Zucchetti Ad Hoc Infinity 安全漏洞

Zucchetti Ad Hoc Infinity is an ERP software from Zucchetti. A security vulnerability exists in Zucchetti Ad Hoc Infinity 4.2 and earlier versions, which stems from an unvalidated pHtmlSource parameter that could lead to a cross-site scripting attack...

PT-2025-44444

Name of the Vulnerable Software and Affected Versions Zucchetti Ad Hoc Revolution versions 4.1 and earlier Description A cross-site scripting XSS issue exists in Zucchetti Ad Hoc Revolution. This allows attackers to inject arbitrary JavaScript code. The issue is present in the /ahrw/jsp/gsfr...

CVE-2025-52180

Cross-site scripting XSS vulnerability in Zucchetti Ad Hoc Infinity 4.2 and earlier allows remote unauthenticated attackers to inject arbitrary JavaScript via the pHtmlSource parameter of the /ahi/jsp/gsfrfeditorHTML.jsp?pHtmlSource endpoint...

CVE-2025-52179

CVE-2025-52179 is an XSS vulnerability in Zucchetti Ad Hoc Revolution 4.1 and earlier. It allows remote unauthenticated attackers to inject arbitrary JavaScript via the pHtmlSource parameter of the /ahrw/jsp/gsfr_feditorHTML.jsp endpoint. Affected software: Zucchetti Ad Hoc Revolution up to versi...

PT-2025-44447

Name of the Vulnerable Software and Affected Versions Zucchetti Ad Hoc Infinity versions prior to 4.2 Description A cross-site scripting issue exists in Zucchetti Ad Hoc Infinity. This allows attackers to inject arbitrary JavaScript code. The issue is present in the /ahi/jsp/gsfr feditorHTML.jsp...

Zucchetti Ad Hoc Revolution 安全漏洞

Zucchetti Ad Hoc Revolution is a business data processing system from Zucchetti, Italy. A security vulnerability exists in Zucchetti Ad Hoc Revolution 4.1 and earlier versions, which stems from an unvalidated pHtmlSource parameter that could lead to a cross-site scripting attack...

CVE-2025-52180

Cross-site scripting XSS vulnerability in Zucchetti Ad Hoc Infinity 4.2 and earlier allows remote unauthenticated attackers to inject arbitrary JavaScript via the pHtmlSource parameter of the /ahi/jsp/gsfrfeditorHTML.jsp?pHtmlSource endpoint...

CVE-2025-52180

Summary: CVE-2025-52180 is a cross-site scripting (XSS) flaw in Zucchetti Ad Hoc Infinity 4.2 and earlier. The issue arises from an unvalidated pHtmlSource parameter at the endpoint /ahi/jsp/gsfr_feditorHTML.jsp?pHtmlSource, enabling remote, unauthenticated attackers to inject arbitrary JavaScrip...

CVE-2025-11834

The WP AD Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'startindex' parameter of the ad-gallery shortcode in all versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2025-11827

The Oboxmedia Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'beforewidget' and 'afterwidget' parameters of the oboxads-ad-widget shortcode in all versions up to, and including, 1.9.8. This is due to insufficient input sanitization and output escaping. This makes it...

CVE-2025-11834 WP AD Gallery <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WP AD Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'startindex' parameter of the ad-gallery shortcode in all versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2025-11834

The CVE CVE-2025-11834 (WP AD Gallery) affects WordPress WP AD Gallery plugin versions ≤ 1.3, with stored XSS via the startindex parameter in the ad-gallery shortcode. Root cause: insufficient input sanitization and output escaping; authenticated attackers with contributor-level access can inject...

EUVD-2025-35326

The WP AD Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'startindex' parameter of the ad-gallery shortcode in all versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

WordPress plugin WP AD Gallery 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2017-20202

Web Developer for Chrome v0.4.9 contained malicious code that generated a domain via a DGA and fetched a remote script. The fetched script conditionally loaded follow-on modules that performed extensive ad substitution and malvertising, displayed fake “repair” alerts that redirected users to...

DEBIAN-CVE-2025-11561

A flaw was found in the integration of Active Directory and the System Security Services Daemon SSSD on Linux systems. In default configurations, the Kerberos local authentication plugin sssdkrb5localauthplugin is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an...

CVE-2025-11561 Sssd: sssd default kerberos configuration allows privilege escalation on ad-joined linux systems

A flaw was found in the integration of Active Directory and the System Security Services Daemon SSSD on Linux systems. In default configurations, the Kerberos local authentication plugin sssdkrb5localauthplugin is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an...

CVE-2017-20202

Web Developer for Chrome v0.4.9 contained malicious code that generated a domain via a DGA and fetched a remote script. The fetched script conditionally loaded follow-on modules that performed extensive ad substitution and malvertising, displayed fake “repair” alerts that redirected users to...

EUVD-2025-33277

Web Developer for Chrome v0.4.9 contained malicious code that generated a domain via a DGA and fetched a remote script. The fetched script conditionally loaded follow-on modules that performed extensive ad substitution and malvertising, displayed fake “repair” alerts that redirected users to...

CVE-2017-20202 Web Developer for Chrome v0.4.9 Malicious Backdoor Supply Chain Compromise

Web Developer for Chrome v0.4.9 contained malicious code that generated a domain via a DGA and fetched a remote script. The fetched script conditionally loaded follow-on modules that performed extensive ad substitution and malvertising, displayed fake “repair” alerts that redirected users to...