EUVD-2025-36518

IPFire versions prior to 2.29 Core Update 198 contain a stored cross-site scripting XSS vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the txtmailuser and txtmailpass parameters when updating the mail server settings. When a user updates the mail...

PT-2025-44175

Name of the Vulnerable Software and Affected Versions IPFire versions prior to 2.29 Core Update 198 Description IPFire versions prior to 2.29 Core Update 198 are susceptible to a stored cross-site scripting XSS issue. An authenticated attacker can inject arbitrary JavaScript code through the txt...

EUVD-2017-7855

Malware in sbrugna...

EUVD-2008-5546

Malware in sbrugna...

EUVD-2011-4855

Malware in sbrugna...

EUVD-2020-6185

Malware in sbrugna...

EUVD-2018-17743

Malware in sbrugna...

EUVD-2019-3129

Malware in sbrugna...

EUVD-2022-5726

Malicious code in bioql PyPI...

EUVD-2024-0683

Malicious code in bioql PyPI...

EUVD-2022-26152

Malicious code in bioql PyPI...

CVE-2025-54875 FreshRSS: Unauthorized creation of admin user when registration is enabled

FreshRSS is a free, self-hostable RSS aggregator. In versions 1.16.0 and above through 1.26.3, an unprivileged attacker can create a new admin user when registration is enabled through the use of a hidden field used only in the user management admin page, newuserisadmin. This is fixed in version...

Linux Distros Unpatched Vulnerability : CVE-2022-30597

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field. CVE-2022-30597 Note that Nessus relies on the...

ActFax Server 安全漏洞

ActFax Server is a fax server software from ActFax Austria. A security vulnerability exists in ActFax Server version 4.32, which originates from an unvalidated .exp file field length in the Import User function, and could lead to a stack buffer overflow and arbitrary code execution...

CVE-2025-5651

A vulnerability, which was classified as problematic, has been found in code-projects Traffic Offense Reporting System 1.0. This issue affects some unknown processing of the file saveuser.php. The manipulation of the argument userid/username/email/name/position leads to cross site scripting. The...

CVE-2023-6187

The Paid Memberships Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'pmpropaypalexpresssessionvarsforuserfields' function in versions up to, and including, 2.12.3. This makes it possible for authenticated attackers with subscriber...

CVE-2021-24504

The WP LMS – Best WordPress LMS Plugin WordPress plugin through 1.1.2 does not properly sanitise or validate its User Field Titles, allowing XSS payload to be used in them. Furthermore, no CSRF and capability checks were in place, allowing such attack to be performed either via CSRF or as any use...

CVE-2020-14018

An issue was discovered in Navigate CMS 2.9 r1433. There is a stored XSS vulnerability that is executed on the page to view users, and on the page to edit users. This is present in both the User field and the E-Mail field. On the Edit user page, the XSS is only triggered via the E-Mail field;...

CVE-2020-15599

Victor CMS through 2019-02-28 allows XSS via the register.php userfirstname or userlastname field...

CVE-2022-47194

An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this...