BIT-GITLAB-2025-2255 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in Gitlab EE/CE for AppSec affecting all versions from 13.5.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Certain error messages could allow Cross-Site Scripting attacks XSS. for AppSec...

CVE-2025-26941

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in andymoyle Church Admin church-admin allows SQL Injection.This issue affects Church Admin: from n/a through = 5.0.18...

CVE-2025-26564

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in kagla GNUCommerce gnucommerce allows Reflected XSS.This issue affects GNUCommerce: from n/a through = 1.5.4...

CVE-2025-22356

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Stencies Stencies stencies allows Reflected XSS.This issue affects Stencies: from n/a through = 0.58...

CVE-2025-31457

Cross-Site Request Forgery CSRF vulnerability in Aurélien LWS LWS SMS lws-sms allows Cross Site Request Forgery.This issue affects LWS SMS: from n/a through = 2.4.1...

CVE-2025-31096

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPXPO PostX ultimate-post allows DOM-Based XSS.This issue affects PostX: from n/a through = 4.1.25...

CVE-2020-8565 affecting package local-path-provisioner for versions less than 0.0.24-5

CVE-2020-8565 affecting package local-path-provisioner for versions less than 0.0.24-5. A patched version of the package is available...

CVE-2025-22652

CVE-2025-22652 is a SQL Injection vulnerability in the WordPress plugin Payment Forms for Paystack (vulnerable up to and including 4.0.1). The root cause, as detailed in the exploit repo, is unsafely inserting a URL parameter (order) directly into an SQL query without input validation/escaping in...

CVE-2025-2255

An issue has been discovered in Gitlab EE/CE for AppSec affecting all versions from 13.5.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Certain error messages could allow Cross-Site Scripting attacks XSS. for AppSec...

CVE-2025-30904

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ays Pro Chartify chart-builder allows Stored XSS.This issue affects Chartify: from n/a through = 3.1.7...

CVE-2025-30879

CVE-2025-30879 concerns MC WooCommerce Wishlist. Connected sources confirm a concrete issue: an authenticated SQL Injection in the MC Woocommerce Wishlist plugin, affecting versions up to 1.8.9 (inclusive). The vulnerability is categorized with CVSS v3.1: vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C...

CVE-2025-30860

CVE-2025-30860 is a DOM-based Cross-Site Scripting vulnerability in Off-Canvas Sidebars & Menus (Slidebars) for WordPress, stemming from improper neutralization of input during web page generation. Affected versions range up to 0.5.8.2 (date shown). Exploitation would require user interaction and...

USN-7375-1: Org Mode vulnerabilities

It was discovered that Org Mode did not correctly handle filenames containing shell metacharacters. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. CVE-2023-28617 It was discovered that Org Mode could run...

CVE-2025-30164

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 vulnerability allows an attacker to craft a URL that, once visited by an authenticated user or one that is able to authenticate, allows to...

CVE-2025-30164 Icinga Web 2 has open redirect on login page

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 vulnerability allows an attacker to craft a URL that, once visited by an authenticated user or one that is able to authenticate, allows to...

CVE-2025-30568

Cross-Site Request Forgery CSRF vulnerability in hitoy Super Static Cache super-static-cache allows Cross Site Request Forgery.This issue affects Super Static Cache: from n/a through = 3.3.5...

CVE-2025-30534

Cross-Site Request Forgery CSRF vulnerability in captcha.soft Image Captcha image-captcha allows Cross Site Request Forgery.This issue affects Image Captcha: from n/a through = 1.2...

CVE-2025-30606

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Logan Carlile Easy Page Transition easy-page-transition allows Stored XSS.This issue affects Easy Page Transition: from n/a through = 1.0.1...

CVE-2025-30586

Cross-Site Request Forgery CSRF vulnerability in bbodine1 cTabs ctabs allows Stored XSS.This issue affects cTabs: from n/a through = 1.3...

CVE-2025-30571

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in STEdb Corp. STEdb Forms stedb-forms allows SQL Injection.This issue affects STEdb Forms: from n/a through = 1.0.4...