CVE-2025-60246

CVE-2025-60246 applies to the WordPress plugin Simple Finance Calculator (author: weissmike) in versions <= 1.0. It is described as an improper input neutralization leading to a Reflected Cross-Site Scripting (XSS) vulnerability during web page generation. Affected scope is limited to the plug...

CVE-2025-60209 WordPress Connector for Gravity Forms and Google Sheets plugin <= 1.2.6 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in CRM Perks Connector for Gravity Forms and Google Sheets wp-gravity-forms-spreadsheets allows Object Injection.This issue affects Connector for Gravity Forms and Google Sheets: from n/a through = 1.2.6...

CVE-2025-52751

CVE-2025-52751 affects the WordPress Slide Puzzle plugin (versions ≤ 1.0.0). The issue is a Reflected XSS caused by improper input neutralization during web page generation in the slide-puzzle component. Exploitation could allow an attacker to inject and execute scripts in a victim’s browser when...

CVE-2025-11810 Print Button Shortcode <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Print Button Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'print-button' shortcode in all versions up to, and including, 1.0.1. This is due to insufficient input sanitization and output escaping on the 'target' attribute. This makes it possible for...

CVE-2025-11809 WP-Force Images Download <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The WP-Force Images Download plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpfid' shortcode in all versions up to, and including, 1.8. This is due to insufficient input sanitization and output escaping on the 'class' attribute. This makes it possible for authenticated...

WordPress plugin WhatsApp Chat for WordPress and WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site...

EUVD-2025-35136

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in The Wikimedia Foundation Mediawiki - Wikistories allows Stored XSS.This issue affects Mediawiki - Wikistories: from master before 1.44...

CVE-2025-62694

CVE-2025-62694 is a stored XSS in the Wikimedia Foundation MediaWiki WikiLove Extension (version 1.39). The root cause is improper neutralization of input during web page generation. This issue is described across multiple feeds as affecting the WikiLove Extension: 1.39, with a CVSS v4 base score...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987598)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987598 advisory. In the Linux kernel, the following vulnerability has been resolved: net/tls: fix slab-out-of-bounds bug in decryptinternal The memory size of tlsctx-rx.iv for...

NETLINK HG322G 安全漏洞

The NETLINK HG322G is a fiber optic network terminal from NETLINK. A security vulnerability exists in the NETLINK HG322G version V1.0.00, which stems from improper authentication of the web-based management interface, which could allow a remote, unauthenticated attacker to elevate privileges and...

CVE-2025-60280

CVE-2025-60280 affects Bang Resto v1.0 and is described as a Cross-Site Scripting (XSS) vulnerability caused by insufficient input sanitization or output encoding. The vulnerability could allow attacker-controlled input to be rendered in the browser, enabling potential theft of session cookies, u...

CVE-2025-62656

CVE-2025-62656 concerns a stored XSS in the Wikimedia Foundation MediaWiki GlobalBlocking extension. The connected sources confirm the vulnerability arises from improper neutralization of input during web page generation, enabling stored cross-site scripting. Affected versions are MediaWiki Globa...

PT-2025-42792

Name of the Vulnerable Software and Affected Versions FileRise versions prior to 1.4.0 Description FileRise is a self-hosted web-based file manager. A flaw in file/folder handling allows low-privilege users to perform unauthorized operations view, delete, modify on files created by other users...

CVE-2025-60781

PHP Education Manager v1.0 is vulnerable to Cross Site Scripting XSS in the worksheet.php file via the participantname parameter...

Restaurant-Management-System-DBMS-project 安全漏洞

Restaurant-Management-System-DBMS-project is a restaurant management system by Rajvi Patel, an individual developer. A security vulnerability exists in Restaurant-Management-System-DBMS-project version 1.0, which stems from improper handling of SQL query strings in login.php, which can lead to SQ...

CVE-2025-48087

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jason C. Memberlite Shortcodes memberlite-shortcodes allows Stored XSS.This issue affects Memberlite Shortcodes: from n/a through 1.4.1...

SUSE CVE-2025-11568

A data corruption vulnerability has been identified in the luksmeta utility when used with the LUKS1 disk encryption format. An attacker with the necessary permissions can exploit this flaw by writing a large amount of metadata to an encrypted device. The utility fails to correctly validate the...

CVE-2025-10300

The TopBar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the fmenbtopbarsavesettings function. This makes it possible for unauthenticated attackers to update the plugin's settin...

CVE-2025-10299

The WPBifröst – Instant Passwordless Temporary Login Links plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ctlcreatelink AJAX action in all versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with...

EUVD-2025-34697

A data corruption vulnerability has been identified in the luksmeta utility when used with the LUKS1 disk encryption format. An attacker with the necessary permissions can exploit this flaw by writing a large amount of metadata to an encrypted device. The utility fails to correctly validate the...