EUVD-2014-2617

Malware in sbrugna...

EUVD-2014-1593

Malware in sbrugna...

EUVD-2013-3363

Malware in sbrugna...

EUVD-2018-11344

Malware in sbrugna...

EUVD-2014-2166

Malware in sbrugna...

EUVD-2020-13018

Malware in sbrugna...

EUVD-2014-0461

Malware in sbrugna...

EUVD-2020-19971

Malware in sbrugna...

EUVD-2019-5198

Malware in sbrugna...

EUVD-2016-2545

Malware in sbrugna...

EUVD-2020-2827

Malware in sbrugna...

Authenticated SQL Injection on CLI functionality in Guardian/CMC before 25.3.0

Summary A SQL Injection vulnerability was discovered in the CLI functionality due to improper validation of an input parameter. Impact An authenticated user with limited privileges can execute arbitrary SELECT SQL statements on the DBMS used by the web application, potentially exposing unauthoriz...

Authenticated SQL Injection on Alert functionality in Guardian/CMC before 25.2.0

Summary A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. Impact An authenticated user with limited privileges can execute arbitrary SQL statements on the DBMS used by the web application, potentially exposing unauthorized...

(0Day) Ivanti Endpoint Manager DBDR SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Endpoint Manager. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the DBDR class. The issue results from the lack of proper...

CVE-2025-61687 FlowiseAI/Flosise has File Upload vulnerability

Flowise is a drag & drop user interface to build a customized large language model flow. A file upload vulnerability in version 3.0.7 of FlowiseAI allows authenticated users to upload arbitrary files without proper validation. This enables attackers to persistently store malicious Node.js web...

CVE-2024-56804

An SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.4 and later...

CVE-2025-56382

The CVE-2025-56382 entry describes a stored XSS in LionCoders SalePro POS 5.4.8, specifically in the Customer Management Module. An authenticated user can inject script or HTML via the 'Customer Name' field when creating or editing a customer profile. The input is not properly sanitized before st...

CVE-2025-9030

The Majestic Before After Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'beforelabel' and 'afterlabel' parameters in versions less than, or equal to, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2025-10165

The AP Background plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advparallaxback' shortcode in all versions up to, and including, 3.8.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-9080

The Generic Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widget fields in version 1.2.8 and earlier. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with...