17029 matches found
Cross-Site Scripting (XSS)
starcitizentools/citizen-skin is vulnerable to cross-site scripting XSS. The vulnerability is due to improper sanitization of page descriptions inserted into raw HTML when using the old search bar, which allows an attacker with page editing privileges to inject XSS payloads into the DOM and explo...
PT-2025-27900 · Woocommerce · Printcart Web To Print Product Designer
Name of the Vulnerable Software and Affected Versions: Printcart Web to Print Product Designer for WooCommerce versions prior to 2.4.0 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL...
PT-2025-27869 · Unknown · Chatra Live Chat + Chatbot + Cart Saver
Name of the Vulnerable Software and Affected Versions: Chatra Live Chat + ChatBot + Cart Saver versions 1.0.11 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacke...
PT-2025-27894 · Unknown · Sharable Password Protected Posts
Name of the Vulnerable Software and Affected Versions: Sharable Password Protected Posts version 1.1.1 and earlier Description: The issue allows access to password protected posts by providing a secret key in a GET parameter. However, the key is exposed by the REST API. Recommendations: For...
PT-2025-27874 · Bplugins · Bplugins Video Gallery Block
Name of the Vulnerable Software and Affected Versions: bPlugins Video Gallery Block versions 1.1.0 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored Cross-site Scripting XSS. This enables attackers to inject...
PT-2025-27932 · Unknown · Bearsthemes Alone
Name of the Vulnerable Software and Affected Versions: Bearsthemes Alone versions n/a through 7.8.2 Description: The issue is related to an Improper Control of Generation of Code, also known as 'Code Injection', which allows Remote Code Inclusion. This enables potential attackers to execute...
PT-2025-27899 · Unknown · Otwthemes Content Manager Light
Name of the Vulnerable Software and Affected Versions: OTWthemes Content Manager Light versions n/a through 3.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Reflected XSS. This enables potentia...
PT-2025-27880 · Unknown · Cybio Gallery Widget
Name of the Vulnerable Software and Affected Versions: cybio Gallery Widget versions 1.2.1 and earlier Description: The issue is related to the improper neutralization of special elements used in an SQL command, also known as 'SQL Injection'. This allows for SQL Injection in the cybio Gallery...
PT-2025-27898
Name of the Vulnerable Software and Affected Versions: aonetheme Service Finder Booking versions n/a through 6.0 Description: The issue is related to an Incorrect Privilege Assignment vulnerability in the aonetheme Service Finder Booking, allowing Privilege Escalation. Recommendations: For versio...
PT-2025-27904 · Noaa · Aviation Weather
Name of the Vulnerable Software and Affected Versions: Aviation Weather from NOAA versions 0.7.2 and earlier Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows for Path Traversal in the affected software...
PT-2025-27922 · Dynamiapps · Frontend Admin
Name of the Vulnerable Software and Affected Versions: Frontend Admin by DynamiApps versions n/a through 3.28.7 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows for Path Traversal in the affected...
PT-2025-27929
Name of the Vulnerable Software and Affected Versions: Cozmoslabs Paid Member Subscriptions versions 2.15.1 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection...
CVE-2025-52496
Mbed TLS before 3.6.4 has a race condition in AESNI detection if certain compiler optimizations occur. An attacker may be able to extract an AES key from a multithreaded program, or perform a GCM forgery...
PT-2025-27925 · Unknown · Teconcetheme Allmart
Name of the Vulnerable Software and Affected Versions: TeconceTheme Allmart versions n/a through 1.0.0 Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability, which allows for Server Side Request Forgery. This means an attacker can potentially trick the server into...
PT-2025-27933 · Unknown · Thanhtungtnt Video List Manager
Name of the Vulnerable Software and Affected Versions: thanhtungtnt Video List Manager versions 1.7 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables potential attacke...
Grafana Labs 11.1.0 < 11.2.8+security-01, 11.3.5+security-01, 11.4.3+security-01, 11.5.3+security-01, 11.6.0+security-01 XSS (CVE-2025-2703)
The version of Grafana Labs installed on the remote host is affected by cross-site scripting vulnerability as referenced in the CVE-2025-2703 advisory. - The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in order t...
MAL-2025-5604 Malicious code in n8n-nodes-zalo-tools-vts (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a2329810f2a1823ea41018ebaecc3088d17c44d6b40443b63ba8cf17463f898a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2025-49826 Next.js DoS vulnerability via cache poisoning
Next.js is a React framework for building full-stack web applications. From versions 15.0.4-canary.51 to before 15.1.8, a cache poisoning bug leading to a Denial of Service DoS condition was found in Next.js. This issue does not impact customers hosted on Vercel. Under certain conditions, this...