17029 matches found
PT-2025-17834 · Unknown · Haris Zulfiqar Tooltip
Name of the Vulnerable Software and Affected Versions: Haris Zulfiqar Tooltip versions 1.0.1 and earlier Description: The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows DOM-Based XSS. This enables potential...
PT-2025-17759 · Unknown · Habibur Rahman Razib Control Listings
Name of the Vulnerable Software and Affected Versions: Habibur Rahman Razib Control Listings versions 1.0.4.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This means an...
PT-2025-17707 · WordPress · The Reales Wp
Name of the Vulnerable Software and Affected Versions: The Reales WP - Real Estate WordPress Theme versions up to, and including, 2.1.2 Description: The issue allows unauthorized modification and loss of data due to a missing capability check on the reales delete file, reales delete file plans,...
PT-2025-17715 · Unknown · Wpmastertoolkit
Name of the Vulnerable Software and Affected Versions: WPMasterToolKit WPMTK versions up to, and including, 2.5.2 Description: The issue allows authenticated attackers with Administrator-level access and above to read and modify the contents of arbitrary files on the server, potentially containin...
WordPress Buddypress Force Password Change plugin <= 0.1 - Authenticated (Subscriber+) Account Takeover via Password Update vulnerability
Authenticated Subscriber+ Account Takeover via Password Update vulnerability discovered by kr0d in WordPress Plugin Buddypress Force Password Change versions = 0.1...
MAL-2025-3373 Malicious code in @sporta-technology/rn-components.text-input (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-3366 Malicious code in @sporta-technology/d11-web-components.toggle (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-3361 Malicious code in @sporta-technology/d11-web-components.tags.tags-status (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-3359 Malicious code in @sporta-technology/d11-web-components.tags.tags (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-3343 Malicious code in @sporta-technology/d11-web-components.radio (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-3342 Malicious code in @sporta-technology/d11-web-components.progress-line (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-3340 Malicious code in @sporta-technology/d11-web-components.popout (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-3339 Malicious code in @sporta-technology/d11-web-components.pagination (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-3301 Malicious code in @medibank-lib/medi-analytics (npm)
--- -= Per source details. Do not edit below this line.=-...
Stack Based Buffer Overflow
org.jsonschema2pojo, jsonschema2pojo-core is vulnerable to Stack-based buffer overflow. The vulnerability is due to improper input validation in the apply function of the SchemaRule.java file, allows attackers to exploit the function, leading to a stack-based buffer overflow...
PT-2025-17656 · Drupal · Drupal Colorbox
Name of the Vulnerable Software and Affected Versions: Drupal Colorbox versions 0.0.0 through 2.1.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows an attacker to perform Cross-Site Scripting XSS...
PT-2025-17599 · Axis · Axis Camera Station Pro
Name of the Vulnerable Software and Affected Versions: AXIS Camera Station Pro affected versions not specified Description: A non-admin user can remove system files, causing a boot loop, by redirecting a file deletion when recording video. Recommendations: At the moment, there is no information...
Q4 Investor Relations Platform 安全漏洞
Q4 Investor Relations Platform is an investor relations platform from Q4 Canada. A security vulnerability exists in Q4 Investor Relations Platform version v5.147.1.2, which stems from an unfiltered input to the SearchTerm parameter in the search function, and could lead to a cross-site scripting...
PT-2025-17706 · Gitlab · Gitlab Ce/Ee
Name of the Vulnerable Software and Affected Versions: GitLab EE/CE versions 16.6 through 17.9.7 GitLab EE/CE versions 17.10 through 17.10.5 GitLab EE/CE versions 17.11 through 17.11.1 Description: An issue has been discovered in GitLab EE/CE that could allow an attacker to track users' browsing...
