14338 matches found
CVE-2024-13702
CVE-2024-13702 affects CRM and Lead Management by vcita (WordPress plugin). Versions up to 2.7.4 are vulnerable to Stored XSS via vCitaMeetingScheduler and vCitaSchedulingCalendar shortcodes due to insufficient input sanitization/output escaping on user attributes. Exploitation requires authentic...
CVE-2025-2167 Event post <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Event post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'eventslist' shortcodes in all versions up to, and including, 5.9.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
CVE-2025-2302 Advanced Woo Search <= 3.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via aws_search_terms Shortcode
The Advanced Woo Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's awssearchterms shortcode in all versions up to, and including, 3.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2025-2302
CVE-2025-2302 affects the Advanced Woo Search WordPress plugin. It is vulnerable to a Stored Cross-Site Scripting (XSS) via the aws_search_terms shortcode in all versions up to and including 3.28, caused by insufficient input sanitization and output escaping of user-supplied attributes. This allo...
CVE-2025-30222 Shescape has potential environment variable exposure on Windows with CMD
Shescape is a simple shell escape library for JavaScript. Versions 1.7.2 through 2.1.1 are vulnerable to potential environment variable exposure on Windows with CMD. This impact users of Shescape on Windows that explicitly configure shell: 'cmd.exe' or shell: true using any of...
CVE-2024-12623
The DICOM Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dcm' shortcode in all versions up to, and including, 0.10.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
Cross-Site Scripting (XSS)
clickstorm/cs-seo is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper encoding of user input in the TYPO3 backend user interface, allowing a logged-in backend user to inject malicious scripts...
CVE-2024-10725
A stored cross-site scripting XSS vulnerability exists in phpipam/phpipam version 1.5.2. This vulnerability allows an attacker to inject malicious scripts into the application, which are then executed in the context of other users who view the affected pages. The issue occurs when editing the NAT...
CVE-2024-12388
A vulnerability in binary-husky/gptacademic version 310122f allows for a Regular Expression Denial of Service ReDoS attack. The application uses a regular expression to parse user input, which can take polynomial time to match certain crafted inputs. This allows an attacker to send a small...
CVE-2024-9900
mudler/localai version v2.21.1 contains a Cross-Site Scripting XSS vulnerability in its search functionality. The vulnerability arises due to improper sanitization of user input, allowing the injection and execution of arbitrary JavaScript code. This can lead to the execution of malicious scripts...
CVE-2024-8898
A path traversal vulnerability exists in the install and uninstall API endpoints of parisneo/lollms-webui version V12 Strawberry. This vulnerability allows attackers to create or delete directories with arbitrary paths on the system. The issue arises due to insufficient sanitization of...
CVE-2024-10549
A vulnerability in the /3/Parse endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service DoS attack. The endpoint uses a user-specified string to construct a regular expression, which is then applied to another user-specified string. By sending multiple simultaneous requests, an...
CVE-2024-10188
A vulnerability in BerriAI/litellm, as of commit 26c03c9, allows unauthenticated users to cause a Denial of Service DoS by exploiting the use of ast.literaleval to parse user input. This function is not safe and is prone to DoS attacks, which can crash the litellm Python server...
CVE-2024-8156
A command injection vulnerability exists in the workflow-checker.yml workflow of significant-gravitas/autogpt. The untrusted user input github.head.ref is used insecurely, allowing an attacker to inject arbitrary commands. This vulnerability affects versions up to and including the latest version...
CVE-2025-2303
CVE-2025-2303 (Block Logic – Full Gutenberg Block Display Control) affects the WordPress Block Logic plugin (versions
CVE-2025-27786
Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file removal in core.py. outputttspath in tts.py takes arbitrary user input and passes it to runttsscript function in core.py, which checks if the path in outputttspath exists, and if yes, removes that...
LocalAI Cross-Site Scripting (XSS) vulnerability in its search functionality
mudler/localai version v2.21.1 contains a Cross-Site Scripting XSS vulnerability in its search functionality. The vulnerability arises due to improper sanitization of user input, allowing the injection and execution of arbitrary JavaScript code. This can lead to the execution of malicious scripts...
GHSA-W6HH-W36C-VXMW LocalAI Cross-Site Scripting (XSS) vulnerability in its search functionality
mudler/localai version v2.21.1 contains a Cross-Site Scripting XSS vulnerability in its search functionality. The vulnerability arises due to improper sanitization of user input, allowing the injection and execution of arbitrary JavaScript code. This can lead to the execution of malicious scripts...
Denial of Service (DoS)
Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Denial of Service DoS through the use of ast.literaleval to parse user input. Details Denial of Service DoS describes a family of attacks, all aimed at making a system...