Yoo Slider allows Reflected XSS.This issue affects Yoo Slider: from n/a through 2.1.1...

WordPress WP Email Newsletter plugin <= 1.1 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Hassan Khan Yusufzai - Splint3r7 in WordPress Plugin WP Email Newsletter versions = 1.1...

CVE-2025-22691 WordPress WP Travel plugin <= 10.1.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WP Travel WP Travel allows SQL Injection. This issue affects WP Travel: from n/a through 10.1.0...

CVE-2025-22693

CVE-2025-22693 concerns the WordPress Contest Gallery plugin (versions

PT-2025-4620 · Unknown · Hesabfa Accounting

Name of the Vulnerable Software and Affected Versions: Hesabfa Accounting versions prior to 2.1.2 Description: The issue is related to improper neutralization of input during web page generation, which allows reflected Cross-site Scripting XSS. This means an attacker can inject malicious scripts...

PT-2025-4637 · WordPress · Wordpress Signature

Name of the Vulnerable Software and Affected Versions: WordPress Signature versions 0.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Cross Site Request Forgery. This means an attacker can trick a user into performing unintended actions on a web...

WordPress Music Sheet Viewer plugin <= 4.1 - Arbitrary File Read vulnerability

Arbitrary File Read vulnerability discovered by Abdi Pranata in WordPress Plugin Music Sheet Viewer versions = 4.1...

WordPress SW Plus Plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin SW Plus versions = 2.1...

PT-2025-4759 · O2Oa · O2Oa

Name of the Vulnerable Software and Affected Versions: O2OA version 9.1.3 Description: The issue is related to Cross Site Scripting XSS in the Meetings - Settings section. This allows for potential malicious script execution. Recommendations: For O2OA version 9.1.3, update to a version that...

WordPress Music Sheet Viewer plugin <= 4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Music Sheet Viewer versions = 4.1...

CVE-2025-0741

An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to write messages into other users chat by changing the parameter "chatid" of the POST request "/embedai/chats/sendmessage"...

EmbedAI 安全漏洞

EmbedAI is a platform from EmbedAI that enables users to use their data to create AI chatbots powered by ChatGPT. A security vulnerability exists in EmbedAI version 2.1 and prior versions that stems from improper access control...

PT-2025-4029 · Embedai · Embedai

Name of the Vulnerable Software and Affected Versions: EmbedAI versions 2.1 and below Description: An Improper Access Control issue allows an authenticated attacker to obtain chat messages belonging to other users by modifying the CHAT ID parameter in the endpoint "/embedai/chats/load messages?ch...

PT-2025-4034 · Embedai · Embedai

Name of the Vulnerable Software and Affected Versions: EmbedAI versions 2.1 and earlier Description: An issue with inadequate access control has been identified, allowing an authenticated attacker to obtain database backups by requesting the "/embedai/app/uploads/database/" endpoint. This endpoin...

CVE-2025-0353 Divi Torque Lite <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

The Divi Torque Lite – Best Divi Addon, Extensions, Modules & Social Modules plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. Th...