CVE-2025-9095

A flaw has been found in ExpressGateway express-gateway up to 1.16.10. This issue affects some unknown processing in the library lib/rest/routes/users.js of the component REST Endpoint. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been...

CVE-2025-8723

The Cloudflare Image Resizing plugin for WordPress is vulnerable to Remote Code Execution due to missing authentication and insufficient sanitization within its hookrestpredispatch method in all versions up to, and including, 1.5.6. This makes it possible for unauthenticated attackers to inject...

CVE-2025-8723 Cloudflare Image Resizing <= 1.5.6 - Missing Authentication to Unauthenticated Remote Code Execution via rest_pre_dispatch Hook

The Cloudflare Image Resizing plugin for WordPress is vulnerable to Remote Code Execution due to missing authentication and insufficient sanitization within its hookrestpredispatch method in all versions up to, and including, 1.5.6. This makes it possible for unauthenticated attackers to inject...

CVE-2025-8723 Cloudflare Image Resizing <= 1.5.6 - Missing Authentication to Unauthenticated Remote Code Execution via rest_pre_dispatch Hook

The Cloudflare Image Resizing plugin for WordPress is vulnerable to Remote Code Execution due to missing authentication and insufficient sanitization within its hookrestpredispatch method in all versions up to, and including, 1.5.6. This makes it possible for unauthenticated attackers to inject...

CVE-2025-8723

CVE-2025-8723 affects the Cloudflare Image Resizing plugin for WordPress. The vulnerability arises from missing authentication and insufficient sanitization in the hook_rest_pre_dispatch() method, affecting all versions up to and including 1.5.6. This enables unauthenticated attackers to inject a...

Linux Distros Unpatched Vulnerability : CVE-2020-13675

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access...

M-Files 25.6.14925.0 Path Traversal

This repository contains a proof-of-concept exploit in C for a suspected path traversal vulnerability in M‑Files version 25.6.14925.0. It attempts to read sensitive files e.g. /etc/passwd by injecting traversal payloads into REST API endpoints...

GHSA-Q4RG-7CJJ-5R86 ExpressGateway Cross-Site Scripting Vulnerability in lib/rest/routes/users.js

A cross-site scripting XSS issue exists in ExpressGateway up to 1.16.10 in the REST endpoint implemented in lib/rest/routes/users.js. User-controlled input is reflected into the HTTP response without proper sanitization, allowing arbitrary JavaScript execution in the browser of a logged-in user w...

GHSA-XFP8-X3J6-H67V ExpressGateway Cross-Site Scripting Vulnerability in lib/rest/routes/apps.js

A cross-site scripting XSS issue exists in ExpressGateway ≤ 1.16.10 in lib/rest/routes/apps.js. User-controlled data returned by the REST endpoint is not sanitized before being rendered by the admin/UI layer, allowing an authenticated, low-privileged actor to store or reflect a payload that...

ExpressGateway Cross-Site Scripting Vulnerability in lib/rest/routes/users.js

A cross-site scripting XSS issue exists in ExpressGateway up to 1.16.10 in the REST endpoint implemented in lib/rest/routes/users.js. User-controlled input is reflected into the HTTP response without proper sanitization, allowing arbitrary JavaScript execution in the browser of a logged-in user w...

ExpressGateway express-gateway 代码注入漏洞

ExpressGateway express-gateway is an interface service of ExpressGateway open source. A code injection vulnerability exists in ExpressGateway express-gateway version 1.16.10 and earlier, which stems from a cross-site scripting flaw in the component REST Endpoint that can be exploited remotely by ...

Linux Distros Unpatched Vulnerability : CVE-2021-23341

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The package prismjs before 1.23.0 are vulnerable to Regular Expression Denial of Service ReDoS via the prism-asciidoc, prism-rest, prism-tap and prism-eiffel...

CVE-2025-9096

ExpressGateway (express-gateway) up to version 1.16.10 is affected by a Cross-Site Scripting (XSS) vulnerability in the REST Endpoint code, specifically lib/rest/routes/apps.js. The issue arises from an unknown function used in that component, enabling a remote attacker to inject and execute scri...

CVE-2025-9095 ExpressGateway express-gateway REST Endpoint users.js cross site scripting

A flaw has been found in ExpressGateway express-gateway up to 1.16.10. This issue affects some unknown processing in the library lib/rest/routes/users.js of the component REST Endpoint. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been...

CVE-2025-9095 ExpressGateway express-gateway REST Endpoint users.js cross site scripting

A flaw has been found in ExpressGateway express-gateway up to 1.16.10. This issue affects some unknown processing in the library lib/rest/routes/users.js of the component REST Endpoint. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been...

CVE-2025-9095

Summary: CVE-2025-9095 affects ExpressGateway up to 1.16.10. The issue resides in the REST Endpoint component, specifically the library file lib/rest/routes/users.js, where user-controlled input can cause cross-site scripting. The vulnerability can be triggered remotely and has publicly disclosed...

CVE-2025-7641

The Assistant for NextGEN Gallery plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation in the /wp-json/nextgenassistant/v1.0.0/control REST endpoint in all versions up to, and including, 1.0.9. This makes it possible for unauthenticated...

CVE-2025-52716

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Acato WP REST Cache wp-rest-cache allows PHP Local File Inclusion.This issue affects WP REST Cache: from n/a through = 2025.1.0...

CVE-2025-7441 StoryChief <= 1.0.42 - Unauthenticated Arbitrary File Upload

The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42. This vulnerability occurs through the /wp-json/storychief/webhook REST-API endpoint that does not have sufficient filetype validation. This makes it possible for unauthenticat...

CVE-2025-7641

The Assistant for NextGEN Gallery plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation in the /wp-json/nextgenassistant/v1.0.0/control REST endpoint in all versions up to, and including, 1.0.9. This makes it possible for unauthenticated...