CVE-2024-1211

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2 in which cross-site request forgery may have been possible on GitLab instances configured to use JWT as an OmniAut...

CVE-2025-24538 WordPress BuddyPress Groups Extras plugin <= 3.6.10 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Slava Abakumov BuddyPress Groups Extras buddypress-groups-extras allows Cross Site Request Forgery.This issue affects BuddyPress Groups Extras: from n/a through = 3.6.10...

CVE-2025-24721

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Aleksandar Urošević Easy YouTube Gallery easy-youtube-gallery allows Stored XSS.This issue affects Easy YouTube Gallery: from n/a through = 1.0.4...

CVE-2025-23545

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Navnish Bhardwaj WP Social Broadcast wp-social-broadcast allows Reflected XSS.This issue affects WP Social Broadcast: from n/a through = 1.0.0...

CVE-2025-23545

CVE-2025-23545 is a Reflected XSS in WP Social Broadcast (Navnish Bhardwaj) affecting WP Social Broadcast versions up to 1.0.0. Root cause: improper neutralization of input during web page generation. Public details come from CVE records (NVD/Red Hat) and confirm the issue; exploitation status, s...

CVE-2025-23770 WordPress Fast Tube plugin <= 2.3.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Caspie Fast Tube fast-tube allows Reflected XSS.This issue affects Fast Tube: from n/a through = 2.3.1...

CVE-2025-23708

Cross-Site Request Forgery CSRF vulnerability in Dominic Fallows DF Draggable df-draggable allows Stored XSS.This issue affects DF Draggable: from n/a through = 1.13.2...

Mediawiki - DataTransfer Extension Cross-Site Request Forgery (CSRF) and Cross-site Scripting (XSS)

Cross-Site Request Forgery CSRF, Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Cross Site Request Forgery, Cross-Site Scripting XSS.This issue affects Mediawiki - DataTransf...

CVE-2025-23079

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - ArticleFeedbackv5 extension allows Cross-Site Scripting XSS.This issue affects Mediawiki - ArticleFeedbackv5 extension: from 1.42.X before 1.42.2...

CVE-2024-13300

Vulnerability in Drupal Print Anything.This issue affects Print Anything:...

CVE-2024-13301 OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) - Critical - Cross Site Scripting - SA-CONTRIB-2024-067

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal OAuth & OpenID Connect Single Sign On – SSO OAuth/OIDC Client allows Cross-Site Scripting XSS.This issue affects OAuth & OpenID Connect Single Sign On – SSO OAuth/OIDC Client: from 3.0.0...

CVE-2024-13292 Tooltip - Moderately critical - Cross site scripting - SA-CONTRIB-2024-058

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Tooltip allows Cross-Site Scripting XSS.This issue affects Tooltip: from 0.0.0 before 1.1.2...

CVE-2024-13284

Cross-Site Request Forgery CSRF vulnerability in Drupal Gutenberg allows Cross Site Request Forgery.This issue affects Gutenberg: from 0.0.0 before 2.13.0, from 3.0.0 before 3.0.5...

CVE-2024-13244

Cross-Site Request Forgery CSRF vulnerability in Drupal Migrate Tools allows Cross Site Request Forgery.This issue affects Migrate Tools: from 0.0.0 before 6.0.3...

CVE-2024-13258

Summary: CVE-2024-13258 is an Incorrect Authorization issue in the Drupal REST & JSON API Authentication module that allows forceful browsing. Affected software: Drupal REST & JSON API Authentication module (versions 0.0.0 through 2.0.12). Root cause/impact: Insufficient access control could bypa...

CVE-2024-13253

CVE-2024-13253 affects Drupal Advanced PWA inc Push Notifications. Affected versions range from 0.0.0 to before 1.5.0; the root cause is an Incorrect Authorization vulnerability that enables forceful browsing. A fixed version is 1.5.0 or later. Remediation: upgrade to 1.5.0+ or apply vendor guida...

CVE-2024-43658 Using the <redacted> action or <redacted>.sh script, arbitrary files and directories can be deleted using directory traversal.

Patch traversal, External Control of File Name or Path vulnerability in Iocharger Home allows deletion of arbitrary files This issue affects Iocharger firmware for AC model before firmware version 25010801. Likelihood: High, but requires authentication Impact: Critical – The vulnerability can be...

CVE-2025-22533

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in bulktheme WOOEXIM wooexim allows SQL Injection.This issue affects WOOEXIM: from n/a through = 5.0.0...

CVE-2024-56300

Insertion of Sensitive Information Into Sent Data vulnerability in wpspin Post/Page Copying Tool postpage-import-export-with-custom-fields-taxonomies allows Retrieve Embedded Sensitive Data.This issue affects Post/Page Copying Tool: from n/a through = 2.0.0...

Wireshark 3.6.x < 3.6.20, 4.0.x < 4.0.12, 4.2.0 Multiple Vulnerabilities (Jan 2025) - Mac OS X

Wireshark is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wireshark:wireshark"; ifdescripti...