CVE-2025-6490 sparklemotion nokogiri hashmap.c hashmap_set_with_hash heap-based overflow

A vulnerability was found in sparklemotion nokogiri c29c920907366cb74af13b4dc2230e9c9e23b833 and classified as problematic. This issue affects the function hashmapsetwithhash of the file gumbo-parser/src/hashmap.c. The manipulation leads to heap-based buffer overflow. An attack has to be approach...

Malicious code in mydummyproject-zyp (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b7385c16c060ed95f15f1eed55e51d69f17bc1768a7ed955da163b7e314b62df Any computer that has this package installed or running should be considered...

CVE-2025-5125: Improper Neutralization of Input During Web Page Generation

The Custom Post Carousels with Owl WordPress plugin before 1.4.12 uses the featherlight library and makes use of the data-featherlight attribute without sanitizing before using it...

CVE-2025-50042: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in aviplugins.com WP Register Profile With Shortcode wp-register-profile-with-shortcode allows Stored XSS.This issue affects WP Register Profile With Shortcode: from n/a through = 3.6.3...

Malicious code in @ftapi/components (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 465d533e4d5739006fe746ab80f7ca366926e9c7fa2a5d063a1a2c6a2b1cfb9c The OpenSSF Package Analysis project identified '@ftapi/components' @...

IBM OpenPages Web Arbitrary HTML Code

The vulnerability of the web interface of IBM OpenPages and IBM OpenPages with Watson relates to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary HTML code remotely...

IBM OpenPages File Write

The vulnerability of the IBM OpenPages and IBM OpenPages with Watson web interfaces relates to incorrect restrictions on the path name to the restricted catalog. Exploitation of this vulnerability could allow a malicious actor to write to or re-write any files remotely...

IBM OpenPages Session Interception

The vulnerability of the IBM OpenPages and IBM OpenPages with Watson web interfaces relates to improper session management. Exploiting this vulnerability can allow a malicious actor to intercept a user’s session...

IBM OpenPages CSRF

The vulnerability of the web interfaces of IBM OpenPages and IBM OpenPages with Watson relates to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to execute a CSRF attack remotely...

CVE-2025-49451: Path Traversal: '.../...//'

Path Traversal: '.../...//' vulnerability in yannisraft Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery aeroscroll-gallery allows Path Traversal.This issue affects Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery: from n/a through...

CVE-2025-4216: Improper Neutralization of Input During Web Page Generation

The DIOT SCADA with MQTT plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'diot' shortcode in all versions up to, and including, 1.0.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

GO-2025-3744 SpiceDB checks involving relations with caveats can result in no permission when permission is expected in github.com/authzed/spicedb

SpiceDB checks involving relations with caveats can result in no permission when permission is expected in github.com/authzed/spicedb...

Malware in opensearch-with-grafana-lambdas

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Code-Projects School Fees Payment System Security Vulnerabilities

School Fees Payment System is a tuition payment system. The School Fees Payment System suffers from a SQL injection vulnerability that originates from a lack of validation of externally-entered SQL statements in the parameter namestartsWith in the file /ajx.php. An attacker can exploit this...

CVE-2025-24772

Cross-Site Request Forgery CSRF vulnerability in cmsMinds Pay with Contact Form 7 pay-with-contact-form-7 allows Cross Site Request Forgery.This issue affects Pay with Contact Form 7: from n/a through = 1.0.4...

MAL-2025-4916 Malicious code in @yahoo-engadget/i13n (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7b0126ffaa6b21bad21996772209dce287f8a254cb6d7a85d835ea2dee07352c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-24772

Cross-Site Request Forgery CSRF vulnerability in cmsMinds Pay with Contact Form 7 pay-with-contact-form-7 allows Cross Site Request Forgery.This issue affects Pay with Contact Form 7: from n/a through = 1.0.4...

CVE-2025-24772 WordPress Pay with Contact Form 7 plugin <= 1.0.4 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in cmsMinds Pay with Contact Form 7 pay-with-contact-form-7 allows Cross Site Request Forgery.This issue affects Pay with Contact Form 7: from n/a through = 1.0.4...

CVE-2025-24772 WordPress Pay with Contact Form 7 plugin <= 1.0.4 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in cmsMinds Pay with Contact Form 7 pay-with-contact-form-7 allows Cross Site Request Forgery.This issue affects Pay with Contact Form 7: from n/a through = 1.0.4...

CVE-2025-24772

CVE-2025-24772 describes a CSRF vulnerability in cmsMinds Pay with Contact Form 7 (Pay with Contact Form 7: from n/a through 1.0.4). The connected Red Hat entry confirms the CSRF issue but provides no additional technical details or patch information beyond the description, so no remediation deta...