PT-2025-54462

Name of the Vulnerable Software and Affected Versions Esri ArcGIS Server versions prior to 11.4 Description A stored cross-site scripting issue exists in Esri ArcGIS Server. In certain configurations, a remote, unauthenticated attacker can store files containing malicious code that may execute...

PT-2025-54463

Name of the Vulnerable Software and Affected Versions Esri ArcGIS Server versions prior to 11.4 Description A stored cross site scripting issue exists in Esri ArcGIS Server. In certain configurations, a remote, unauthenticated attacker can store files containing malicious code that may execute...

CVE-2025-15355

CVE-2025-15355 describes a reflected cross-site scripting vulnerability in ISOinsight (NetVision Information). Unauthenticated remote attackers can lure users via phishing to trigger arbitrary JavaScript execution in the victim’s browser. The Red Hat/CIRCL/NVD entries align on the same descriptio...

CVE-2025-15355 NetVision Information｜ISOinsight - Reflected Cross-site Scripting

ISOinsight developed by NetVision Information has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks...

EUVD-2025-205693

ISOinsight developed by NetVision Information has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks...

CVE-2025-15355 NetVision Information｜ISOinsight - Reflected Cross-site Scripting

ISOinsight developed by NetVision Information has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks...

CVE-2025-15225

WMPro developed by Sunnet has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to read arbitrary system files...

PT-2025-54254

Name of the Vulnerable Software and Affected Versions Tinycontrol LAN Controller version 1.58a Description An authentication bypass allows unauthenticated attackers to change admin passwords. This is achieved by sending a crafted API request to the /stm.cgi endpoint with a specially crafted...

CVE-2025-15225 Sunnet｜WMPro - Arbitrary File Read

WMPro developed by Sunnet has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to read arbitrary system files...

SUNNET WMPro 代码问题漏洞

SUNNET WMPro is a suite of online learning platforms from Taiwan, China-based Sunnet Technology SUNNET. SUNNET WMPro suffers from a code issue vulnerability that stems from the presence of an arbitrary file upload vulnerability that could allow an unauthenticated, remote attacker to upload and...

SUSE CVE-2025-12816

An interpretation-conflict CWE-436 vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions...

CVE-2025-11419 Keycloak: keycloak tls client-initiated renegotiation denial of service

A flaw was found in Keycloak. This vulnerability allows an unauthenticated remote attacker to cause a denial of service DoS by repeatedly initiating TLS 1.2 client-initiated renegotiation requests to exhaust server CPU resources, making the service unavailable...

CVE-2023-53972

WebTareas 2.4 contains a SQL injection vulnerability in the webTareasSID cookie parameter that allows unauthenticated attackers to manipulate database queries. Attackers can exploit error-based and time-based blind SQL injection techniques to extract database information and potentially access...

CVE-2025-15015

Enterprise Cloud Database developed by Ragic has a Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files...

CVE-2025-15016

The CVE-2025-15016 entry relates to Ragic’s Enterprise Cloud Database, which is vulnerable due to a hard-coded cryptographic key that can be exploited by unauthenticated remote attackers to generate authentication data and log in as any user. Affected component: Ragic Enterprise Cloud Database (c...

CVE-2025-9343

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ticket subjects in all versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacker...

EUVD-2025-204662

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ticket subjects in all versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacker...

CVE-2025-13361

The Web to SugarCRM Lead plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation on the custom field deletion functionality. This makes it possible for unauthenticated attackers to delete custom fields v...

CVE-2025-12398

The Product Table for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'searchkey' parameter in all versions up to, and including, 5.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2025-14164

The Quran Gateway plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing nonce validation in the qurangatewayoptions function. This makes it possible for unauthenticated attackers to modify the plugin's display settings v...