CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

403 matches found

RedhatCVE•added 2025/12/11 12:3 a.m.•10 views

CVE-2025-63317

Todoist v8896 is vulnerable to Cross Site Scripting XSS in /api/v1/uploads. Uploaded SVG files have no sanitization applied, so embedded JavaScript executes when a user opens the attachment from a task/comment...

5.4CVSS6.1AI score0.00182EPSS

Exploits1References1

NVD•added 2025/12/05 6:16 a.m.•11 views

CVE-2025-12163

The Omnipress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to...

6.4CVSS0.00309EPSS

Exploits2References8

Vulnrichment•added 2025/12/01 12:0 a.m.•2 views

CVE-2025-63317

5.7AI score0.00182EPSS

Exploits1References1

CVE•added 2025/10/27 7:39 a.m.•18 views

CVE-2025-11682

The CVE-2025-11682 issue affects Perx Customer Engagement & Loyalty Platform, specifically the LMT Dashboard, with versions prior to 4.617.4. Root cause: improper sanitization of uploaded SVGs, allowing an authenticated attacker to upload a malicious SVG to a campaign. When other users view the i...

7.1CVSS5.7AI score0.00179EPSS

Exploits0References1

RedhatCVE•added 2025/10/17 2:58 a.m.•8 views

CVE-2025-10700

The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.0. This is due to missing or incorrect nonce validation on the enableunfilteredfilesupload function. This makes it possible for unauthenticated...

4.3CVSS5.4AI score0.0018EPSS

Exploits0References1