CVE-2025-53482

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - IPInfo Extension allows Cross-Site Scripting XSS.This issue affects Mediawiki - IPInfo Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from...

CVE-2025-27326

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bPlugins Video Gallery Block video-gallery-block allows Stored XSS.This issue affects Video Gallery Block: from n/a through = 1.1.0...

CVE-2025-28957

CVE-2025-28957 : Stored XSS in the WordPress plugin OwnerRez (versions up to 1.2.1). Root cause: improper input neutralization during web page generation. Impact as per sources: cross-site scripting with low–moderate confidentiality/integrity/availability impact; CVSSv3.1 base score 6.5. Exploita...

PT-2025-27878 · Unknown · Md Yeasin Ul Haider Url Shortener

Name of the Vulnerable Software and Affected Versions: Md Yeasin Ul Haider URL Shortener versions 3.0.7 and earlier Description: The issue is related to a Server Side Request Forgery SSRF problem, which allows for Server Side Request Forgery. No information is provided about the estimated number ...

CVE-2025-53489 XSS in GoogleDocs4MW

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - GoogleDocs4MW Extension allows Cross-Site Scripting XSS.This issue affects Mediawiki - GoogleDocs4MW Extension: from 1.42.X before 1.42.7, from 1.43.X before...

PT-2025-27658 · Unknown · Secret Server

Name of the Vulnerable Software and Affected Versions: Secret Server versions 11.7.49 and earlier Description: The distributed engine of Secret Server can be exploited during an initial authorization event, allowing an attacker to impersonate another distributed engine. Recommendations: For Secre...

BIT-VAULT-2025-4656 Vault Vulnerable to Recovery Key Cancellation Denial of Service

Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability CVE-2025-4656 has been remediated in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11, 1.17.17...

PT-2025-27493 · Unknown · Tiny-Secp256K1

Name of the Vulnerable Software and Affected Versions: tiny-secp256k1 versions prior to 1.1.7 Description: A malicious JSON-stringifyable message can be made to bypass the Buffer.isBuffer check, resulting in strange objects being accepted as a message. This can trick the verify function into...

CVE-2025-53331

Cross-Site Request Forgery CSRF vulnerability in samcharrington RSS Digest rss-digest allows Stored XSS.This issue affects RSS Digest: from n/a through = 1.5...

CVE-2025-52834

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in favethemes Homey homey allows SQL Injection.This issue affects Homey: from n/a through = 2.4.7...

PT-2025-28298 · Totolink · Totolink N200Re

Name of the Vulnerable Software and Affected Versions: TOTOLINK N200RE versions 9.3.5u.6095 B20200916 through 9.3.5u.6139 B20201216 Description: A critical issue has been found, affecting the function sub 41A0F8 of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument Hostname leads to ...

CVE-2025-48921

Cross-Site Request Forgery CSRF vulnerability in Drupal Open Social allows Cross Site Request Forgery.This issue affects Open Social: from 0.0.0 before 12.3.14, from 12.4.0 before 12.4.13...

CVE-2025-53258

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Wow-Company Hover Effects hover-effects allows SQL Injection.This issue affects Hover Effects: from n/a through = 2.1.2...

CVE-2025-28988

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in aharonyan WP Front User Submit / Front Editor front-editor allows Reflected XSS.This issue affects WP Front User Submit / Front Editor: from n/a through = 4.9.3...

PT-2025-27193 · Unknown · Plationline Payments

Name of the Vulnerable Software and Affected Versions: PlatiOnline Payments versions through 6.3.2 Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For versions through 6.3.2...

PT-2025-27124 · Unknown · Infility Global

Name of the Vulnerable Software and Affected Versions: Infility Global versions through 2.12.7 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. Recommendations: For versions through 2.12.7...

PT-2025-27178 · Woocommerce · Additional Order Filters For Woocommerce

Name of the Vulnerable Software and Affected Versions: Additional Order Filters for WooCommerce versions 1.22 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on...

CVE-2025-48921

Cross-Site Request Forgery CSRF vulnerability in Drupal Open Social allows Cross Site Request Forgery.This issue affects Open Social: from 0.0.0 before 12.3.14, from 12.4.0 before 12.4.13...

CVE-2025-48921

CVE-2025-48921 concerns a Cross-Site Request Forgery (CSRF) vulnerability in the Drupal Open Social distribution. Affected versions are Open Social 0.0.0–12.3.13 and 12.4.0–12.4.12. The root cause is inadequate CSRF protection on certain routes, which could allow an attacker to trick authenticate...

PT-2025-26974

Name of the Vulnerable Software and Affected Versions: MongoDB Server versions prior to 6.0.21 MongoDB Server versions prior to 7.0.17 MongoDB Server versions prior to 8.0.5 Description: The issue is related to the JSON parsing mechanism in MongoDB Server, where specifically crafted JSON inputs c...