CVE-2025-28893 WordPress Visual Text Editor plugin <= 1.2.1 - Remote Code Execution (RCE) vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in Govind Visual Text Editor visual-text-editor allows Remote Code Inclusion.This issue affects Visual Text Editor: from n/a through = 1.2.1...

CVE-2025-30615

Cross-Site Request Forgery CSRF vulnerability in Jacob Schwartz WP e-Commerce Style Email wp-e-commerce-style-email allows Code Injection.This issue affects WP e-Commerce Style Email: from n/a through = 0.6.2...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for November 2023.

Summary Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation 21.0.3-IF027 and 23.0.1-IF005. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2023-46158 DESCRIPTION: IBM WebSphere Application Server...

WordPress plugin Visual Text Editor 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code injection...

Gitlab -- Vulnerabilities

Gitlab reports: Cross-site Scripting XSS through merge-request error messages Cross-site Scripting XSS through improper rendering of certain file types Admin Privileges Persists After Role is Revoked External user can access internal projects Prompt injection in Amazon Q integration may allow...

Mattermost Desktop App Permission Misconfiguration Vulnerability

Mattermost Desktop App is a cross-platform desktop collaboration tool based on the Electron framework, supporting Windows, macOS and Linux systems, designed for team collaboration. A privilege misconfiguration vulnerability exists in Mattermost Desktop App. The vulnerability stems from declaring...

Alfasado PowerCMS 注入漏洞

Alfasado PowerCMS is a content management system CMS from Alfasado Japan. Alfasado PowerCMS suffers from an injection vulnerability that originates from an attacker who may be able to exploit the vulnerability to obtain sensitive information or perform malicious actions by injecting special...

GHSA-5565-3C98-G6JC WildFly Elytron OpenID Connect Client ExtensionOIDC authorization code injection attack

Impact A vulnerability was found in OIDC-Client. When using the elytron-oidc-client subsystem with WildFly, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim's identity. This is...

WildFly Elytron OpenID Connect Client ExtensionOIDC authorization code injection attack

Impact A vulnerability was found in OIDC-Client. When using the elytron-oidc-client subsystem with WildFly, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim's identity. This is...

fprime-ci (0.0.1a1), fprime-fpy (>=0.0.1a1, <=0.3.2) +1 more potentially affected by CVE-2024-55029 via fprime-gds (>=4.2.1, <=4.2.2a4)

fprime-gds PYPI version =4.2.1, =0.0.1a1, =0.1.0, =0.1.5 Source cves: CVE-2024-55029 Source advisory: SNYK:PYTHON-FPRIMEGDS-9749311...

CVE-2025-30091

In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command. This vulnerability allows unauthenticated attackers to inject and execute arbitrary code. Attacker-controlled data to InstallCommand can be inserted into config.php, and InstallCommand is available...

CVE-2025-27631

The TRMTracker web application is vulnerable to LDAP injection attack potentially allowing an attacker to inject code into a query and execute remote commands that can read and update data on the website...

CVE-2025-27633

The TRMTracker web application is vulnerable to reflected Cross-site scripting attack. The application allows client-side code injection that might be used to compromise the confidentiality and integrity of the system...

CVE-2025-27633

The TRMTracker web application is vulnerable to reflected Cross-site scripting attack. The application allows client-side code injection that might be used to compromise the confidentiality and integrity of the system...

CVE-2025-27633

Summary: CVE-2025-27633 affects the Hitachi Energy TRMTracker web application, with a reflected cross-site scripting (XSS) vulnerability due to client-side code injection. The issue could compromise confidentiality and integrity and is described across multiple sources as a reflected XSS risk. CV...

Exploit for Code Injection in Foxcms

CVE-2025-29306 FOXCMS Qianhu Content Management System Servi...

CVE-2024-10208

An Improper Neutralization of Input During Web Page Generation vulnerability in the APROL Web Portal used in B&R APROL 4.4-00P5 may allow an authenticated network-based attacker to insert malicious code which is then executed in the context of the user’s browser session...

CVE-2024-45480

An improper control of generation of code 'Code Injection' vulnerability in the AprolCreateReport component of B&R APROL 4.4-00P5 may allow an unauthenticated network-based attacker to read files from the local system...

CVE-2024-45480 Unauthorized local file reading in B&R APROL

An improper control of generation of code 'Code Injection' vulnerability in the AprolCreateReport component of B&R APROL 4.4-00P5 may allow an unauthenticated network-based attacker to read files from the local system...

CVE-2024-45480 Unauthorized local file reading in B&R APROL

An improper control of generation of code 'Code Injection' vulnerability in the AprolCreateReport component of B&R APROL 4.4-00P5 may allow an unauthenticated network-based attacker to read files from the local system...