3405 matches found
CVE-2025-64112 Statmatic vulnerable to Stored Cross-Site Scripting
Statmatic is a Laravel and Git powered content management system CMS. Stored XSS vulnerabilities in Collections and Taxonomies allow authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This vulnerability is fix...
CVE-2025-43942
Dell Unity, versions 5.5 and prior, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution and Elevation of privilege...
CVE-2025-43940
Dell Unity, versions 5.5 and Prior, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution and Elevation of privilege...
CVE-2025-10008
CVE-2025-10008 affects Translate WordPress and go Multilingual – Weglot plugin for WordPress. Root cause: missing capability check in clean_options, allowing unauthenticated deletion of limited transients (cached plugin options) in all versions up to and including 5.1. Impact: unauthorized data l...
PT-2025-44550
Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 5.8.0 Description The software is susceptible to stored cross-site scripting XSS through the My Tools page. Insufficient validation or escaping of user-supplied input could allow an attacker to inject and execute...
PT-2025-44552
Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 5.8.0 Description Nagios XI versions prior to 5.8.0 are susceptible to cross-site scripting XSS through the Views feature's URL handling. Insufficient validation or escaping of user-supplied input could allow an...
PT-2025-44470
Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 5.7.3 Description Nagios XI versions prior to 5.7.3 contain a command injection issue in the report PDF download/export functionality. Insufficient validation or improper escaping of user-supplied values used in the...
Nagios XI 安全漏洞
Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems and more. A security vulnerability exists in Nagios XI versions prior to 5.8.0 that stems from insufficient validatio...
CVE-2025-64194 WordPress Eduma theme <= 5.7.6 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThimPress Eduma eduma allows Stored XSS.This issue affects Eduma: from n/a through = 5.7.6...
CVE-2025-64194 WordPress Eduma theme <= 5.7.6 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThimPress Eduma eduma allows Stored XSS.This issue affects Eduma: from n/a through = 5.7.6...
WordPress plugin Eduma 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...
PT-2025-44241
Name of the Vulnerable Software and Affected Versions ThimPress Eduma versions through 5.7.6 Description The software contains a flaw due to improper neutralization of input during web page generation, leading to a Cross-site Scripting issue. This allows for Stored XSS attacks. The affected...
CentOS 9 : kernel-5.14.0-631.el9
"The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-631.el9 build changelog. - In the Linux kernel, the following vulnerability has been resolved: tcp: Clear tcpsksk-fastopenrsk in tcpdisconnect. syzbot reported t...
CVE-2025-12204
A security vulnerability has been detected in Kamailio 5.5. Impacted is the function rvedestroy of the file src/core/rvalue.c of the component Configuration File Handler. The manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed...
Ghost CMS 5.42.1 - Path Traversal (CVE-2023-32235)
Binary data ghostcmspathtraversalcve-2023-32235.nbin...
EUVD-2025-36380
eLabFTW is an open source electronic lab notebook for research labs. The application served uploaded SVG files inline. Because SVG supports active content, an attacker could upload a crafted SVG that executes script when viewed, resulting in stored XSS under the application origin. A victim who...
DEBIAN-CVE-2025-12206
A flaw has been found in Kamailio 5.5. The impacted element is the function rveisconstant of the file src/core/rvalue.c. This manipulation causes null pointer dereference. The attack needs to be launched locally. The exploit has been published and may be used. It is still unclear if this...
CVE-2025-12205
Kamailio 5.5 is affected by a vulnerability in the function sr_push_yy_state (src/core/cfg.lex) that causes use-after-free. The issue requires local access to exploit. Public exploit exists, but the real-world existence of the vulnerability has been doubted in the sources. Connected advisories (R...
CVE-2025-58918
CVE-2025-58918 – CSRF in Waituk Entrada Theme (WordPress) A Cross-Site Request Forgery vulnerability affects the Waituk Entrada WordPress theme (versions up to and including 5.7.7). The issue is documented across multiple sources (NVD/Red Hat/CIRCL/CVEs list) with the same description. No exploit...