PT-2025-34753 · Cmc · Cmc

Name of the Vulnerable Software and Affected Versions: CMC versions prior to 25.1.0 Description: An access control issue was identified in the Request Trace and Download Trace functionalities. Improper access restrictions allow authenticated users with limited privileges to request and download...

CVE-2025-9228

MiR software versions prior to version 3.0.0 have insufficient authorization controls when creating text notes, allowing low-privilege users to create notes which are intended only for administrative users...

CVE-2025-8281

The WP Talroo WordPress plugin through 2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin and unauthenticated users...

CVE-2025-9228

MiR software versions prior to version 3.0.0 have insufficient authorization controls when creating text notes, allowing low-privilege users to create notes which are intended only for administrative users...

CVE-2025-9228 Insufficient authorization when creating notes

MiR software versions prior to version 3.0.0 have insufficient authorization controls when creating text notes, allowing low-privilege users to create notes which are intended only for administrative users...

CVE-2025-9228 Insufficient authorization when creating notes

MiR software versions prior to version 3.0.0 have insufficient authorization controls when creating text notes, allowing low-privilege users to create notes which are intended only for administrative users...

PT-2025-34027 · Mir · Mir

Name of the Vulnerable Software and Affected Versions: MiR software versions prior to 3.0.0 Description: MiR software versions prior to 3.0.0 have insufficient authorization controls when creating text notes, allowing low-privilege users to create notes intended only for administrative users...

CVE-2025-54475

A SQL injection vulnerability in the JS Jobs plugin versions 1.3.2-1.4.4 for Joomla allows low-privilege users to execute arbitrary SQL commands...

CVE-2025-54475

A SQL injection vulnerability in the JS Jobs plugin versions 1.3.2-1.4.4 for Joomla allows low-privilege users to execute arbitrary SQL commands...

PT-2025-33482 · Joomla +1 · Joomla! +1

Name of the Vulnerable Software and Affected Versions: JS Jobs plugin versions 1.3.2 through 1.4.4 Description: A SQL injection vulnerability in the JS Jobs plugin for Joomla allows low-privilege users to execute arbitrary SQL commands. Recommendations: Update the JS Jobs plugin to a version late...

PT-2025-33127

Name of the Vulnerable Software and Affected Versions: WP Shopify WordPress plugin versions prior to 1.5.4 Description: The WP Shopify WordPress plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting issue. This could be...

CVE-2025-52361

CVE-2025-52361 affects AK-Nord USB-Server-LXL Firmware up to v0.0.16 Build 2023-03-13. The root cause is insecure permissions on the /etc/init.d/lighttpd script, which is executed with root privileges during system boot and on any interaction. A locally authenticated low-privilege user can modify...

CVE-2025-7022

The My Reservation System WordPress plugin through 2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2025-7022

The My Reservation System WordPress plugin through 2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2025-7022 My Reservation System <= 2.3 - Reflected XSS

The My Reservation System WordPress plugin through 2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2025-7022

The CVE-2025-7022 entry concerns the WordPress plugin My Reservation System (versions ≤ 2.3). The connected data specifies that the plugin does not sanitize/escape a user-supplied parameter before echoing it back to the page, resulting in a Reflected Cross-Site Scripting (XSS) vulnerability that ...

CVE-2025-6174

The Qwizcards | online quizzes and flashcards WordPress plugin through 3.9.4 does not sanitise and escape the "stylesheet" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or any other user...

CVE-2025-6174

The WordPress Qwizcards plugin (versions up to 3.9.4) is affected by a Reflected XSS due to insufficient sanitisation/escaping of the stylesheet parameter(s) when reflected back in the page. Specifically, the vulnerability is described as affecting the _stylesheet parameter (per CVE description) ...

CVE-2025-6174 WordPress Qwizcards <= 3.9.4 - Reflected XSS

The Qwizcards | online quizzes and flashcards WordPress plugin through 3.9.4 does not sanitise and escape the "stylesheet" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or any other user...

CVE-2025-49484

A SQL injection vulnerability in the JS Jobs plugin versions 1.0.0-1.4.1 for Joomla allows low-privilege users to execute arbitrary SQL commands via the 'cvid' parameter in the employee application feature...