CVE-2024-44002

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PickPlugins Team Showcase team allows Reflected XSS.This issue affects Team Showcase: from n/a through = 1.22.25...

CVE-2024-35664

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpvividplugins WPvivid Backup for MainWP wpvivid-backup-mainwp allows Reflected XSS.This issue affects WPvivid Backup for MainWP: from n/a through = 0.9.32...

GHSA-2CCP-VQMV-4R4X S3Proxy allows insecure path traversal in filesystem and filesystem-nio2 storage backends

Impact Users of the filesystem and filesystem-nio2 storage backends could unintentionally expose local files to authenticated clients. Patches Upgrade to S3Proxy 2.6.0 which includes apache/jclouds@b0819e0ef5e08c792a4d1724b938714ce9503aa3 and 86b6ee4749aa163a78e7898efc063617ed171980. Workarounds...

MAL-2025-775 Malicious code in @orange-team/map-rank-tracker-frontend (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2025-22720 WordPress WpRently | WordPress plugin plugin <= 2.2.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in MagePeople Team Booking and Rental Manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Booking and Rental Manager: from n/a through 2.2.1...

CVE-2025-22720 WordPress WpRently | WordPress plugin plugin <= 2.2.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through = 2.2.1...

CVE-2025-22720

CVE-2025-22720 corresponds to a Missing Authorization vulnerability in MagePeople Team Booking and Rental Manager (WordPress plugin) affecting versions up to 2.2.1. The issue stems from incorrectly configured access control, enabling bypass of authorization. CVSS v3.1 base score is 5.8 (Scope: Ch...

PT-2025-5399 · Oneteamsoftware · Radio Buttons/Swatches For Woocommerce

Name of the Vulnerable Software and Affected Versions: OneTeamSoftware Radio Buttons and Swatches for WooCommerce versions 1.1.20 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflecte...

PT-2025-4647 · Magepeople · Team Booking/Rental Manager

Name of the Vulnerable Software and Affected Versions: MagePeople Team Booking and Rental Manager versions 2.2.1 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations:...

CVE-2024-12320

The Team Rosters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in all versions up to, and including, 4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...

CVE-2024-12320

CVE-2024-12320 refers to a Reflected Cross-Site Scripting vulnerability in the WordPress plugin Team Rosters (versions up to 4.7). The issue arises from insufficient input sanitization and output escaping in the tab parameter, enabling unauthenticated attackers to inject web scripts into pages th...

CVE-2024-12320 Team Rosters <= 4.7 - Reflected Cross-Site Scripting via 'tab'

The Team Rosters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in all versions up to, and including, 4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...

CVE-2024-12320: Improper Neutralization of Input During Web Page Generation

The Team Rosters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in all versions up to, and including, 4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...

PT-2025-1813 · WordPress · Team Rosters

Name of the Vulnerable Software and Affected Versions: Team Rosters plugin for WordPress versions up to, and including, 4.7 Description: The issue is related to Reflected Cross-Site Scripting via the tab parameter due to insufficient input sanitization and output escaping. This allows...

WordPress plugin Team Rosters 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-24671: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Pdfcrowd Dev Team Save as PDF save-as-pdf-by-pdfcrowd allows Object Injection.This issue affects Save as PDF: from n/a through = 4.4.0...

CVE-2025-24739

Cross-Site Request Forgery CSRF vulnerability in Shahjahan Jewel FluentSMTP fluent-smtp allows Cross Site Request Forgery.This issue affects FluentSMTP: from n/a through = 2.2.80...

CVE-2025-24739

CVE-2025-24739 corresponds to a Cross-Site Request Forgery (CSRF) vulnerability in the FluentSMTP WordPress plugin. Affected versions are FluentSMTP

CVE-2025-22608

Coolify (before 4.0.0-beta.361) suffers from missing authorization that lets any authenticated user revoke arbitrary team invitations by providing a predictable, incrementing ID, enabling Denial of Service. A patch is available in 4.0.0-beta.361. The issue’s description across multiple sources co...

CVE-2025-22608 Coolify Vulnerable to Revocation of Arbitrary Team Invitations (DOS)

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to revoke any team invitations on a Coolify instance by only providing a predictable and incrementing ID,...