PT-2025-13862 · Drupal · Drupal Ai

Name of the Vulnerable Software and Affected Versions: Drupal AI Artificial Intelligence versions 0.0.0 through 1.0.4 Description: The issue is related to an OS Command Injection vulnerability due to improper neutralization of special elements used in an OS command. This allows for OS Command...

PT-2025-13866 · Unknown · Rapidoc Oas Field Formatter

Name of the Vulnerable Software and Affected Versions: RapiDoc OAS Field Formatter versions 0.0.0 through 1.0.0 Description: The issue affects the RapiDoc OAS Field Formatter, allowing Cross-Site Scripting XSS due to improper neutralization of input during web page generation. Recommendations: Fo...

CVE-2025-31443

Cross-Site Request Forgery CSRF vulnerability in Krzysztof Furtak KK I Like It kk-i-like-it allows Stored XSS.This issue affects KK I Like It: from n/a through = 1.7.5.3...

BELL-CVE-2025-21891

Bulletin has no description...

BELL-CVE-2023-53015

Bulletin has no description...

BELL-CVE-2023-53019

Bulletin has no description...

BELL-CVE-2023-53032

Bulletin has no description...

BELL-CVE-2023-53031

Bulletin has no description...

BELL-CVE-2023-52998

Bulletin has no description...

BELL-CVE-2023-52997

Bulletin has no description...

BELL-CVE-2023-52929

Bulletin has no description...

BELL-CVE-2023-52975

Bulletin has no description...

CVE-2025-1736 Stream HTTP wrapper header check might omit basic auth header

In PHP from 8.1. before 8.1.32, from 8.2. before 8.2.28, from 8.3. before 8.3.19, from 8.4. before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent or lead to certain headers be misinterpreted...

BIT-GITLAB-2024-9773 Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab

An issue was discovered in GitLab EE affecting all versions starting from 14.9 before 17.8.6, all versions starting from 17.9 before 17.8.3, all versions starting from 17.10 before 17.10.1. An input validation issue in the Harbor registry integration could have allowed a maintainer to add malicio...

BIT-GITLAB-2025-0811 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Improper rendering of certain file types leads to cross-site scripting...

CVE-2025-2803

CVE-2025-2803 concerns the WordPress plugin “So-Called Air Quotes”. The description states unauthenticated attackers can trigger arbitrary shortcode execution in all versions up to 0.1 by exploiting a lack of proper validation before running do_shortcode, enabling shortcode execution without cred...

BELL-CVE-2023-53033

Bulletin has no description...

GHSA-24CF-848G-762C ShopXO Vulnerable to Server-Side Request Forgery (SSRF) and Cross-Site Scripting (XSS)

shopxo v6.4.0 has a ssrf/xss vulnerability in multiple places...

depath and cool-path vulnerable to Prototype Pollution via `set()` Method

janryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set method at setIn lib/index.js:90. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties...

GHSA-799Q-F2PX-WX8C Duplicate Advisory: @alizeait/unflatto Prototype Pollution via `exports.unflatto` Method

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q8jq-4rm5-4hm5. This link is maintained to preserve external references. Original Description alizeait unflatto = 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at...