CVE-2025-24949

In JotUrl 2.0, is possible to bypass security requirements during the password change process...

CVE-2025-24948

In JotUrl 2.0, passwords are sent via HTTP GET-type requests, potentially exposing credentials to eavesdropping or insecure records...

CVE-2025-26958 WordPress JetBlog plugin <= 2.4.3 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Crocoblock JetBlog jet-blog allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetBlog: from n/a through = 2.4.3...

GHSA-9GQV-WP59-FQ42 http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed

In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed...

PT-2025-16357 · Joturl · Joturl

Name of the Vulnerable Software and Affected Versions: JotUrl version 2.0 Description: The issue involves passwords being sent via HTTP GET-type requests, potentially exposing credentials to eavesdropping or insecure records. Recommendations: For JotUrl version 2.0, consider disabling the use of...

JotUrl security vulnerability

JotUrl is a marketing integration suite from JotUrl, Inc. A security vulnerability exists in JotUrl version 2.0 that stems from a password being sent via an HTTP GET request, which could lead to credential disclosure...

Code-Gen security vulnerability

code-gen is a code generation tool for tanghc individual developers. A security vulnerability exists in code-gen 2.0.6 and earlier versions, which stems from a lack of privilege control and could lead to arbitrary access...

WordPress Plugin Sign-up Sheets: Code Injection Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code injection vulnerability exis...

JotUrl security vulnerability

JotUrl is a marketing integration suite from JotUrl, Inc. A security vulnerability exists in JotUrl version 2.0 that stems from a password change process that can bypass security requirements...

Cisco IOS XR DoS

The vulnerability of the Internet Key Exchange version 2 IKEv2 module in Cisco IOS XR operating systems is related to the use of incorrect authentication tokens due to unlimited resource allocation. Exploiting this vulnerability can allow a malicious actor to cause service failures...

WordPress plugin Clearfy Cache has a cross-site request forgeing vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

SUSE CVE-2025-31483

Miniflux is a feed reader. Due to a weak Content Security Policy on the /proxy/ route, an attacker can bypass the CSP of the media proxy and execute cross-site scripting when opening external images in a new tab/window. To mitigate the vulnerability, the CSP for the media proxy has been changed...

WordPress HTML5 Video Player with Playlist Plugin <= 2.50 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin HTML5 Video Player with Playlist versions = 2.50...

CodeAstro Internet Banking System Security Vulnerabilities

CodeAstro Internet Banking System is a PHP online banking system from CodeAstro. A security vulnerability exists in CodeAstro Internet Banking System version 2.0.0, which is caused by stored cross-site scripting in the name parameter...

Verydows security vulnerabilities

Verydows is a lightweight open source e-commerce management system developed using the PHP language. A security vulnerability exists in version 2.0 of verydows, which stems from an improper privilege setting that could allow a remote attacker to execute arbitrary code...

WordPress plugin WP w3all phpBB cross-site request fraud vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site reques...

CVE-2025-3436

The coreActivity: Activity Logging for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'order' and 'orderby' parameters in all versions up to, and including, 2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQ...

tomcat: Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame

A flaw was found in Apache Tomcat. This vulnerability allows an application-level denial of service DoS, causing it to become unresponsive or slow via maliciously crafted HTTP/2 prioritization headers. It performs an incomplete cleanup of failed requests, which triggers a memory leak...

Security update for skopeo

This update for skopeo fixes the following issues: CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs bsc1238685 CVE-2025-27144: gopkg.in/square/go-jose.v2,gopkg.in/go-jose/go-jose.v2,github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: Go JOSE's Parsing Vulnerable t...

pb-cms: Code injection vulnerability

pb-cms waterfall content management system is a content management system developed by LinZhaoguan. A code injection vulnerability exists in pb-cms version 2.0, which is caused by cross-site scripting in Friendship Link Handler...