The vulnerability of the Sparkle framework on the Oracle Java SE software platform arises from the ability to expose files or directories to external parties. This allows a perpetrator to bypass the signature verification mechanism and gain full control over the application.

The vulnerability of the Sparkle framework on the Oracle Java SE software platform relates to the exposure of files or directories to external parties. Exploiting this vulnerability could allow an attacker to bypass the EdDSA signature verification and gain full control over the application...

CVE-2025-50030

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sparklewpthemes Spark Multipurpose spark-multipurpose allows DOM-Based XSS.This issue affects Spark Multipurpose: from n/a through = 1.0.7...

CVE-2025-50033

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sparklewpthemes Fitness Park fitness-park allows DOM-Based XSS.This issue affects Fitness Park: from n/a through = 1.1.1...

sparklemotion nokogiri hashmap.c hashmap_set_with_hash heap-based overflow

Withdrawn Advisory This advisory has been withdrawn because the affected code was never included in a release. This link has been maintained to preserve external references. Original Description A vulnerability was found in sparklemotion nokogiri c29c920907366cb74af13b4dc2230e9c9e23b833 and...

CVE-2025-6490

CVE-2025-6490 concerns a heap-based buffer overflow in gumbo-parser/src/hashmap.c (function hashmap_set_with_hash) within sparklemotion nokogiri. Reported as a locally exploitable issue; exploitation details have been disclosed, but the real existence of the vulnerability is questioned in the des...

Sparkle Motion Nokogiri 安全漏洞

Sparkle Motion Nokogiri is a Sparkle Motion open source software for processing xml and html files. A security vulnerability exists in Sparkle Motion Nokogiri version 1.18.7 and earlier, which originates from a heap buffer overflow in the function hashmapsetwithhash in the file...

CVE-2025-50030

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sparklewpthemes Spark Multipurpose spark-multipurpose allows DOM-Based XSS.This issue affects Spark Multipurpose: from n/a through = 1.0.7...

CVE-2025-50033

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sparklewpthemes Fitness Park fitness-park allows DOM-Based XSS.This issue affects Fitness Park: from n/a through = 1.1.1...

CVE-2025-50033

CVE-2025-50033 affects the WordPress Fitness Park theme (versions n/a through 1.1.1). It is a DOM-based XSS caused by improper input neutralization during web page generation. Multiple sources (Wordfence, Patchstack, CVE listings) confirm the vulnerability and note that a patch is not available y...

CVE-2025-50030

CVE-2025-50030 corresponds to a DOM-Based XSS in the Spark Multipurpose WordPress theme (Sparkle Themes). Public details confirm improper input neutralization during web page generation, affecting Spark Multipurpose versions up to 1.0.7 (no fixed version listed). Reported CVSS v3.1 vector yields ...

PT-2025-26386 · Unknown · Sparkle Themes Fitness Park

Name of the Vulnerable Software and Affected Versions: Sparkle Themes Fitness Park versions n/a through 1.1.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This means that an attack...

CVE-2024-53774

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jakub Glos Sparkle Elementor Kit sparkle-elementor-kit allows DOM-Based XSS.This issue affects Sparkle Elementor Kit: from n/a through = 2.0.9...

CVE-2023-30476

Missing Authorization vulnerability in Sparkle Themes Blogger Buzz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Blogger Buzz: from n/a through 1.2.2...

CVE-2023-32129

Missing Authorization vulnerability in Sparkle WP Editorialmag editorialmag.This issue affects Editorialmag: from n/a through 1.1.9...

CVE-2023-30480

Missing Authorization vulnerability in Sparkle WP Educenter.This issue affects Educenter: from n/a through 1.5.5...

CVE-2023-28416

Missing Authorization vulnerability in Sparkle Themes Chankhe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chankhe: from n/a through 1.0.5...

CVE-2021-20084

Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution' in jquery-sparkle 1.5.2-beta allows a malicious user to inject properties into Object.prototype...

CVE-2025-32157

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Jakub Glos Sparkle Elementor Kit sparkle-elementor-kit allows PHP Local File Inclusion.This issue affects Sparkle Elementor Kit: from n/a through = 2.0.9...

CVE-2025-32157

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Jakub Glos Sparkle Elementor Kit sparkle-elementor-kit allows PHP Local File Inclusion.This issue affects Sparkle Elementor Kit: from n/a through = 2.0.9...

CVE-2025-32157 WordPress Sparkle Elementor Kit plugin <= 2.0.9 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Jakub Glos Sparkle Elementor Kit allows PHP Local File Inclusion. This issue affects Sparkle Elementor Kit: from n/a through 2.0.9...