CVE-2024-12815

The CVE-2024-12815 entry concerns the Point Maker WordPress plugin. It affects the Point Maker plugin’s point_maker shortcode in all versions up to 0.1.6, due to insufficient input sanitization and output escaping on user-supplied attributes. The vulnerability enables stored XSS that, if exploite...

CVE-2024-13757 Master Slider – Responsive Touch Slider <= 3.10.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_layer Shortcode

The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mslayer shortcode in all versions up to, and including, 3.10.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

Cross Site Scripting

solid-js is vulnerable to Cross Site Scripting. The vulnerability is due to improper escaping of user input inside illegal inlined JSX fragments, allowing unescaped input to be rendered as HTML...

Linux Distros Unpatched Vulnerability : CVE-2022-31108

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. A...

CVE-2024-45782

A flaw was found in the HFS filesystem. When reading an HFS volume's name at grubfsmount, the HFS filesystem driver performs a strcpy using the user-provided volume name as input without properly validating the volume name's length. This issue may read to a heap-based out-of-bounds writer,...

Cross-Site Scripting (XSS)

NagVis is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to user-supplied input being reflected in responses without adequate sanitization, and attackers can exploit this by crafting malicious links that execute arbitrary JavaScript in the victim's browser when clicked, affectin...

CVE-2025-0769

PixelYourSite - Your smart PIXEL TAG and API Manager 10.1.1.1 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/modules/facebook/facebook-server-a sync-task.php...

CVE-2025-22491

The user input was not sanitized on Reporting Hierarchy Management page of Foreseer Reporting Software FRS application which could lead into execution of arbitrary JavaScript in a browser context for all the interacting users. This security issue has been patched in the latest version 1.5.100 of...

CVE-2025-0767

WP Activity Log 5.3.2 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/classes/Writers/class-csv-writer.php...

CVE-2025-0769

PixelYourSite - Your smart PIXEL TAG and API Manager 10.1.1.1 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/modules/facebook/facebook-server-a sync-task.php...

CVE-2025-0769 PixelYourSite 10.1.1.1 - Insecure deserialization

PixelYourSite - Your smart PIXEL TAG and API Manager 10.1.1.1 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/modules/facebook/facebook-server-a sync-task.php...

CVE-2025-0769 PixelYourSite 10.1.1.1 - Insecure deserialization

PixelYourSite - Your smart PIXEL TAG and API Manager 10.1.1.1 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/modules/facebook/facebook-server-a sync-task.php...

CVE-2025-0769

PixelYourSite – Your smart PIXEL (TAG) and API Manager plugin (WordPress) version 10.1.1.1 is affected by CVE-2025-0769 due to unvalidated user input being used directly in an unserialize call inside myapp/modules/facebook/facebook-server-sync-task.php. The vulnerability is described as an unauth...

Pebble has Arbitrary Local File Inclusion (LFI) Vulnerability via `include` macro

Summary If untrusted user input is used to dynamically create a PebbleTemplate with the method PebbleEnginegetLiteralTemplate, then an attacker can include arbitrary local files from the file system into the generated template, leaking potentially sensitive information into the output of...

CVE-2025-22491

The user input was not sanitized on Reporting Hierarchy Management page of Foreseer Reporting Software FRS application which could lead into execution of arbitrary JavaScript in a browser context for all the interacting users. This security issue has been patched in the latest version 1.5.100 of...

Security Bulletin: Multiple security vulnerabilities in Cloud Pak foundational services are addressed with IBM Cloud Pak for Business Automation 24.0.1-IF001

Summary IBM Cloud Pak for Business Automation 24.0.1-IF001 updates the version of IBM Cloud Pak foundational services to address multiple security vulnerabilities. Vulnerability Details CVEID:CVE-2024-43796 DESCRIPTION: expressjs express is vulnerable to cross-site scripting, caused by improper...

CVE-2024-9019

CVE-2024-9019 concerns the SecuPress Free — WordPress Security plugin. The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the secupress_check_ban_ips_form shortcode, caused by insufficient input sanitization and output escaping. Affected versions are all up to and including 2.2.5.3....

CVE-2025-1571

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text and Image Comparison Widgets in all versions up to, and including, 2.7.6 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2025-1405

CVE-2025-1405 affects the WordPress plugin Product Catalog Simple (post-type-x). It is a stored XSS vulnerability via the plugin’s show_products shortcode in versions up to 1.7.11, caused by insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires an ...

PT-2025-9133 · Unknown · Pixelyoursite

Name of the Vulnerable Software and Affected Versions: PixelYourSite - Your smart PIXEL TAG and API Manager version 10.1.1.1 Description: The issue arises from unvalidated user input being used directly in an unserialize function. This occurs in the myapp/modules/facebook/facebook-server-a...