EUVD-2025-31071

Malicious code in bioql PyPI...

EUVD-2025-32225

Malicious code in bioql PyPI...

EUVD-2025-27170

Malicious code in bioql PyPI...

EUVD-2024-49451

Malicious code in bioql PyPI...

EUVD-2025-27471

Malicious code in bioql PyPI...

EUVD-2025-23893

Malicious code in bioql PyPI...

PT-2025-40460

Name of the Vulnerable Software and Affected Versions Emlog versions 2.5.21 and below Description Emlog is a website building system. A flaw exists where a malicious payload can be saved through the mail template settings, leading to stored cross-site scripting XSS. When an attacker saves malicio...

CVE-2025-59525

Horilla HRMS prior to 1.4.0 is vulnerable to Cross-Site Scripting (XSS) via uploaded SVG files (and via allowed embed/ tags), enabling script execution when affected content (e.g., announcements) is viewed and potentially leading to an admin account takeover. The issue stems from improper sanitiz...

CVE-2025-59525 Horilla has Improper Input Sanitization Leading to XSS and Admin Account Takeover

Horilla is a free and open source Human Resource Management System HRMS. Prior to version 1.4.0, improper sanitization across the application allows XSS via uploaded SVG and via allowed , which can be chained to execute JavaScript whenever users view impacted content e.g., announcements. This can...

CVE-2025-59525 Horilla has Improper Input Sanitization Leading to XSS and Admin Account Takeover

Horilla is a free and open source Human Resource Management System HRMS. Prior to version 1.4.0, improper sanitization across the application allows XSS via uploaded SVG and via allowed , which can be chained to execute JavaScript whenever users view impacted content e.g., announcements. This can...

CVE-2025-59525 Horilla has Improper Input Sanitization Leading to XSS and Admin Account Takeover

Horilla is a free and open source Human Resource Management System HRMS. Prior to version 1.4.0, improper sanitization across the application allows XSS via uploaded SVG and via allowed , which can be chained to execute JavaScript whenever users view impacted content e.g., announcements. This can...

Horilla 代码问题漏洞

Horilla is a free and open source human resources software from Horilla, Inc. A code issue vulnerability exists in Horilla versions prior to 1.4.0 that stems from improper cleanup in the application, which could lead to a cross-site scripting attack that could lead to an administrator account...

PT-2025-39325

Name of the Vulnerable Software and Affected Versions Horilla versions prior to 1.4.0 Description Horilla is a Human Resource Management System HRMS. Improper sanitization within the application allows for Cross-Site Scripting XSS through uploaded SVG files and allowed tags. This can lead to the...

CVE-2025-5948

The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0. This is due to the plugin not properly validating a user's identity prior to claiming a business when using the claimbusiness AJAX action. This...

CVE-2025-5948

The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0. This is due to the plugin not properly validating a user's identity prior to claiming a business when using the claimbusiness AJAX action. This...

CVE-2025-58761

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The realpmsimageproxy endpoint in Tautulli v2.15.3 and prior is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. The realpmsimageproxy i...

CVE-2025-9114

The Doccure theme for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.5.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticat...

Linux Distros Unpatched Vulnerability : CVE-2021-25955

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Dolibarr ERP CRM, WYSIWYG Editor module, v2.8.1 to v13.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to store...

CVE-2025-58760 Tautulli vulnerable to Unauthenticated Path Traversal in `/image` endpoint

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The /image API endpoint in Tautulli v2.15.3 and earlier is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. In Tautulli, the /image API...

CVE-2025-58430

CVE-2025-58430 affects listmonk (up to version 1.1.0). The vulnerability arises because each HTTP request includes a nonce in addition to the session cookie, and the nonce value is not checked/validated by the backend, enabling request forgery. When chained with other flaws (CSRF and XSS), this c...