14335 matches found
CVE-2022-50030
CVE-2022-50030 is a vulnerability in the Linux kernel’s lpfc driver affecting debugfs input handling. According to the provided documents, malformed user input to debugfs can cause buffer overflow crashes due to input strings not fitting internal buffers (space for NULL terminators added). The CV...
CVE-2025-26198
CloudClassroom-PHP-Project v1.0 contains a critical SQL Injection vulnerability in the loginlinkadmin.php component. The application fails to sanitize user-supplied input in the admin login form before directly including it in SQL queries. This allows unauthenticated attackers to inject arbitrary...
CVE-2025-26198
CloudClassroom-PHP-Project v1.0 contains a critical SQL Injection vulnerability in the loginlinkadmin.php component. The application fails to sanitize user-supplied input in the admin login form before directly including it in SQL queries. This allows unauthenticated attackers to inject arbitrary...
CVE-2025-26198
CVE-2025-26198 — CloudClassroom-PHP-Project v1.0 suffers a critical SQL Injection in the admin login path (loginlinkadmin.php) where unsanitized input is used directly in SQL queries. This enables unauthenticated users to bypass authentication and gain full admin access, potentially exposing or m...
PT-2025-26082 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A buffer overflow issue has been identified in the Linux kernel, specifically in the cp2112 xfer function. The read length variable, which is provided by data-block0 and comes from use...
PT-2025-26163 · Minitcg · Minitcg
Name of the Vulnerable Software and Affected Versions: miniTCG version 1.3.1 beta Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the id parameter at the "/members/edit.php" API endpoint. Recommendations:...
CVE-2025-49149 Dify has XSS vulnerability
Dify is an open-source LLM app development platform. In version 1.2.0, there is insufficient filtering of user input by web applications. Attackers can use website vulnerabilities to inject malicious script code into web pages. This may result in a cross-site scripting XSS attack when a user...
CVE-2025-49149 Dify has XSS vulnerability
Dify is an open-source LLM app development platform. In version 1.2.0, there is insufficient filtering of user input by web applications. Attackers can use website vulnerabilities to inject malicious script code into web pages. This may result in a cross-site scripting XSS attack when a user...
CVE-2025-49823
conda Constructor is a tool which allows constructing an installer for a collection of conda packages. Prior to version 3.11.3, shell installer scripts process the installation prefix userprefix using an eval statement, which executes unsanitized user input as shell code. Although the script runs...
CVE-2025-49823 Conda Constructor Command Injection via Unsanitized User Input (Low)
conda Constructor is a tool which allows constructing an installer for a collection of conda packages. Prior to version 3.11.3, shell installer scripts process the installation prefix userprefix using an eval statement, which executes unsanitized user input as shell code. Although the script runs...
CVE-2025-49823 Conda Constructor Command Injection via Unsanitized User Input (Low)
conda Constructor is a tool which allows constructing an installer for a collection of conda packages. Prior to version 3.11.3, shell installer scripts process the installation prefix userprefix using an eval statement, which executes unsanitized user input as shell code. Although the script runs...
PT-2025-25704 · Unknown · Rustaurius Ultimate Reviews
Name of the Vulnerable Software and Affected Versions: Rustaurius Ultimate Reviews versions n/a through 3.2.14 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. Recommendations: For version...
PT-2025-25736 · Unknown · Cubewp Framework
Name of the Vulnerable Software and Affected Versions: CubeWP Framework versions 1.1.23 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS in the CubeWP Framework...
PT-2025-25735 · Cyberchimps · Cyberchimps Responsive Blocks
Name of the Vulnerable Software and Affected Versions: CyberChimps Responsive Blocks versions 2.0.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacke...
WordPress Animated Buttons Cross-Site Scripting Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress Animated Buttons, which stems from insufficient cleanup and escaping of user-supplied attribute inputs in the...
Cisco Webex Cross-Site Scripting Vulnerability (CNVD-2025-15713)
Cisco Webex is a suite of video conferencing and collaboration products from Cisco. A cross-site scripting vulnerability exists in Cisco Webex that stems from improper user input filtering and can be exploited by an attacker to cause a cross-site scripting attack...
PT-2025-25648 · Undefined · Undefined
Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue concerns unvalidated user input. However, it has been rejected as it was not considered a security issue. Recommendations: At the moment, there is no information about a newer...
CVE-2025-4216
The DIOT SCADA with MQTT plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'diot' shortcode in all versions up to, and including, 1.0.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...
CVE-2025-4585
The IRM Newsroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irmflat' shortcode in all versions up to, and including, 1.2.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
