CVE-2024-10239

CVE-2024-10239 concerns a stack overflow in the firmware image verification of the Supermicro MBD-X12DPG-OA6. The issue arises from an unchecked fat->fsd.max_fld in the image verification path, allowing an administrator-controlled upload of a crafted image to potentially trigger the overflow. ...

Dell PowerProtect Data Domain security vulnerabilities

Dell PowerProtect Data Domain Dell PowerProtect DD is a suite of hardware appliances for data protection, backup, storage, and deduplication from Dell, USA. A security vulnerability exists in Dell PowerProtect Data Domain. An attacker exploiting the vulnerability could tamper with information...

CVE-2024-13114: Improper Neutralization of Input During Web Page Generation

The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13115: Cross-Site Request Forgery (CSRF)

The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2025-23594

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Uzzal Mondal Google Map With Fancybox location-piker allows Reflected XSS.This issue affects Google Map With Fancybox: from n/a through = 2.1.0...

CVE-2025-23594 WordPress Google Map With Fancybox plugin <= 2.1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Uzzal Mondal Google Map With Fancybox location-piker allows Reflected XSS.This issue affects Google Map With Fancybox: from n/a through = 2.1.0...

CVE-2025-23594

CVE-2025-23594 is a reflected XSS in WordPress Google Map With Fancybox plugin (versions up to and including 2.1.0) caused by improper neutralization of inputs during web page generation. Public sources (NVD/Red Hat/CVE records) confirm the issue affects Google Map With Fancybox

Malicious code in sample-nodejs-vsk-with-adm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 268548cd4032a80297c2f7fd9c2e1171027f9ecf4fabcb35debfb7c1fbc0cc13 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE-SU-2025:20012-1 Security update for libvirt

This update for libvirt fixes the following issues: Security issue fixed: - CVE-2024-4418: rpc: ensure temporary GSource is removed from client event loop bsc1223849 Non-security issue fixed: - libxl: Fix domxml-to-native conversion bsc1222584 - qemu: Fix migration with custom XML bsc1226492...

IBM OpenPages XSS

The vulnerability of the web interface of IBM OpenPages and IBM OpenPages with Watson relates to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks and gain unauthorized access to protected...

PT-2025-4961 · Unknown · Google Map With Fancybox

Name of the Vulnerable Software and Affected Versions: Google Map With Fancybox versions prior to 2.1.0 Description: The issue is related to improper neutralization of input during web page generation, which allows for Cross-site Scripting XSS. Specifically, it enables Reflected XSS...

CVE-2025-23594: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Uzzal Mondal Google Map With Fancybox location-piker allows Reflected XSS.This issue affects Google Map With Fancybox: from n/a through = 2.1.0...

CVE-2024-13612

The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bettermessageslivechatbutton' shortcode in all versions up to, and including, 2.6.9 due to insufficient input...

CVE-2024-12041: Exposure of Private Personal Information to an Unauthorized Actor

The Directorist: AI-Powered WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 8.0.12 via the /wp-json/directorist/v1/users/ endpoint. This makes it possible for unauthenticated attacker...

PT-2025-1733

Name of the Vulnerable Software and Affected Versions The Directorist: AI-Powered WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress versions up to, and including, 8.0.12 Description The issue allows unauthenticated attackers to extract sensitive data, including...

Malicious code in skulldentist (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

CVE-2025-24686: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Reflected XSS.This issue affects RegistrationMagic: from n/a through = 6.0.3.3...

MAL-2025-677 Malicious code in old-celo-base (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d16d8623e169f195cbb3deeebd0e37b8e6ddd13cfdd5a9b2ece072f3e0170a1b Any computer that has this package installed or running should be considered...

CVE-2024-13470: Improper Neutralization of Input During Web Page Generation

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 3.8.24 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

CVE-2024-13758: Cross-Site Request Forgery (CSRF)

The CP Contact Form with PayPal plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.52. This is due to missing or incorrect nonce validation on the cpcontactformpaypalcheckinitactions function. This makes it possible for unauthenticated...