CVE-2024-54461

The file names constructed within fileselector are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select a document file from that provider while using your app and could...

CVE-2024-54462 Unsanitized Filenames in Flutter package image_picker_android Allow File Overwrites

The file names constructed within imagepicker are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select an image file from that provider while using your app and could...

CVE-2024-54461 Unsanitized Filenames in Flutter package file_selector_android Allow File Overwrites

The file names constructed within fileselector are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select a document file from that provider while using your app and could...

PT-2025-1944

Name of the Vulnerable Software and Affected Versions Competition Form WordPress plugin through 2.0 Description The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This could be used...

Advisory ROSA-SA-2025-2605

software: libuv 1.44.2 OS: ROSA-CHROME packageevrstring: libuv-1.44.2-2 CVE-ID: CVE-2024-24806 BDU-ID: 2024-02979 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the uvgetaddrinfo function src/unix/getaddrinfo.c, src/win/getaddrinfo.c of the libuv asynchronous I/O library is related to insufficient...

PT-2025-5500 · WordPress · Wp Multi Store Locator

Name of the Vulnerable Software and Affected Versions: WP Multi Store Locator versions 2.4.7 and earlier Description: The issue is related to improper neutralization of script-related HTML tags in a web page, which allows for Reflected XSS attacks. This means that an attacker can inject malicious...

PT-2025-1987

Name of the Vulnerable Software and Affected Versions Dyn Business Panel WordPress plugin version 1.0.0 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. This...

PT-2025-3357 · Baidu · Baidu Input Method

Name of the Vulnerable Software and Affected Versions: Baidu Input Method version 12.6.13 Description: The issue allows attackers to access user information by supplying a crafted link. Recommendations: For version 12.6.13, update to a newer version to mitigate the risk. At the moment, there is n...

PT-2025-1695 · WordPress · Broadstreet

Name of the Vulnerable Software and Affected Versions: Broadstreet plugin for WordPress versions up to, and including, 1.50.3 Description: The issue is related to Stored Cross-Site Scripting via the zone parameter due to insufficient input sanitization and output escaping. This allows authenticat...

Medium: runfinch-finch

Issue Overview: An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service. CVE-2024-45338 golang-jwt is a Go implementation of JSON Web Tokens. Unclear...

PT-2025-5462 · WordPress · Orbisius Simple Notice

Name of the Vulnerable Software and Affected Versions: Orbisius Simple Notice versions 1.1.3 and earlier Description: The issue affects the Orbisius Simple Notice plugin, allowing Stored XSS due to improper neutralization of input during web page generation. This can lead to cross-site scripting...

PT-2025-5397 · Unknown · Caching Compatible Cookie Opt-In/Javascript

Name of the Vulnerable Software and Affected Versions: Caching Compatible Cookie Opt-In and JavaScript versions 0.0.0 through 0.0.10 Description: The issue is related to improper neutralization of input during web page generation, also known as cross-site scripting. This allows for stored XSS...

PT-2025-5545 · Ip2Location · Ip2Location Country Blocker

Name of the Vulnerable Software and Affected Versions: IP2Location Country Blocker versions prior to 2.38.3 Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS attacks. This means that an attacker can...

PT-2025-4642 · Unknown · Mdjm Event Management

Name of the Vulnerable Software and Affected Versions: MDJM Event Management versions 1.7.5.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables an attacker to injec...

PT-2025-5135 · Unknown · Notfound Bauernregeln

Name of the Vulnerable Software and Affected Versions: NotFound Bauernregeln versions 1.0.1 and below Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Reflected XSS. This means that an attacker can...

PT-2025-2222 · WordPress · Simple Gallery With Filter

Name of the Vulnerable Software and Affected Versions: Simple Gallery with Filter plugin for WordPress versions up to, and including, 2.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'c2tw sgwf' shortcode due to insufficient input sanitization and output...

Important: redis6

Issue Overview: Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17. An additional...

Important: python3.12

Issue Overview: Starting in Python 3.12.0, the asyncio.SelectorSocketTransport.writelines method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the...

PT-2025-2244 · Sperse.Io · Automate Hub Free

Name of the Vulnerable Software and Affected Versions: Automate Hub Free by Sperse.IO plugin for WordPress versions up to and including 1.7.0 Description: The issue is due to missing or incorrect nonce validation on the 'automate hub' page, making it possible for unauthenticated attackers to upda...

PT-2025-2824 · WordPress · Hero Mega Menu - Responsive Wordpress Menu Plugin

Name of the Vulnerable Software and Affected Versions: Hero Mega Menu - Responsive WordPress Menu Plugin versions 1.16.5 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for reflected cross-site scripting XSS. This means an...