13570 matches found
Sensitive Information Disclosure
Weblate is vulnerable to Sensitive Information Disclosure. The vulnerability is due to exposed sensitive data due to source repository URLs containing credentials being included in client-side URL parameters and logs in plaintext...
Cross-Site Scripting (XSS)
@sveltejs/kit is vulnerable to cross-site scripting XSS. The vulnerability is due to improper sanitization of search parameter names when iterating over event.url.searchParams in server load functions, allowing attackers to inject malicious scripts via crafted URLs...
Moodle 安全漏洞
Moodle is a free e-learning software platform, also known as a course management system, learning management system or virtual learning environment. Moodle suffers from an information disclosure vulnerability that stems from an insufficient capability check, which can be exploited by an attacker ...
openSUSE Security Advisory (SUSE-SU-2025:1332-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2025-3788
creationtimestamp| type| source ---|---|--- 2025-04-18 10:59:16+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/12415 2025-04-18 11:26:52+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3ln3iuub3jhe2 2025-04-18...
CVE-2025-26268
creationtimestamp| type| source ---|---|--- 2025-04-17 17:57:23+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/12293 2025-04-17 18:54:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmzrqzkuas2b 2025-04-17 23:01:11+00:00| seen|...
CVE-2025-27338
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in graphems List Urls list-urls allows Reflected XSS.This issue affects List Urls: from n/a through = 0.2...
CVE-2025-27338 WordPress List Urls Plugin <= 0.2 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in graphems List Urls list-urls allows Reflected XSS.This issue affects List Urls: from n/a through = 0.2...
CVE-2025-27338 WordPress List Urls Plugin <= 0.2 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in graphems List Urls list-urls allows Reflected XSS.This issue affects List Urls: from n/a through = 0.2...
CVE-2025-27338
CVE-2025-27338 is a listed WordPress vulnerability affecting the List Urls (graphems List Urls) plugin up to version 0.2, described as an improper input neutralization vulnerability enabling Reflected XSS through Cross-site Scripting. The CVE is categorized as CSRF to Reflected XSS (Wordfence/NVD...
PT-2025-17073 · Unknown · Graphems List Urls
Name of the Vulnerable Software and Affected Versions: graphems List Urls versions n/a through 0.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS in graphems List Urls. Recommendation...
WordPress plugin List Urls 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress...
CVE-2024-49706
Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Open Redirect attacks by including base64 encoded URLs in the target parameter sent in a POST request to one of the endpoints. This vulnerability has been patched in version 79.0...
Server Side Request Forgery (SSRF)
LNbits is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of callback URLs in the LNURL authentication handling functionality, allowing attackers to access internal resources by specifying internal network addresses...
PYSEC-2025-35
Weblate is a web based localization tool. Prior to version 5.11, when creating a new component from an existing component that has a source code repository URL specified in settings, this URL is included in the client's URL parameters during the creation process. If, for example, the source code...
CVE-2025-3522
Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally. When an email is opened, Thunderbird accesses the specified URL to determine file size, and navigates to it when the user clicks the attachment. Because the URL is not validate...
PT-2025-16546 · Espocrm · Espocrm
Name of the Vulnerable Software and Affected Versions: EspoCRM versions prior to 9.0.5 Description: The issue concerns the Iframe dashlet in EspoCRM, which allows users to display iframes with arbitrary URLs. Since the sandbox attribute is not included in the iframe, a remote page can open popups...
CVE-2024-49706
Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Open Redirect attacks by including base64 encoded URLs in the target parameter sent in a POST request to one of the endpoints. This vulnerability has been patched in version 79.0...
CVE-2024-49706
Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Open Redirect attacks by including base64 encoded URLs in the target parameter sent in a POST request to one of the endpoints. This vulnerability has been patched in version 79.0...
CVE-2024-49706
The CVE-2024-49706 entry concerns Internet Starter, a module of the SoftCOM iKSORIS system. The vulnerability is an Open Redirect caused by including base64-encoded URLs in the target parameter of a POST request to a specific endpoint. The underlying component exposed to this issue is the handlin...