EUVD-2010-4724

Malware in sbrugna...

EUVD-2018-16861

Malware in sbrugna...

EUVD-2011-5152

Malware in sbrugna...

EUVD-2015-1307

Malware in sbrugna...

EUVD-2016-9956

Malware in sbrugna...

EUVD-2018-9624

Malware in sbrugna...

EUVD-2018-6500

Malware in sbrugna...

EUVD-2017-18235

Malware in sbrugna...

EUVD-2008-7230

Malware in sbrugna...

EUVD-2005-3889

Malware in sbrugna...

EUVD-2010-4727

Malware in sbrugna...

EUVD-2010-4725

Malware in sbrugna...

EUVD-2021-18743

Malware in sbrugna...

EUVD-2008-7234

Malware in sbrugna...

EUVD-2020-28909

Malware in sbrugna...

EUVD-2010-1121

Malware in sbrugna...

CVE-2025-9875

The Event Tickets, RSVPs, Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ticketspot' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f...

CVE-2025-10696 OpenSupports 4.11.0 — Insecure Direct Object Reference in supervised list

OpenSupports exposes an endpoint that allows the list of 'supervised users' for any account to be edited, but it does not validate whether the actor is the owner of that list. A Level 1 staff member can modify the supervision relationship of a third party the target user, who can then view the...

CVE-2025-10692 OpenSupports 4.11.0 — SQL Injection

The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter binding. As a result, an authenticated staff user level ≥ 1 can inject SQL to alter the filter logic, effectively bypassing department scoping...

CVE-2025-10692 OpenSupports 4.11.0 — SQL Injection

The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter binding. As a result, an authenticated staff user level ≥ 1 can inject SQL to alter the filter logic, effectively bypassing department scoping...