WordPress Contest Gallery plugin cross-site scripting vulnerability

WordPress Contest Gallery plugin is a powerful plugin that is mainly used to organize all kinds of online contests in WordPress websites, supporting the uploading and displaying of photos, videos, audios, documents and other types of files. WordPress Contest Gallery plugin suffers from a cross-si...

CVE-2025-51497

CVE-2025-51497 : In AdGuard for Safari on macOS, versions before 1.11.22 log every visited URL to macOS general logs while the plugin is active. This verbose logging can be read by any unsandboxed process, creating potential information disclosure. Root cause is user activity data being written t...

CVE-2025-53908

RomM is a self-hosted rom manager and player. Versions prior to 3.10.3 and 4.0.0-beta.3 have an authenticated path traversal vulnerability in the /api/raw endpoint. Anyone running the latest version of RomM and has multiple users, even unprivileged users, such as the kiosk user in the official...

CVE-2025-53908 RomM vulnerable to Authenticated Path Traversal

RomM is a self-hosted rom manager and player. Versions prior to 3.10.3 and 4.0.0-beta.3 have an authenticated path traversal vulnerability in the /api/raw endpoint. Anyone running the latest version of RomM and has multiple users, even unprivileged users, such as the kiosk user in the official...

CVE-2025-53908

RomM is affected by an authenticated path traversal vulnerability in the /api/raw endpoint. Versions prior to 3.10.3 and prior to 4.0.0-beta.3 are vulnerable. The issue can allow leakage of passwords and user data on systems with multiple users (including unprivileged users such as the kiosk user...

CVE-2025-40724

Stored Cross-Site Scripting XSS vulnerability in Pharmacy POS PHP Script. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the umedicinename parameter in /editmedicine.php. This vulnerability can be exploited to...

CVE-2025-40724

Vulnerability : CVE-2025-40724 affects the Pharmacy POS PHP Script. A Stored Cross-Site Scripting (XSS) flaw exists in the /edit_medicine.php endpoint, exploitable via the u_medicine_name parameter to inject JavaScript into victims’ browsers. Impact : As described, an attacker can steal sensitive...

CVE-2025-40724 Stored Cross-Site Scripting (XSS) in Pharmacy POS PHP Script

Stored Cross-Site Scripting XSS vulnerability in Pharmacy POS PHP Script. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the umedicinename parameter in /editmedicine.php. This vulnerability can be exploited to...

CVE-2025-40724 Stored Cross-Site Scripting (XSS) in Pharmacy POS PHP Script

Stored Cross-Site Scripting XSS vulnerability in Pharmacy POS PHP Script. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the umedicinename parameter in /editmedicine.php. This vulnerability can be exploited to...

PT-2025-29876 · Romm · Romm

Name of the Vulnerable Software and Affected Versions: RomM versions prior to 3.10.3 RomM versions prior to 4.0.0-beta.3 Description: RomM, a self-hosted rom manager and player, contains an authenticated path traversal issue in the /api/raw endpoint. This allows for the leakage of passwords and...

GHSA-X3VM-88HF-GPXP Directus is vulnerable to sensitive data exposure as user data is not being redacted when logged

Summary When using Directus Flows to handle CRUD events for users it is possible to log the incoming data to console using the "Log to Console" operation and a template string. Impact Malicious admins can log sensitive data from other users when they are created or updated. Workarounds Avoid...

PT-2025-29543 · Unknown · Pharmacy Pos Php Script

Name of the Vulnerable Software and Affected Versions: Pharmacy POS PHP Script affected versions not specified Description: A stored Cross-Site Scripting XSS issue exists in Pharmacy POS PHP Script. Successful exploitation allows an attacker to execute JavaScript code in a victim’s browser. This ...

CVE-2025-53885 Directus doesn't redact sensitive user data when logging via event hooks

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flows to handle CRUD events for users it is possible to log the incoming data to console using the "Log to Console" operation and a template...

CVE-2025-53885 Directus doesn't redact sensitive user data when logging via event hooks

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flows to handle CRUD events for users it is possible to log the incoming data to console using the "Log to Console" operation and a template...

CVE-2025-53640 Indico vulnerable to user enumeration via API endpoint

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Starting in version 2.2 and prior to version 3.3.7, an endpoint used to display details of users listed in certain fields such as ACLs could be misused to dump basic user details such ...

GHSA-Q28V-664F-Q6WJ Indico vulnerability allows attackers to bulk dump user details

Impact An endpoint used to display details of users listed in certain fields such as ACLs could be misused to dump basic user details such as name, affiliation and email in bulk. !TIP If your instance allows everyone to create a user account, and you wish to truly restrict access to these user...

Indico 安全漏洞

Indico is a feature-rich event management system from Indico Open Source. A security vulnerability exists in Indico versions prior to 3.3.7, which stems from Flask-Multipass having user details leaked...

New Study Shows Google Tracking Persists Even With Privacy Tools

A new SafetyDetectives study reveals the surprising extent of Google tracking across the web in the US, UK, Switzerland, and Sweden. Discover how Google Analytics, AdSense, and YouTube embeds collect your data, even when using DuckDuckGo...

CVE-2025-4593 WP Register Profile With Shortcode <= 3.6.2 - Authenticated (Contributor+) Sensitive Information Exposure

The WP Register Profile With Shortcode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the 'rpuserdata' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive...

CVE-2025-7021 OpenAI Operator - API Spoofing through Locking Operator on FullScreen

Fullscreen API Spoofing and UI Redressing in the handling of Fullscreen API and UI rendering in OpenAI Operator SaaS on Web allows a remote attacker to capture sensitive user input e.g., login credentials, email addresses via displaying a deceptive fullscreen interface with overlaid fake browser...