1769 matches found
CVE-2025-3897
CVE-2025-3897 affects EUCookieLaw for WordPress (
CVE-2025-45242
Rhymix v2.1.22 was discovered to contain an arbitrary file deletion vulnerability via the procFileAdminEditImage method in /file/file.admin.controller.php...
Retrieval-based-Voice-Conversion-WebUI 代码问题漏洞
Retrieval-based-Voice-Conversion-WebUI is an open source voice training modeling tool from RVC-Project. A code issue vulnerability exists in Retrieval-based-Voice-Conversion-WebUI version 2.2.231006 and earlier, which stems from improper handling of the ckptdir variable, and could lead to unsafe...
ABB Automation Builder 安全漏洞
ABB Automation Builder is an integrated engineering development environment from ABB Switzerland for unified programming and configuration of ABB programmable logic controllers PLCs, motion control and robotics systems. A security vulnerability exists in ABB Automation Builder version 2.8.0 and...
RHSA-2025:4228 Red Hat Security Advisory: mod_auth_openidc:2.3 security update
Bulletin has no description...
CVE-2025-46655
CodiMD through 2.5.4 has a CSP-based protection mechanism against XSS through uploaded SVG documents containing JavaScript, but it can be bypassed in certain cases of different-origin file storage, such as AWS S3. NOTE: it can be considered a user error if AWS is employed for hosting untrusted...
glibc security update
2.34-125.0.1.8 - Forward-port Oracle patches for ol9-u5 glibc-2.34-125.0.1.8 Reviewed by: David Faust Oracle history:...
CVE-2025-46689
CVE-2025-46689 affects Ververica Platform 2.14.0 with a Reflected XSS vulnerability exposed via the URI path namespaces/default/formats . The issue involves user-controlled input in that path, allowing an attacker to trigger script execution in a victim’s browser when the vulnerable page is loade...
CVE-2025-32389
NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Prior to version 2.1.4, NamelessMC is vulnerable to SQL injection by providing an unexpected square bracket GET parameter syntax. Square bracket GET parameter syntax refers to the structure ?param0=a1=b2=c utiliz...
CVE-2024-56156 Halo Vulnerable to Stored XSS and RCE via File Upload Bypass
Halo is an open source website building tool. Prior to version 2.20.13, a vulnerability in Halo allows attackers to bypass file type validation controls. This bypass enables the upload of malicious files including executables and HTML files, which can lead to stored cross-site scripting attacks a...
CVE-2025-46495 WordPress Drop Caps plugin <= 2.1 - CSRF to XSS vulnerability
Cross-Site Request Forgery CSRF vulnerability in tomontoast Drop Caps drop-caps allows Stored XSS.This issue affects Drop Caps: from n/a through = 2.1...
CVE-2025-46452 WordPress Google News plugin <= 2.5.1 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery CSRF vulnerability in Olav Kolbu Google News allows Stored XSS. This issue affects Google News: from n/a through 2.5.1...
CVE-2025-46226 WordPress MPL-Publisher <= 2.18.0 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ferranfg MPL-Publisher allows Stored XSS. This issue affects MPL-Publisher: from n/a through 2.18.0...
AZL-61768 CVE-2024-58250 affecting package ppp 2.5.0-1
The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges...
CVE-2025-30357 NamelessMC Forum Topic Deletion Triggered by Unrelated User Deletion
NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, if a malicious user is leaving spam comments on many topics then an administrator, unable to manually remove each spam comment, may delete the malicious account. Once an administrator...
CVE-2025-32626 WordPress JS Job Manager plugin <= 2.0.2 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in JoomSky JS Job Manager allows SQL Injection. This issue affects JS Job Manager: from n/a through 2.0.2...
CVE-2025-32634
CVE-2025-32634 describes a Reflected XSS in the WordPress plugin Run Contests, Raffles, and Giveaways with ContestsWP (versions n/a through 2.0.6). The vulnerability arises from improper input neutralization during web page generation. Affected software is ContestsWP communications for Run Contes...
CVE-2025-32636 WordPress Local Magic Plugin <= 2.6.0 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in matthewrubin Local Magic allows SQL Injection. This issue affects Local Magic: from n/a through 2.6.0...
WordPress Contact Form vCard Generator plugin <= 2.4 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Contact Form vCard Generator versions = 2.4...