CVE-2025-4587 A/B Testing for WordPress <= 1.18.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The A/B Testing for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ab-testing-for-wp/ab-test-block' block in all versions up to, and including, 1.18.2 due to insufficient input sanitization and output escaping on the 'id' parameter. This makes it...

Malicious code in kwp-a-b-testing (npm)

The package communicates with a domain associated with malicious activity...

Drupal CKEditor5 Youtube module < 1.0.4 - Unauthenticated Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS vulnerability discovered by nico.b in WordPress Module CKEditor5 Youtube versions 1.0.4...

CVE-2025-36519

Unrestricted upload of file with dangerous type issue exists in WRC-2533GST2, WRC-1167GST2, WRC-2533GST2, WRC-2533GS2V-B,WRC-2533GS2-B v1.69 and earlier, WRC-2533GS2-W, WRC-1167GST2, WRC-1167GS2-B, and WRC-1167GS2H-B. If a specially crafted file is uploaded by a remote authenticated attacker,...

CVE-2025-6468

creationtimestamp| type| source ---|---|--- 2025-06-22 07:45:07+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19153 2025-06-22 09:02:03+00:00| published-proof-of-concept| Telegram/npQB2XGYJLggY75iX9SGcA2hXnwLNHfq2RVdmmYAHmjOw 2025-06-22 12:23:54+00:00| seen|...

B&R Automation Runtime Missing Release of Memory after Effective Lifetime (CVE-2020-11637)

A memory leak in the TFTP service in B&R Automation Runtime versions N4.26, N4.34, F4.45, E4.53, D4.63, A4.73 and prior could allow an unauthenticated attacker with network access to cause a denial of service DoS condition. This plugin only works with Tenable.ot. Please visit...

B&R Automation Studio and Automation Runtime Improper Authorization (CVE-2019-19108)

An authentication weakness in the SNMP service in B&R Automation Runtime versions 2.96, 3.00, 3.01, 3.06 to 3.10, 4.00 to 4.63, 4.72 and above allows unauthenticated users to modify the configuration of B&R products via SNMP. This plugin only works with Tenable.ot. Please visit...

B&R Automation Runtime Use of a Cryptographic Primitive with a Risky Implementation (CVE-2024-0323)

The FTP server used on the B&R Automation Runtime supports unsecure encryption mechanisms, such as SSLv3, TLSv1.0 and TLS1.1. An network- based attacker can exploit the flaws to conduct man-in-the-middle attacks or to decrypt communications between the affected product clients. This plugin only...

B&R Automation Runtime Allocation of Resources Without Limits or Throttling (CVE-2023-3242)

Improper initialization implementation in Portmapper used in B&R Industrial Automation Automation Runtime G4.93 allows unauthenticated network-based attackers to cause permanent denial-of-service conditions. This plugin only works with Tenable.ot. Please visit...

B&R Automation Runtime Improper Neutralization of Input During Web Page Generation (CVE-2023-6028)

A reflected cross-site scripting XSS vulnerability exists in the SVG version of System Diagnostics Manager of B&R Automation Runtime versions = G4.93 that enables a remote attacker to execute arbitrary JavaScript code in the context of the attacked user's browser session. This plugin only works...

B&R Automation Runtime Use of a Broken or Risky Cryptographic Algorithm (CVE-2024-8603)

B&R Automation Runtime and B&R mapp View generates self-signed certificates during the boot-up process if no certificates have been configured in the B&R Automation Studio project. These certificates are signed using an algorithm, which is no longer considered to be secure. This plugin only works...

B&R Systems Diagnostics Manager Improper Neutralization of Input During Web Page Generation (CVE-2022-4286)

A reflected cross-site scripting XSS vulnerability exists in System Diagnostics Manager of B&R Automation Runtime versions =3.00 and =3.00 and =C4.93 that enables a remote attacker to execute arbitrary JavaScript in the context of the users browser session. This plugin only works with Tenable.ot...

BRAutomation Runtime Buffer Copy without Checking Size of Input (CVE-2021-22275)

Buffer Overflow vulnerability in B&R Automation Runtime webserver allows an unauthenticated network-based attacker to stop the cyclic program on the device and cause a denial of service. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

PT-2025-24052 · B. Braun · B. Braun Onlinesuite

Name of the Vulnerable Software and Affected Versions: B.Braun OnlineSuite versions prior to AP 3.0 Description: A predefined administrative account is not documented and cannot be deactivated. This account cannot be misused from the network, only by local users on the server. The issue affects t...

CVE-2025-23100

creationtimestamp| type| source ---|---|--- 2025-06-03 21:36:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqqaqaxmy32a...

CVE-2024-30432

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bPlugins B Slider - Slider for your block editor allows Stored XSS.This issue affects B Slider - Slider for your block editor: from n/a through 1.1.12...

CVE-2024-30973

An issue in V-SOL G/EPON ONU HG323AC-B with firmware version V2.0.08-210715 allows an attacker to execute arbtirary code and obtain sensitive information via crafted POST request to /boaform/getASPdata/formFirewall, /boaform/getASPdata/formAcc...

CVE-2024-11880

The B Testimonial – testimonial plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'btestimonial' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes ...

CVE-2024-46669

An Integer Overflow or Wraparound vulnerability CWE-190 in version 7.4.4 and below, version 7.2.10 and below; FortiSASE version 23.4.b FortiOS tenant IPsec IKE service may allow an authenticated attacker to crash the IPsec tunnel via crafted requests, resulting in potential denial of service...

CVE-2023-6028

A reflected cross-site scripting XSS vulnerability exists in the SVG version of System Diagnostics Manager of B Automation Runtime versions = G4.93 that enables a remote attacker to execute arbitrary JavaScript code in the context of the attacked user’s browser session...