25694 matches found
Emlog Pro cross-site scripting vulnerabilities
Emlog Pro is an Emlog open source blogging system. A cross-site scripting vulnerability exists in Emlog Pro 2.5.21 and earlier versions, which stems from a Twitter feature that does not properly validate input and could lead to a stored cross-site scripting attack...
CVE-2025-60448
A stored Cross-Site Scripting XSS vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists due to insufficient validation of SVG file uploads in the /admin/media.php component, allowing attackers to upload malicious SVG files containing JavaScript code that executes when th...
CVE-2025-60447: Improper Neutralization of Input During Web Page Generation
A stored Cross-Site Scripting XSS vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists in the email template configuration component located at /admin/setting.php?action=mail, which allows administrators to input HTML code that is not properly sanitized, leading to...
Emlog Pro security vulnerabilities
Emlog Pro is a blogging system from Emlog Open Source. A security vulnerability exists in Emlog Pro version 2.5.19, which stems from an email template configuration component that does not properly clean up its HTML code and could lead to a stored cross-site scripting attack...
PT-2025-40525
Name of the Vulnerable Software and Affected Versions Emlog Pro version 2.5.19 Description A stored Cross-Site Scripting XSS issue has been identified. The vulnerability is located in the email template configuration component at the /admin/setting.php?action=mail API endpoint. This allows...
CVE-2025-60448
A stored Cross-Site Scripting (XSS) vulnerability exists in Emlog Pro version 2.5.19 within the /admin/media.php component. The root cause is insufficient validation of SVG file uploads , which allows attackers to upload malicious SVG files containing embedded JavaScript. This script executes aut...
CVE-2025-11195
Rapid7 AppSpider Pro versions below 7.5.021 suffer from a project name validation vulnerability, whereby an attacker can change the project name directly in the configuration file to a name that already exists. This issue stems from a lack of effective verification of the uniqueness of project...
CVE-2025-11195
Rapid7 AppSpider Pro versions below 7.5.021 suffer from a project name validation vulnerability, whereby an attacker can change the project name directly in the configuration file to a name that already exists. This issue stems from a lack of effective verification of the uniqueness of project...
CVE-2025-11195
Rapid7 AppSpider Pro versions below 7.5.021 suffer from a project name validation vulnerability, whereby an attacker can change the project name directly in the configuration file to a name that already exists. This issue stems from a lack of effective verification of the uniqueness of project...
CVE-2025-11195
Rapid7 AppSpider Pro versions below 7.5.021 are affected by a project name validation bypass. The issue arises from insufficient verification of project name uniqueness when editing the configuration file outside the application, allowing an attacker to set a project name to one that already exis...
CVE-2025-11195 Rapid7 AppSpider Project Name Validation Bypass
Rapid7 AppSpider Pro versions below 7.5.021 suffer from a project name validation vulnerability, whereby an attacker can change the project name directly in the configuration file to a name that already exists. This issue stems from a lack of effective verification of the uniqueness of project...
CVE-2024-13150
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Fayton Software and Consulting Services fayton.Pro ERP allows SQL Injection.This issue affects fayton.Pro ERP: through 20250929...
WordPress Ultimate Learning Pro plugin <= 3.9.3 - Arbitrary Content Deletion vulnerability
Arbitrary Content Deletion vulnerability discovered by Bonds in WordPress Plugin Ultimate Learning Pro versions = 3.9.3...
PT-2025-40014
Name of the Vulnerable Software and Affected Versions Rapid7 AppSpider Pro versions prior to 7.5.021 Description Rapid7 AppSpider Pro versions below 7.5.021 have a project name validation issue. An attacker can modify the project name directly in the configuration file to a name that already exis...
Rapid7 AppSpider Pro has a vulnerability related to data falsification.
Rapid7 AppSpider Pro is a dynamic application security testing solution from Rapid7, Inc. that allows you to scan Web and mobile applications for vulnerabilities. A data forgery issue vulnerability exists in Rapid7 AppSpider Pro versions prior to 7.5.021, which stems from insufficient project nam...
CVE-2025-11195: Improper Input Validation
Rapid7 AppSpider Pro versions below 7.5.021 suffer from a project name validation vulnerability, whereby an attacker can change the project name directly in the configuration file to a name that already exists. This issue stems from a lack of effective verification of the uniqueness of project...
Dutch Teens Arrested Over Alleged Spying for Pro-Russian Hackers
Dutch authorities arrest two teens recruited by pro-Russian hackers for spying missions. Learn how Russia is using disposable agents for sabotage across Europe...
CVE-2024-13150
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Fayton Software and Consulting Services fayton.Pro ERP allows SQL Injection. This issue affects fayton.Pro ERP: through 20250929...
CVE-2024-13150
CVE-2024-13150 describes an SQL Injection in Fayton Software and Consulting Services fayton.Pro ERP. The vulnerability arises from improper neutralization of special elements in SQL commands, enabling potential unauthorized access to the full database. Affected product is fayton.Pro ERP (through ...
CVE-2024-13150 SQLi in Fayton Software's fayton.pro ERP
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Fayton Software and Consulting Services fayton.Pro ERP allows SQL Injection. This issue affects fayton.Pro ERP: through 20250929...