CVE-2025-52558

changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. Prior to version 0.50.4, errors in filters from website page change detection watches were not being filtered resulting in a cross-site scripting XSS vulnerability. This...

CVE-2025-52561

The CVE-2025-52561 issue affects HTMLSanitizer.jl (a whitelist-based HTML sanitizer). Before version 0.2.1, adding the style element to the whitelist caused content inside the tag to be unescaped and closing tags injected as content to be interpreted as real HTML, enabling tag injection and JavaS...

CVE-2025-52561 HTMLSanitizer.jl Possible XSS

HTMLSanitizer.jl is a Whitelist-based HTML sanitizer. Prior to version 0.2.1, when adding the style tag to the whitelist, content inside the tag is incorrectly unescaped, and closing tags injected as content are interpreted as real HTML, enabling tag injection and JavaScript execution. This could...

CVE-2025-52558 ChangeDetection.io XSS in watch overview

changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. Prior to version 0.50.4, errors in filters from website page change detection watches were not being filtered resulting in a cross-site scripting XSS vulnerability. This...

CVE-2025-52558

Changedetection.io prior to version 0.50.4 is affected by a cross-site scripting (XSS) vulnerability caused by errors in filters during page-change detection watches. The issue can allow an attacker to inject malicious scripts into a user’s browser. The vulnerability has been patched in version 0...

CVE-2025-2828 SSRF Vulnerability in RequestsToolkit in langchain-ai/langchain

A Server-Side Request Forgery SSRF vulnerability exists in the RequestsToolkit component of the langchain-community package specifically, langchaincommunity.agenttoolkits.openapi.toolkit.RequestsToolkit in langchain-ai/langchain version 0.0.27. This vulnerability occurs because the toolkit does n...

PT-2025-26644

Name of the Vulnerable Software and Affected Versions: changedetection.io versions prior to 0.50.4 Description: The issue is related to a cross-site scripting XSS vulnerability due to errors in filters from website page change detection watches not being properly filtered. This vulnerability has...

Important: javapackages-bootstrap

Issue Overview: Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not...

PT-2025-26586

Name of the Vulnerable Software and Affected Versions sslh versions prior to 2.2.2 Description An improper link resolution issue, known as link following, exists in sslh, a protocol multiplexor used to share SSH and HTTPS on the same port. The software fails to properly handle symbolic links when...

PT-2025-26643 · Langchain Ai · Langchain

Name of the Vulnerable Software and Affected Versions: langchain-ai/langchain version 0.0.27 Description: A Server-Side Request Forgery SSRF vulnerability exists in the RequestsToolkit component of the langchain-community package. This vulnerability occurs because the toolkit does not enforce...

PT-2025-26599

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2025.03.3 Description JetBrains TeamCity is affected by a reflected Cross-Site Scripting XSS issue on the favoriteIcon page. This occurs because the application fails to properly protect the web page...

CVE-2025-52487

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. In versions 7.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted request or proxy to be created that could bypass the design of DNN Login IP Filters allowing login attempts from IP...

PT-2025-26492

Name of the Vulnerable Software and Affected Versions: FastGPT versions prior to 4.9.12 Description: The issue concerns the LastRoute Parameter on the login page, which is vulnerable to open redirect and DOM-based XSS due to improper validation and lack of sanitization. This allows attackers to...

PT-2025-26347 · Unknown · Slui Media Hygiene

Name of the Vulnerable Software and Affected Versions: slui Media Hygiene versions n/a through 4.0.1 Description: The issue is related to a Missing Authorization vulnerability in slui Media Hygiene, which allows exploiting incorrectly configured access control security levels. Recommendations: Fo...

PT-2025-26401 · WordPress · Jobs For Wordpress

Name of the Vulnerable Software and Affected Versions: Jobs for WordPress versions through 2.7.12 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

PT-2025-26290 · WordPress · Euro Fxref Currency Converter

Name of the Vulnerable Software and Affected Versions: Euro FxRef Currency Converter plugin for WordPress versions up to, and including, 2.0.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's currency shortcode due to insufficient input sanitization and output...

PT-2025-26400 · Unknown · Modern Footnotes

Name of the Vulnerable Software and Affected Versions: Modern Footnotes versions 1.4.19 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

PT-2025-26355 · Wpfactory · Wpfactory Crm Erp Business Solution

Name of the Vulnerable Software and Affected Versions: WPFactory CRM ERP Business Solution versions 1.13 and earlier Description: The issue is related to a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Recommendations: For...

PT-2025-26422 · Unknown · Creative Contact Form

Name of the Vulnerable Software and Affected Versions: Creative Contact Form versions 1.0.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application...

PT-2025-26378 · Unknown · Better Random Redirect

Name of the Vulnerable Software and Affected Versions: Better Random Redirect versions 1.3.20 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...