11427 matches found
Drupal One Time Password security vulnerability
Drupal One Time Password is a module plugin in the Drupal content management system for the Drupal community. A security vulnerability exists in Drupal One Time Password versions prior to 1.3.0 that stems from bypassing authentication using an alternate path or channel, which could lead to...
Inedo ProGet security vulnerabilities
Inedo ProGet is a package management system from Inedo. A security vulnerability exists in Inedo ProGet versions prior to 2.17.5, which stems from improper input cleanup in the comments section and could lead to an elevated privilege user executing a stored cross-site scripting attack...
WordPress Order Delivery Date Pro for WooCommerce plugin < 12.4.0 - Reflected XSS vulnerability
Reflected XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin Order Delivery Date for WP e-Commerce versions 12.4.0...
Microsoft Edge (Chromium-Based) Multiple Vulnerabilities (May 2025)
Microsoft Edge Chromium-Based is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Gardener security vulnerabilities
Gardener is an open source Kubernetes cluster management tool from Gardener Open Source. The product supports managing, monitoring and updating Kubernetes clusters. A security vulnerability exists in Gardener versions prior to 1.116.4, prior to 1.117.5, prior to 1.118.2, and prior to 1.119.0, whi...
PT-2026-33029
Name of the Vulnerable Software and Affected Versions BC-JAVA versions 1.74 through 1.83 Description Improper neutralization of special elements used in an LDAP query, known as LDAP injection, exists in the BC-JAVA bcprov modules. This issue is associated with the program files LDAPStoreHelper...
BeamClean: Language Aware Embedding Reconstruction
In this work, we consider an inversion attack on the obfuscated input embeddings sent to a language model on a server, where the adversary has no access to the language model or the obfuscation mechanism and sees only the obfuscated embeddings along with the model's embedding table. We propose...
CVE-2025-48136
CVE-2025-48136 affects Estatik Mortgage Calculator (WordPress plugin) <= 2.0.12. The issue is an authenticated Local File Inclusion due to improper filename handling in PHP include/require, enabling PHP Local File Inclusion. Patch status in connected docs indicates no patch applied for Estatik...
WordPress plugin Wishlist security vulnerabilities
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
WordPress plugin "Posts per Cat" cross-site scripting vulnerabilities
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...
WordPress plugin UltraAddons Elementor Lite has a cross-site scripting vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
CVE-2024-12770 WP ULike < 4.7.6 - Admin+ Stored XSS
The WP ULike WordPress plugin before 4.7.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
WordPress plugin Polls has a security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
WordPress plugin PVN Auth Popup has a security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
WordPress plugin HD Quiz security vulnerabilities
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
PT-2025-21455 · WordPress · Hd Quiz
Name of the Vulnerable Software and Affected Versions: HD Quiz WordPress plugin version prior to 2.0.0 Description: The issue concerns the HD Quiz WordPress plugin, where versions prior to 2.0.0 do not properly sanitise and escape some of its settings. This could allow high privilege users, such ...
PT-2025-21459 · WordPress · Vikbooking Hotel Booking Engine & Pms
Name of the Vulnerable Software and Affected Versions: VikBooking Hotel Booking Engine & PMS WordPress plugin versions prior to 1.7.2 Description: The issue concerns the VikBooking Hotel Booking Engine & PMS WordPress plugin, where certain settings are not properly sanitized and escaped. This cou...
emlog code issue vulnerabilities
emlog is emlog open source a set of PHP and MySQL based CMS site building system . A code issue vulnerability exists in versions prior to emlog 2.5.10, which stems from store.php not properly validating the contents of the ZIP plugin file, which could lead to the execution of arbitrary code...
CVE-2025-47703 COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-049
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting XSS.This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.14...