CVE-2025-10018 Multiple Stored XSS in QuickCMS

QuickCMS is vulnerable to multiple Stored XSS in language editor functionality languages. Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed on every page. By default admin user is not able to add JavaScript into the website. Th...

EUVD-2025-197611

QuickCMS is vulnerable to multiple Stored XSS in language editor functionality languages. Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed on every page. By default admin user is not able to add JavaScript into the website. Th...

CVE-2025-10018 Multiple Stored XSS in QuickCMS

QuickCMS is vulnerable to multiple Stored XSS in language editor functionality languages. Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed on every page. By default admin user is not able to add JavaScript into the website. Th...

CVE-2025-10018

Summary (CVE-2025-10018) : QuickCMS is reported vulnerable to multiple Stored XSS in the language editor. Affected: version 6.8 (only this version was tested; other versions were not tested and may also be affected). Impact: an attacker with admin privileges can inject arbitrary HTML/JS, leading ...

PT-2025-46952

Name of the Vulnerable Software and Affected Versions QuickCMS version 6.8 QuickCMS affected versions not specified Description QuickCMS is susceptible to multiple Stored Cross-Site Scripting XSS issues within the language editor functionality, specifically in the 'languages' section. An attacker...

CVE-2025-12869

The a+HRD developed by aEnrich has a Stored Cross-Site Scripting vulnerability, allowing remote attackers with administrator privileges to inject persistent JavaScript codes that are executed in users' browsers upon page load...

CVE-2024-32014

A vulnerability has been identified in Spectrum Power 4 All versions V4.70 SP12 Update 2. The affected application is vulnerable to alter the local database which contains the application credentials. This allows an attacker to gain administrative application privileges...

CVE-2025-12869

The a+HRD developed by aEnrich has a Stored Cross-Site Scripting vulnerability, allowing remote attackers with administrator privileges to inject persistent JavaScript codes that are executed in users' browsers upon page load...

CVE-2025-12869

CVE-2025-12869 affects the a+HRD product by aEnrich. The issue is a Stored Cross-Site Scripting vulnerability that allows remote attackers with administrator privileges to inject persistent JavaScript executed in users’ browsers on page load. Documents consistently describe this as stored XSS in ...

CVE-2025-12018

MembershipWorks – Membership, Events & Directory (WordPress) versions up to and including 6.14 are affected by a stored cross-site scripting vulnerability in admin settings due to inadequate input sanitization and output escaping. Exploitation requires an authenticated attacker with administrator...

EUVD-2024-29852

A vulnerability has been identified in Spectrum Power 4 All versions V4.70 SP12 Update 2. The affected application is vulnerable to alter the local database which contains the application credentials. This allows an attacker to gain administrative application privileges...

EUVD-2025-74033

An improper access restriction to a folder in Bitdefender Endpoint Security Tools for Mac BEST before 7.20.52.200087 allows local users with administrative privileges to bypass the configured uninstall password protection. An unauthorized user with sudo privileges can manually remove the...

open-vm-tools: Insecure file handling

A vulnerability was found in open-vm-tools. A malicious actor with non-administrative privileges on a guest virtual machine VM may tamper with the local files to trigger insecure file operations within that VM...

CVE-2025-42883

Affected software: SAP NetWeaver Application Server for ABAP, Migration Workbench (DX Workbench). Vulnerability details: A code issue causes the Migration Workbench to fail to trigger a malware scan when a user with administrative privileges uploads files to the application server, allowing poten...

Advantech iView SQL Injection Vulnerability (CNVD-2025-31065)

Advantech iView is a software developed by Advantech for managing B+BSmartWorx series devices through a simple network management protocol. Advantech iView suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the ztpsearchvalue...

PT-2025-46247

Name of the Vulnerable Software and Affected Versions EasyCommerce – AI-Powered, Fast & Beautiful WordPress Ecommerce Plugin versions 0.9.0-beta2 through 1.5.0 Description The EasyCommerce plugin for WordPress has a flaw where the /easycommerce/v1/orders API endpoint does not adequately limit use...

PT-2025-46536

Name of the Vulnerable Software and Affected Versions Spectrum Power 4 versions prior to 4.70 SP12 Update 2 Description The application is susceptible to arbitrary command execution through the user interface. This interface is accessible over the network, enabling command execution with...

PT-2025-46350

Name of the Vulnerable Software and Affected Versions Avast Free Antivirus versions prior to 25.9 Description A collision in the MiniFilter driver within Avast Free Antivirus can allow a local attacker with administrative privileges to disable real-time protection and self-defense mechanisms. The...

Siemens Spectrum Power 安全漏洞

Siemens Spectrum Power is an energy management system from Siemens, Germany. A security vulnerability exists in Siemens Spectrum Power versions prior to V4.70 SP12 Update 2, which originates from application credentials that can be tampered with in a local database, potentially allowing an attack...

PT-2025-46537

Name of the Vulnerable Software and Affected Versions Spectrum Power versions prior to 4.70 SP12 Update 2 Description The application is susceptible to local database modification, potentially allowing an attacker to obtain administrative application privileges. Recommendations Update to version...