15861 matches found
CVE-2024-13697
The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.4 via the 'nicelinks'. This makes it possible for unauthenticated attackers to make web request...
CVE-2025-1852
A vulnerability has been found in Totolink EX1800T 9.1.0cu.2112B20220316 and classified as critical. This vulnerability affects the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to buffer overflow. The attack can be initiated remotely. The...
Real Estate Property Management System XSS
The vulnerability of the search.php script in the Real Estate Property Management System is related to the lack of measures taken to protect the web page structure when processing the PropertyName parameter. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting...
CVE-2025-22624
FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry and Carousel 2.4.29 was found to be vulnerable. The web application dynamically generates web content without validating the source of the potentially untrusted data in myapp/extensions/albums/admin/class-meta boxes.php...
MAL-2025-1643 Malicious code in web-pw-sample-app (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d6a6e13078b7457900b4b0b41c62e43e878b548e8fd51baf5f2e2d9c567e90a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2025-22624 FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry and Carousel 2.4.29 - Reflected cross-site scripting (XSS)
FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry and Carousel 2.4.29 was found to be vulnerable. The web application dynamically generates web content without validating the source of the potentially untrusted data in myapp/extensions/albums/admin/class-meta boxes.php...
BIG-IP IControl REST Command Execution
The vulnerability of the TMOS Shell configuration tool’s IControl REST interface exists due to the lack of measures to neutralize specific elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...
Plixer / Dell SonicWALL Scrutinizer < 9.0.1.19899 Multiple Vulnerabilities
Plixer / Dell SonicWALL Scrutinizer is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Plixer / Dell SonicWALL Scrutinizer < 19.2.2, 19.3.x < 19.3.2 Multiple Vulnerabilities
Plixer / Dell SonicWALL Scrutinizer is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
LY Corporation: Stored XSS via SVG Upload in chat.line.biz
An SVG file containing malicious JavaScript was uploaded to the web application without proper filtering or disabling of embedded scripts. When another user opened the malicious SVG file in the management interface, the embedded script was executed in the browser, resulting in a stored cross-site...
Leantime allows Stored Cross-Site Scripting (XSS)
Summary Stored XSS, also known as persistent XSS, is the more damaging of the two. It occurs when a malicious script is injected directly into a vulnerable web application. Details A Stored Cross-Site Scripting XSS vulnerability was found that could potentially compromise user data and pose a...
CVE-2025-22622
Age Verification for your checkout page. Verify your customer's identity 1.20.0 was found to be vulnerable. The web application dynamically generates web content without validating the source of the potentially untrusted data in myapp/class-wc-integration-agechecker-integration.php...
Dingfanzu injection vulnerability
dingfanzu is a php based takeaway ordering website by gk2007 individual developer. An injection vulnerability exists in dingfanzu 20250210 and earlier versions, which is caused by a SQL injection in the parameter shopId...
CVE-2025-1006
Use after free in Network in Google Chrome prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted web app. Chromium security severity: Medium...
CVE-2024-13538
The BigBuy Dropshipping Connector for WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0.0. This is due the /vendor/cocur/slugify/bin/generate-default.php file being directly accessible and triggering an error. This makes it possible f...
WordPress Yoast SEO Plugin < 2.1 XSS Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:yoast:yoastseo"; if description...
WordPress Yoast SEO Plugin < 2.2 XSS Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:yoast:yoastseo"; if description...
CVE-2025-1006
Use after free in Network in Google Chrome prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted web app. Chromium security severity: Medium...
CVE-2025-1006
A use after free vulnerability in the Network component of Google Chrome (prior to version 133.0.6943.126 ) allows a remote attacker to potentially exploit heap corruption via a crafted web application. This vulnerability affects the Chromium engine, as evidenced by its presence in related distri...