5411 matches found
CVE-2025-7644
The Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via URLs in all widgets in all versions up to, and including, 1.6.7 due to insufficient input...
CVE-2025-52580
The vulnerability CVE-2025-52580 affects the region PAY App for Android (Gift Pad Co., Ltd.) prior to version 1.5.28. Cause: insertion of sensitive information into log files (CWE-532). Impact: sensitive user data could be exposed to an attacker who gains access to application logs. Mitigation: u...
The vulnerability of the Behavioral DoS (BADoS) function of the BIG-IP Application Security Manager allows a attacker to cause a service failure.
The vulnerability of the Behavioral DoS BADoS function of the BIG-IP Application Security Manager protection tool is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...
GHSA-59G8-H59F-8HJP NodeJS version of HAX CMS Has Disabled Content Security Policy That Enables Cross-Site Scripting
Summary The NodeJS version of HAX CMS has a disabled Content Security Policy CSP. This configuration is insecure for a production application because it does not protect against cross-site-scripting attacks. Details The contentSecurityPolicy value is explicitly disabled in the application's Helme...
NodeJS version of HAX CMS Has Disabled Content Security Policy That Enables Cross-Site Scripting
Summary The NodeJS version of HAX CMS has a disabled Content Security Policy CSP. This configuration is insecure for a production application because it does not protect against cross-site-scripting attacks. Details The contentSecurityPolicy value is explicitly disabled in the application's Helme...
CVE-2025-24936
The web application allows user input to pass unfiltered to a command executed on the underlying operating system. The vulnerable component is bound to the network stack and the set of possible attackers extends up to and including the entire Internet. An attacker with low privileged access to th...
CVE-2025-43977
The com.skt.prod.dialer application through 12.5.0 for Android enables any installed application with no permissions to place phone calls without user interaction by sending a crafted intent via the com.skt.prod.dialer.activities.outgoingcall.OutgoingCallInternalBroadcaster component...
PHPGurukul Online Banquet Booking System 安全漏洞
Online Banquet Booking System is an online banquet booking system. A cross-site scripting vulnerability exists in Online Banquet Booking System, which originates from the failure to strictly filter the adminname parameter in the /admin/admin-profile.php file. An attacker can exploit this...
Exploit for Cross-site Scripting in Campcodes Online_Movie_Theater_Seat_Reservation_System
XSS Exploit for CVE-2025-7840 Author: Byte Reaper @ByteR...
CVE-2025-53934
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting XSS vulnerability was identified in the control.php endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers to inject...
XWiki < 15.10.16, 16.0.0-rc-1 < 16.4.7, 16.5.0-rc-1 < 16.10.2 Multiple Vulnerabilities
Xwiki is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki"; ifdescription...
Oracle GoldenGate for Big Data Multiple Vulnerabilities 23.x < 23.9.0.25.07 (July 2025 CPU)
According to its self-reported version number, the Oracle GoldenGate for Big Data application located on the remote host is affected by multiple vulnerabilities: - Vulnerability in the Oracle GoldenGate Big Data and Application Adapters product of Oracle GoldenGate component: Java Delivery Netty...
PT-2025-29815 · Unknown · Ezihosting Tennis Court Bookings
Name of the Vulnerable Software and Affected Versions: EZiHosting Tennis Court Bookings versions through 1.2.7 Description: The software contains a Reflected Cross-site Scripting XSS issue due to improper neutralization of input during web page generation. This allows an attacker to inject...
GHSA-6QJF-G333-PV38 Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class
Impact There is an arbitrary code execution vulnerability in the CsvEnumerator class of the job-iteration repository. This vulnerability can be exploited by an attacker to execute arbitrary commands on the system where the application is running, potentially leading to unauthorized access, data...
Why AppSec and CloudSec Belong Together in the Age of AI
AI accelerates development— and risk shouldn't be a blocker to innovation. Bridging AppSec and CloudSec with shared context and workflows is key to keeping up...
CVE-2025-6514
creationtimestamp| type| source ---|---|--- 2025-07-09 14:30:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ltjzp6d32j2y 2025-07-09 19:28:16+00:00| seen| https://bsky.app/profile/r-netsec-bot.bsky.social/post/3ltkke2mlwl2j 2025-07-09 19:30:45+00:00| seen|...
CVE-2025-7102
A vulnerability was found in BoyunCMS up to 1.4.20. It has been declared as critical. This vulnerability affects unknown code of the file application/update/controller/Server.php. The manipulation of the argument phone leads to sql injection. The attack can be initiated remotely. The exploit has...
CVE-2025-42966 Insecure Deserialization vulnerability in SAP NetWeaver (XML Data Archiving Service)
SAP NetWeaver XML Data Archiving Service allows an authenticated attacker with administrative privileges to exploit an insecure Java deserialization vulnerability by sending a specially crafted serialized Java object. This could lead to high impact on confidentiality, integrity, and availability ...
CVE-2025-42966 Insecure Deserialization vulnerability in SAP NetWeaver (XML Data Archiving Service)
SAP NetWeaver XML Data Archiving Service allows an authenticated attacker with administrative privileges to exploit an insecure Java deserialization vulnerability by sending a specially crafted serialized Java object. This could lead to high impact on confidentiality, integrity, and availability ...