EUVD-2025-20705

Malicious code in bioql PyPI...

EUVD-2025-28519

Malicious code in bioql PyPI...

EUVD-2025-25918

Malicious code in bioql PyPI...

EUVD-2024-0831

Malicious code in bioql PyPI...

EUVD-2025-31237

Malicious code in bioql PyPI...

EUVD-2025-0124

Malicious code in bioql PyPI...

EUVD-2025-3697

Malicious code in bioql PyPI...

EUVD-2024-17039

Malicious code in bioql PyPI...

EUVD-2024-1640

Malicious code in bioql PyPI...

EUVD-2025-24927

Malicious code in bioql PyPI...

EUVD-2024-55007

Malicious code in bioql PyPI...

CVE-2025-9129 Flexi <= 4.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via flexi-form-tag Shortcode

The Flexi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin for WordPress's flexi-form-tag shortcode in all versions up to, and including, 4.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-9884 Mobile Site Redirect <= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Mobile Site Redirect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious w...

CVE-2025-9332 Interactive Medical Drawing of Human Body <= 2.6 - Authenticated (Admin+) Stored Cross-Site Scripting

The Interactive Human Anatomy with Clickable Body Parts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

PT-2025-40605

Name of the Vulnerable Software and Affected Versions KUNO CMS versions prior to 1.3.14 Description KUNO CMS, a full-stack blog application, has flaws in its file upload functionality. The upload process only validates file types based on Content-Type headers and does not analyze file content or...

CVE-2025-40989

CVE-2025-40989 describes a stored cross-site scripting vulnerability in Ekushey CRM v5.0 (Creativeitem) caused by insufficient validation of user input in the POST endpoint dealing with the applicant’s message, specifically the API path that includes the message parameter. The affected component ...

CVE-2025-9512

The Schema & Structured Data for WP & AMP WordPress plugin before 1.50 does not properly handles HTML tag attribute modifications, making it possible for unauthenticated attackers to conduct Stored XSS attacks via post comments...

CVE-2025-10196

The Survey Anyplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'surveyanyplaceembed' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-9075

CVE-2025-9075 is a stored cross-site scripting vulnerability in the WordPress plugin ZoloBlocks (versions up to and including 2.3.10). The issue stems from insufficient input sanitization and output escaping on user-supplied attributes across multiple Gutenberg blocks (Google Maps markers, Lightb...

Issabel 跨站脚本漏洞

Issabel is a unified communications platform from the Issabel organization. A cross-site scripting vulnerability exists in Issabel version 5.0.0 that stems from a lack of validation of user input and could lead to a stored cross-site scripting attack...