659 matches found
CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard
ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the "Image Gallery", leading to a Stored Cross-Site Scripting XSS vulnerability. The exploit can be triggered when any user accesses the public API endpoint of the malicious SVG images, or if t...
EUVD-2025-33711
rardecode: DoS risk due to unrestricted RAR dictionary sizes...
WordPress Blocksy Companion plugin <= 2.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Rafshanzani Suhada in WordPress Plugin Blocksy Companion versions = 2.1.14...
CVE-2025-28129
Phpgurukul Hostel Management System 2.1 is vulnerable to clickjacking...
CVE-2025-28129
Phpgurukul Hostel Management System 2.1 is vulnerable to clickjacking...
CVE-2025-8917 Path Traversal Leading to Remote Code Execution in allegroai/clearml
A vulnerability in allegroai/clearml version v2.0.1 allows for path traversal due to improper handling of symbolic and hard links in the safeextract function. This flaw can lead to arbitrary file writes outside the intended directory, potentially resulting in remote code execution if critical fil...
EUVD-2025-32428
Minecraft RCON Terminal is a VS Code extension that streamlines Minecraft server management. Versions 0.1.0 through 2.0.6 stores passwords using VS Code's configuration API which writes to settings.json in plaintext. This issue is fixed in version 2.1.0...
EUVD-2025-30629
Malicious code in bioql PyPI...
EUVD-2023-53407
Malicious code in bioql PyPI...
EUVD-2025-29766
Malicious code in bioql PyPI...
EUVD-2025-29767
Malicious code in bioql PyPI...
EUVD-2025-26930
Malicious code in bioql PyPI...
EUVD-2023-43737
Malicious code in bioql PyPI...
EUVD-2025-24891
Malicious code in bioql PyPI...
EUVD-2021-28047
Malicious code in bioql PyPI...
EUVD-2025-31688
Malicious code in bioql PyPI...
CVE-2025-49090
The Matrix specification before 1.16 i.e., with a room version before 12 and State Resolution before 2.1 has deficient state resolution...
CVE-2025-10191
The Big Post Shipping for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wooboigpostshippingstatus' shortcode in all versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This...
CVE-2025-10191
CVE-2025-10191 concerns the WordPress plugin Big Post Shipping for WooCommerce . The vulnerability is a Stored Cross-Site Scripting (XSS) in the shortcode wooboigpost_shipping_status. Affected versions are up to 2.1.1 (Wordfence listing confirms patching in 2.1.2). The issue stems from insufficie...
CVE-2025-59833 FlagForgeCTF Hint Exposure via API
Flag Forge is a Capture The Flag CTF platform. In versions from 2.1.0 to before 2.3.0, the API endpoint GET /api/problems/:id returns challenge hints in plaintext within the question object, regardless of whether the user has unlocked them via point deduction. Users can view all hints for free,...