14321 matches found
PT-2025-32081 · WordPress · Request A Quote Form
Name of the Vulnerable Software and Affected Versions: Request a Quote Form plugin for WordPress versions prior to 2.5.3 Description: The Request a Quote Form plugin for WordPress is susceptible to Remote Code Execution due to improper validation of user input before it is used as a function name...
PT-2025-32355 · Undefined · Undefined
CVE-2025-55025 - Apache HTTP Server Unvalidated User Input CVE ID : CVE-2025-55025 Published : Aug. 6, 2025, 4:16 a.m. | 2 hours, 19 minutes ago Description : Rejected reason: Not used Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2012-10031
BlazeVideo HDTV Player Pro v6.6.0.3 is vulnerable to a stack-based buffer overflow due to improper handling of user-supplied input embedded in .plf playlist files. When parsing a crafted .plf file, the MediaPlayerCtrl.dll component invokes PathFindFileNameA to extract a filename from a URL-like...
GHSA-VF9J-H32G-2764 mcp-package-docs vulnerable to command injection in several tools
Summary A command injection vulnerability exists in the mcp-package-docs MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to childprocess.exec, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote code...
Command Injection
calibreweb is vulnerable to Command Injection. The vulnerability is due to improper neutralization of special elements used in an OS command due to insufficient sanitization of user input, allowing blind OS command injection...
FreeFloat FTP Server 安全漏洞
FreeFloat FTP Server is an FTP service from FreeFloat, Inc. A security vulnerability exists in FreeFloat FTP Server version 1.0.0 that stems from not properly validating USER command input and could lead to a buffer overflow and arbitrary code execution...
PT-2025-32256 · Undefined · Undefined
CVE-2025-54979 - Apache HTTP Server Unvalidated User Input CVE ID : CVE-2025-54979 Published : Aug. 5, 2025, 4:16 a.m. | 2 hours, 19 minutes ago Description : Rejected reason: Not used Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-44961
In RUCKUS SmartZone SZ before 6.1.2p3 Refresh Build, OS command injection can occur via an IP address field provided by an authenticated user...
CVE-2025-8212
The Medical Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typewriter widget in all versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2025-52390
Saurus CMS Community Edition since commit d886e5b0 2010-04-23 is vulnerable to a SQL Injection vulnerability in the prepareSearchQuery method in FulltextSearch.class.php. The application directly concatenates user-supplied input $searchword into SQL queries without sanitization, allowing attacker...
CVE-2025-50869
A stored Cross-Site Scripting XSS vulnerability exists in the qureydetails.php page of Institute-of-Current-Students 1.0, where the input fields for Query and Answer do not properly sanitize user input. Authenticated users can inject arbitrary JavaScript code...
CVE-2025-51569
A cross-site scripting XSS vulnerability exists in the LB-Link BL-CPE300M 01.01.02P42U1406 router's web interface. The /goform/goformgetcmdprocess endpoint fails to sanitize user input in the cmd parameter before reflecting it into a text/html response. This allows unauthenticated attackers to...
CVE-2025-8146 Qi Addons for Elementor <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via TypeOut Text Widget
The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's TypeOut Text widget in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2025-50869
A stored Cross-Site Scripting XSS vulnerability exists in the qureydetails.php page of Institute-of-Current-Students 1.0, where the input fields for Query and Answer do not properly sanitize user input. Authenticated users can inject arbitrary JavaScript code...
CVE-2025-52390
Saurus CMS Community Edition since commit d886e5b0 2010-04-23 is vulnerable to a SQL Injection vulnerability in the prepareSearchQuery method in FulltextSearch.class.php. The application directly concatenates user-supplied input $searchword into SQL queries without sanitization, allowing attacker...
Cross-site Scripting (XSS)
Overview panel is a The powerful data exploration & web app framework for Python. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to missing HTML escaping in authentication templates. The errormessage variable in the basiclogin.html template and the error/errormsg...
PT-2025-31648 · Unknown · Saurus Cms Community Edition
Name of the Vulnerable Software and Affected Versions: Saurus CMS Community Edition versions since commit d886e5b0 2010-04-23 Description: Saurus CMS Community Edition is susceptible to a SQL Injection issue due to the direct concatenation of user-supplied input $search word into SQL queries with...
CVE-2025-52390
Saurus CMS Community Edition since commit d886e5b0 2010-04-23 is vulnerable to a SQL Injection vulnerability in the prepareSearchQuery method in FulltextSearch.class.php. The application directly concatenates user-supplied input $searchword into SQL queries without sanitization, allowing attacker...
PT-2025-31659 · Unknown · Institute-Of-Current-Students
Name of the Vulnerable Software and Affected Versions: Institute-of-Current-Students version 1.0 Description: A stored Cross-Site Scripting XSS vulnerability exists in the qureydetails.php page. The input fields for Query and Answer do not properly sanitize user input, allowing authenticated user...
CVE-2025-52390
CVE-2025-52390 – Saurus CMS Community Edition is affected since commit d886e5b0 (2010-04-23). The vulnerability is a SQL Injection in the FulltextSearch.class.php -> prepareSearchQuery() where user input ($search_word) is directly concatenated into SQL queries without sanitization. This can al...