CVE-2025-3662: Improper Neutralization of Input During Web Page Generation

The FancyBox for WordPress plugin before 3.3.6 does not escape captions and titles attributes before using them to populate galleries' caption fields. The issue was received as a Contributor+ Stored XSS, however one of our researcher Marc Montpas escalated it to an Unauthenticated Stored XSS...

thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links

No description is available for this CVE...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the manipulation of the title parameter in the URL /admin.php?m=config&n=edit&o=core&p=title. An attacker can inject malicious scripts from the admin interface by crafting a malicious title value. Note:...

PT-2025-23531 · Unknown · Cotonti Siena

Name of the Vulnerable Software and Affected Versions: Cotonti Siena version 0.9.25 Description: A vulnerability has been found in Cotonti Siena. The issue affects the file "/admin.php?m=config&n=edit&o=core&p=title". The manipulation of the value of title leads to cross-site scripting...

Cotonti Siena 跨站脚本漏洞

Cotonti Siena is a powerful open source web development framework and content manager from Cotonti Open Source. A security vulnerability exists in Cotonti Siena version v0.9.25, which stems from cross-site scripting due to incorrect manipulation of the parameter title in the file /admin.php...

CVE-2025-44115: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in Cotonti Siena v0.9.25. Affected by this vulnerability is the file /admin.php?m=config&n=edit&o=core&p=title. The manipulation of the value of title leads to cross-site scripting...

WordPress plugin Borderless – Elementor Addons and Templates 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress...

CVE-2025-5290: Improper Neutralization of Input During Web Page Generation

The Borderless – Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links

No description is available for this CVE...

thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links

No description is available for this CVE...

thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links

No description is available for this CVE...

thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links

No description is available for this CVE...

thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links

No description is available for this CVE...

ColorGo: Directed Concolic Execution

Whitepaper called ColorGo: Directed Concolic Execution...

CVE-2025-5181

A vulnerability, which was classified as problematic, was found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1. This affects an unknown part of the file /spgpm/updateListing. The manipulation of the argument spgLsTitle leads to cross site scripting. It is possible to initia...

CVE-2025-5135

A vulnerability, which was classified as problematic, has been found in Tmall Demo up to 20250505. Affected by this issue is some unknown functionality of the file /tmall/admin/ of the component Product Details Page. The manipulation of the argument Product Name/Product Title leads to cross site...

CVE-2025-5135

CVE-2025-5135 affects Tmall Demo up to 20250505. The vulnerability is an XSS in the Product Details Page, triggered by manipulating the Product Name/Product Title in the file path /tmall/admin/. The issue concerns some unknown functionality of that admin path and is exploitable remotely; the expl...

Tmall_demo 代码注入漏洞

Tmalldemo is a Spring Boot based mini Tmall by the projectteam. Tmalldemo 20250505 and previous versions of the code injection vulnerability, the vulnerability stems from the file /tmall/admin/ in the parameter Product Name/Product Title of the wrong operation leads to cross-site scripting...

CVE-2025-5135: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, has been found in Tmall Demo up to 20250505. Affected by this issue is some unknown functionality of the file /tmall/admin/ of the component Product Details Page. The manipulation of the argument Product Name/Product Title leads to cross site...

CVE-2025-22561

Missing Authorization vulnerability in kbowson Title Experiments Free wp-experiments-free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Title Experiments Free: from n/a through = 9.0.4...