1764 matches found
CVE-2025-60039
CVE-2025-60039 affects the WordPress theme Noisa (
CVE-2025-49956 WordPress Fade Slider plugin <= 2.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Anandaraj Balu Fade Slider fade-slider allows Reflected XSS.This issue affects Fade Slider: from n/a through = 2.5...
CVE-2025-49955 WordPress WP Smart Flexslider Plugin <= 2.5 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Rajan Vijayan WP Smart Flexslider wp-smart-flexslider allows Reflected XSS.This issue affects WP Smart Flexslider: from n/a through = 2.5...
CVE-2025-49927
The CVE-2025-49927 issue concerns CrocoBlock JetWooBuilder (jet-woo-builder) for WordPress, with a Stored XSS vulnerability caused by improper neutralization of input during web page generation. Affected versions are up to and including 2.1.20.1. Red Hat and other sources corroborate the same des...
WordPress Plugin Directory Pro 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site...
CVE-2025-62771
Mercku M6a devices (firmware up to 2.1.0) are affected by a cross-site request forgery vulnerability that allows changing passwords via the intranet. The issue is described consistently across multiple feeds (NVD, Red Hat, CNNVD, etc.) but the provided documents do not include a published patch v...
EUVD-2025-35316
Mercku M6a devices through 2.1.0 allow password changes via intranet CSRF attacks...
CVE-2025-62419
DataEase (DataEase platform) prior to v2.10.14 contains a JDBC URL injection in the DB2 data source handler: when extraParams is empty, HOSTNAME, PORT, and DATABASE are concatenated into the JDBC URL without filtering, allowing an attacker to inject a malicious JDBC string via HOSTNAME to bypass ...
CVE-2025-62418 bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG)
Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges e.g. admin to upload a crafted SVG file containing embedded JavaScript. When viewed, the malicious code executes in the context of the...
WordPress Web Accessibility By accessiBe plugin <= 2.10 - Cross-Site Request Forgery vulnerability
Cross-Site Request Forgery vulnerability discovered by Moose Love in WordPress Plugin Web Accessibility By accessiBe versions = 2.10...
webkit2gtk3 security update
2.50.0-1 - Update to 2.50.0...
PT-2025-41630
Name of the Vulnerable Software and Affected Versions Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin versions prior to 2.3.6 Description The Everest Backup plugin for WordPress allows unauthorized access to data due to a missing capability check on the everest proces...
EulerOS 2.0 SP11 : python-urllib3 (EulerOS-SA-2025-2245)
According to the versions of the python-urllib3 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by...
EUVD-2025-33711
rardecode: DoS risk due to unrestricted RAR dictionary sizes...
CVE-2025-52650
Inline script execution allowed in CSP vulnerability has been identified in HCL AION v2.0...
HCL AION 安全漏洞
HCL AION is an AI lifecycle management platform from HCL India. A security vulnerability exists in HCL AION version 2.0, which stems from a cachable SSL page that could lead to the disclosure of credentials, system identifiers, or internal file paths...
PT-2025-41360
Name of the Vulnerable Software and Affected Versions Search & Go - Directory WordPress Theme versions prior to 2.7 Description The Search & Go - Directory WordPress Theme is susceptible to authentication bypass, potentially leading to account takeover. This occurs due to inadequate user validati...
CVE-2025-11495
A vulnerability was determined in GNU Binutils 2.45. The affected element is the function elfx8664relocatesection of the file elf64-x86-64.c of the component Linker. This manipulation causes heap-based buffer overflow. The attack can only be executed locally. The exploit has been publicly disclos...
AZL-68412 CVE-2025-11414 affecting package binutils for versions less than 2.41-10
A vulnerability was determined in GNU Binutils 2.45. Affected by this vulnerability is the function getlinkhashentry of the file bfd/elflink.c of the component Linker. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and...