MAL-2025-352 Malicious code in no-style-dependency (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9044d80b8ff33b0d2a50511386c0fed003004f9452211938b949aca211b0866 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-324 Malicious code in built-with-workers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f426ea9ad545f39f1e84cd26ee384b096d08c2b82f8b3554f97fc1ce85fac83 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in built-with-workers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f426ea9ad545f39f1e84cd26ee384b096d08c2b82f8b3554f97fc1ce85fac83 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-23509: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in siteheart HyperComments comments-with-hypercommentscom allows Reflected XSS.This issue affects HyperComments: from n/a through = 0.9.6...

CVE-2025-22661: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in vcita Online Payments – Get Paid with PayPal, Square & Stripe paypal-payment-button-by-vcita allows Stored XSS.This issue affects Online Payments – Get Paid with PayPal, Square & Stripe: from n/a...

CVE-2025-22723: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type vulnerability in Dmitry V. CEO of "UKR Solution" Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders allows Upload a Web Shell to a Web Server.This issue affects Barcode Scanner with...

WordPress Apply with LinkedIn buttons plugin <= 2.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO in WordPress Plugin Apply with LinkedIn buttons versions = 2.3...

WordPress Sale with Razorpay plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by thiennv in WordPress Plugin Sale with Razorpay versions = 1.0...

CVE-2025-23897: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ivobrett Apply with LinkedIn buttons apply-with-linkedin-buttons allows DOM-Based XSS.This issue affects Apply with LinkedIn buttons: from n/a through = 2.3...

WordPress plugin “Apply with LinkedIn buttons” has a cross-site request forgeing vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

Mattermost Mobile Apps Security Vulnerabilities

Mattermost Mobile Apps is a messaging mobile application from Mattermost USA. A security vulnerability exists in Mattermost Mobile Apps version 2.22.0 that stems from an inability to properly handle posts with attachments, allowing an attacker to cause a mobile device to crash by creating such a...

CVE-2025-23804: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Shiv Prakash Tiwari WP Service Payment Form With Authorize.net wp-service-payment-form-with-authorizenet allows Reflected XSS.This issue affects WP Service Payment Form With Authorize.net: from n/a through = 2.6.0...

PT-2025-5181

Name of the Vulnerable Software and Affected Versions Apply with LinkedIn buttons versions prior to 2.3 Description The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

CVE-2025-23452: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in EditionGuard EditionGuard for WooCommerce – eBook Sales with DRM editionguard-for-woocommerce-ebook-sales-with-drm allows Reflected XSS.This issue affects EditionGuard for WooCommerce – eBook Sales...

CVE-2025-23898: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in ivobrett Apply with LinkedIn buttons apply-with-linkedin-buttons allows Stored XSS.This issue affects Apply with LinkedIn buttons: from n/a through = 2.3...

CVE-2024-57901

In the Linux kernel, the following vulnerability has been resolved: afpacket: fix vlangetprotocoldgram vs MSGPEEK Blamed commit forgot MSGPEEK case, allowing a crash 1 as found by syzbot. Rework vlangetprotocoldgram to not touch skb at all, so that it can be used from many cpus on the same skb. A...

WordPress Contact Form With Shortcode plugin <= 4.2.5 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Le Ngoc Anh Patchstack Alliance in WordPress Plugin Contact Form With Shortcode versions = 4.2.5...

askdoc (0.1.1), chat-with-mlx (>=0.1.6, <=0.1.11) +1 more potentially affected by CVE-2025-23042 via gradio (4.19.2)

gradio PYPI version 4.19.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - askdoc 0.1.1 - chat-with-mlx =0.1.6, =0.1.11 - hugegraph-llm 1.3.0 Source cves: CVE-2025-23042 Source advisory: OSV:PYSEC-2025-118...

chat-with-mlx (>=0.1.0, <=0.1.5), megatts (3.0.0) potentially affected by CVE-2025-23042 via gradio (4.19.1)

gradio PYPI version 4.19.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - chat-with-mlx =0.1.0, =0.1.5 - megatts 3.0.0 Source cves: CVE-2025-23042 Source advisory: OSV:PYSEC-2025-118...

chat-with-mlx (>=0.1.0, <=0.1.5), megatts (3.0.0) potentially affected by CVE-2025-23042 via gradio (4.19.1)

gradio PYPI version 4.19.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - chat-with-mlx =0.1.0, =0.1.5 - megatts 3.0.0 Source cves: CVE-2025-23042 Source advisory: OSV:GHSA-J2JG-FQ62-7C3H...