5846 matches found
Deserialization
prestashop/prestashop is vulnerable to Deserialization. The vulnerability is due to improper handling of crafted POST requests in the /themes/import component, which allows an attacker to execute arbitrary code...
CVE-2025-54680
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sparklewpthemes Blogger Buzz blogger-buzz allows Stored XSS.This issue affects Blogger Buzz: from n/a through = 1.2.6...
CVE-2025-24766
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in wproyal News Magazine X news-magazine-x allows PHP Local File Inclusion.This issue affects News Magazine X: from n/a through = 1.2.37...
Malicious code in stationery-themes (npm)
The package stationery-themes was found to contain malicious code...
MAL-2025-33958 Malicious code in stationery-themes (npm)
The package stationery-themes was found to contain malicious code...
MAL-2025-9780 Malicious code in @zalastax/nolb-_arco-themes_ (npm)
The package @zalastax/nolb-arco-themes was found to contain malicious code...
MAL-2025-9782 Malicious code in @zalastax/nolb-_arco-themes_v (npm)
The package @zalastax/nolb-arco-themesv was found to contain malicious code...
MAL-2025-9781 Malicious code in @zalastax/nolb-_arco-themes_r (npm)
The package @zalastax/nolb-arco-themesr was found to contain malicious code...
CVE-2025-55713
Blocksy WordPress theme versions through 2.1.6 are affected by an Improper neutralization of input during web page generation, resulting in Stored Cross-Site Scripting (XSS). The vulnerability affects the Blocksy frontend when handling user-supplied data without adequate escaping, per PT-2025-334...
CVE-2025-54680
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sparklewpthemes Blogger Buzz blogger-buzz allows Stored XSS.This issue affects Blogger Buzz: from n/a through = 1.2.6...
CVE-2025-54680
CVE-2025-54680 is a Stored XSS in the Blogger Buzz WordPress theme by Sparkle Themes, affecting Blogger Buzz versions up to 1.2.6. Root cause: improper neutralization of input during web page generation. CVSS v3.1 base score 6.5 (Medium); attack vector network, low complexity, user interaction re...
PT-2025-33232 · Unknown · Sparkle Themes Blogger Buzz
Name of the Vulnerable Software and Affected Versions: Sparkle Themes Blogger Buzz versions through 1.2.6 Description: Improper neutralization of input during web page generation allows for stored cross-site scripting XSS. Recommendations: Update to a version later than 1.2.6...
WordPress Blocksy Theme <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)
Software Blocksy Type Theme Vulnerable versions = 2.1.6 Fixed in 2.1.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-55713 Patch priority Low CVSS severity Low 5.9 Developer Creative Themes PSID 05f50ffb9258 Credits savphill Required privilege Shop manager...
GHSA-P3QF-84RG-JXFC OliveTin OS Command Injection vulnerability
OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go...
OliveTin OS Command Injection vulnerability
OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go...
CVE-2025-50946
OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go...
CVE-2025-50946
OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go...
CVE-2025-50946
OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go...
CVE-2025-50946
OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go...
PT-2025-33034
Name of the Vulnerable Software and Affected Versions Olivetin version 2025.4.22 Description OS Command Injection exists in Custom Themes through the ParseRequestURI function located in service/internal/executor/arguments.go. Recommendations At the moment, there is no information about a newer...