CVE-2024-13799: Improper Neutralization of Input During Web Page Generation

The User Private Files – File Upload & Download Manager with Secure File Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘new-fldr-name’ parameter in all versions up to, and including, 2.1.3 due to insufficient input sanitization and output escaping. This makes i...

PT-2025-7430

Name of the Vulnerable Software and Affected Versions IBM OpenPages with Watson versions 8.3 through 9.0 Description The issue allows a remote attacker to traverse directories on the system. An attacker with privileges to perform Import Configuration could send a specially crafted http request...

PT-2025-7429

Name of the Vulnerable Software and Affected Versions IBM OpenPages with Watson versions 8.3 through 9.0 Description The issue is caused by improper validation and management of authentication cookies, allowing a remote attacker to bypass security restrictions. By modifying the CSRF token and...

CVE-2024-11335: Improper Neutralization of Input During Web Page Generation

The UltraEmbed – Advanced Iframe Plugin For WordPress with Gutenberg Block Included plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'iframe' shortcode in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user...

PT-2025-7413

Name of the Vulnerable Software and Affected Versions IBM OpenPages with Watson versions 8.3 through 9.0 Description The issue allows an authenticated user to manipulate data in the Questionnaires application, enabling them to spoof other users' responses. Recommendations For versions 8.3 and 9.0...

PT-2025-7370

Name of the Vulnerable Software and Affected Versions YouTube Playlists with Schema plugin for WordPress versions up to, and including, 2.6.1 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'yt grid' shortcode due to insufficient input sanitization and output...

MAL-2025-1464 Malicious code in archon7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1f53d83b877f02c6e6b51cad5ccf4940a0e19e8e9aeda69d9a9d013ca471bd64 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-11895: Improper Neutralization of Input During Web Page Generation

The Online Payments – Get Paid with PayPal, Square & Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.20.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes...

PT-2025-6510

Name of the Vulnerable Software and Affected Versions Online Payments – Get Paid with PayPal, Square & Stripe plugin for WordPress versions prior to 3.20.0 Description The issue is related to Stored Cross-Site Scripting via the plugin's shortcodes due to insufficient input sanitization and output...

CVE-2025-24564

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in aviplugins.com Contact Form With Shortcode contact-form-with-shortcode allows Reflected XSS.This issue affects Contact Form With Shortcode: from n/a through = 4.2.5...

CVE-2025-24564

CVE-2025-24564 corresponds to a WordPress plugin vulnerability: WordPress plugin “Contact Form With Shortcode” (versions up to 4.2.5) suffers a Reflected XSS due to improper input neutralization during page generation. The issue is tracked across multiple feeds (Red Hat, NVD, CVE List) with the s...

CVE-2024-2240: Execution with Unnecessary Privileges

Docker daemon in Brocade SANnav before SANnav 2.3.1b runs without auditing. The vulnerability could allow a remote authenticated attacker to execute various attacks...

CVE-2025-24564: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in aviplugins.com Contact Form With Shortcode contact-form-with-shortcode allows Reflected XSS.This issue affects Contact Form With Shortcode: from n/a through = 4.2.5...

CVE-2024-13770: Deserialization of Untrusted Data

The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.2.4 via deserialization of untrusted input 'viewmoreposts' AJAX action. This makes it possible for unauthenticated attackers to...

PT-2025-6609

Name of the Vulnerable Software and Affected Versions The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress versions up to, and including, 4.2.4 Description The issue concerns PHP Object Injection via deserialization of untrusted input in the 'view more posts' AJ...

CVE-2024-13769: Missing Authorization

The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability check on the 'themeoptionsajaxpostaction' AJAX action in all versions up to, and including, 4.2.4. This makes it possible for...

Possible Log Injection in Rack::CommonLogger

Summary Rack::CommonLogger can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious content into logs. Details When a user provides the authorization credentials via Rack::Auth::Basic, if success,...

CVE-2025-1168: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in SourceCodester Contact Manager with Export to VCF 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /endpoint/delete-contact.php. The manipulation of the argument contact leads to sql injection. The attack can be initiated...

PT-2025-6142

Name of the Vulnerable Software and Affected Versions: SourceCodester Contact Manager with Export to VCF version 1.0 Description: A critical issue has been found in the SourceCodester Contact Manager with Export to VCF. The problem affects the /endpoint/delete-contact.php file, where the...

CVE-2025-23594

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Uzzal Mondal Google Map With Fancybox location-piker allows Reflected XSS.This issue affects Google Map With Fancybox: from n/a through = 2.1.0...