Wago CODESYS V2 Runtime System Heap-based Buffer Overflow (CVE-2021-30186)

CODESYS V2 runtime system SP before 2.4.7.55 has a Heap-based Buffer Overflow. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid503313;...

PT-2025-36452

Name of the Vulnerable Software and Affected Versions: sanitize-html versions prior to 2.0.0-beta Description: The sanitizeHtml function in index.js does not sanitize content when using the custom transformTags option, which is intended to convert attribute values into text. This allows malicious...

PT-2025-36461

CVE ID: CVE-2025-0004 Published: 2025-04-12T00:00:00.000Z Severity: MEDIUM 6.1/10 Description Cross-site scripting XSS vulnerability in the user management interface of Enterprise Portal v2.3.0 allows attackers to inject arbitrary web scripts. Root Cause Improper neutralization of input during we...

Wago CODESYS V2 Runtime System Stack-based Buffer Overflow (CVE-2021-30188)

CODESYS V2 runtime system SP before 2.4.7.55 has a Stack-based Buffer Overflow. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid503312;...

PT-2025-36487

Name of the Vulnerable Software and Affected Versions: Portabilis i-Educar versions up to 2.10 Description: A weakness exists in Portabilis i-Educar up to version 2.10 related to cross site scripting. The issue is located in an unknown functionality of the file /intranet/educar usuario cad.php...

CVE-2025-10073

CVE-2025-10073 affects Portabilis i-Educar up to version 2.10. The vulnerability resides in an unknown function in the file /module/Api/turma and can lead to improper authorization when manipulated. Exploitation can be performed remotely, and public disclosures of the exploit are noted. Several c...

CVE-2025-10070 Portabilis i-Educar enturmacao-em-lote access control

A flaw has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /enturmacao-em-lote/. This manipulation causes improper access controls. The attack is possible to be carried out remotely. The exploit has been published and may be used...

CVE-2025-10070 Portabilis i-Educar enturmacao-em-lote access control

A flaw has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /enturmacao-em-lote/. This manipulation causes improper access controls. The attack is possible to be carried out remotely. The exploit has been published and may be used...

CVE-2025-10013

A vulnerability was detected in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /exportacao-para-o-seb. Performing manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit is now public and may be used...

CVE-2025-58883

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Thomas Harris Search Cloud One search-cloud-one allows Stored XSS.This issue affects Search Cloud One: from n/a through = 2.2.5...

CVE-2025-58847

Cross-Site Request Forgery CSRF vulnerability in Yaidier WN Flipbox Pro wn-flipbox-pro allows Reflected XSS.This issue affects WN Flipbox Pro: from n/a through = 2.1...

i-Educar 访问控制错误漏洞

i-Educar is a free educational software from Portábilis Open Source. An access control error vulnerability exists in i-Educar version 2.10 and earlier, which stems from improper access control in the file /enturmacao-em-lote/...

Exploit for Deserialization of Untrusted Data in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

CVE-2021-44228 Log4j2 日志内容 JNDI RCE 缓解措施 English version 国际镜像：https://github.com/zhangyoufu/log4j2-without-jndi 国内镜像：https://code.aliyun.com/zhangyoufu/log4j2-without-jndi/tree/master 使用方式 1. 寻找部署目录下的 log4j2-core 组件 find . -name 'log4j-core.jar' 2. 对找到的 log4j2-core JAR 包实施缓解措施 方式1: 使用 zip 命令从 JAR...

CVE-2025-9853 Optio Dentistry <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Optio Dentistry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'optio-lightbox' shortcode in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-9853

Optio Dentistry for WordPress is vulnerable to a Stored Cross-Site Scripting (stored XSS) via the optio-lightbox shortcode in all versions up to 2.2. The root cause is insufficient input sanitization and output escaping on user-supplied attributes, enabling authenticated attackers with contributo...

CVE-2025-9849 Html Social share buttons <= 2.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Html Social share buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zmshbtn' shortcode in all versions up to, and including, 2.1.16 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress Optio Dentistry plugin <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Optio Dentistry versions = 2.2...

CVE-2025-9057

The Biagiotti Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

Malicious code in shenmide-fulu-zhouyu-ver2 (npm)

The package shenmide-fulu-zhouyu-ver2 was found to contain malicious code...

CVE-2025-58628

CVE-2025-58628 refers to a SQL injection vulnerability in the WordPress theme Miraculous (versions before 2.0.9). The issue is caused by improper neutralization of special elements in SQL commands, enabling blind SQL injection. Public writeups and vulnerability feeds confirm affected software as ...