CVE-2025-47481 WordPress GS Testimonial Slider plugin <= 3.2.9 - Content Injection vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in GS Plugins GS Testimonial Slider gs-testimonial allows Code Injection.This issue affects GS Testimonial Slider: from n/a through = 3.2.9...

CVE-2025-4261

A vulnerability was found in GAIR-NLP factool up to 3f3914bc090b644be044b7e0005113c135d8b20f. It has been classified as critical. This affects the function runsingle of the file factool/factool/math/tool.py. The manipulation leads to code injection. The attack needs to be approached locally. The...

CVE-2025-35939

Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at...

WordPress plugin Ultimate Member 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code injection vulnerability exists in...

WordPress plugin GS Testimonial Slider 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code injection...

CVE-2025-45388

CVE-2025-45388 (Wagtail CMS 6.4.1) : A Stored Cross-Site Scripting (XSS) flaw exists in the document upload feature. Attackers can embed malicious payloads in a PDF; when a user clicks the uploaded document in the CMS interface, the payload can execute. The supplier disputes exploitability, notin...

Moodle Code Injection Vulnerability

Moodle is Moodle open source set of free e-learning software platform, also known as course management system, learning management system or virtual learning environment. Moodle suffers from a code injection vulnerability that originates from a security issue in the Moodle LMS EQUELLA repository...

q2apro-on-site-notifications 代码注入漏洞

q2apro-on-site-notifications is a plugin for q2apro individual developers that replaces all email notifications for forums. A code injection vulnerability exists in q2apro-on-site-notifications version 1.4.6 and earlier, which stems from improper handling of the processrequest function in the fil...

RockyLinux 9 : libssh (RLSA-2024:2504)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:2504 advisory. libssh: ProxyCommand/ProxyJump features allow injection of malicious code through hostname CVE-2023-6004 libssh: Missing checks for return values for...

PT-2025-20108 · Unknown · Testimonial Slider

Name of the Vulnerable Software and Affected Versions: GS Testimonial Slider versions 3.2.9 and earlier Description: The issue is related to an Improper Control of Generation of Code 'Code Injection' vulnerability, which allows Code Injection in GS Testimonial Slider. Recommendations: For GS...

Moodle Code Injection Vulnerability (CNVD-2025-10583)

Moodle is Moodle open source set of free e-learning software platform, also known as course management system, learning management system or virtual learning environment. Moodle suffers from a code injection vulnerability that stems from a security issue in the Moodle LMS Dropbox repository that...

PT-2025-20230 · Unknown · Ultimate Member

Name of the Vulnerable Software and Affected Versions: Ultimate Member versions through 2.10.3 Description: The issue is related to an Improper Control of Generation of Code, also known as 'Code Injection'. This allows for Code Injection in Ultimate Member. Recommendations: For versions through...

Code Injection

org.apereo.cas:cas-management-webapp-support is vulnerable to Code Injection. The vulnerability is due to improper input handling due to unsanitized Groovy code execution in the saveService function, which allows remote attackers to inject and execute arbitrary code...

MRCMS 代码注入漏洞

MRCMS is a content management system by marker personal developer. A code injection vulnerability exists in MRCMS version 3.1.2, which originates from improper manipulation of the file /admin/chip/add.do in the component Add Fragment Page, which could lead to a cross-site scripting attack...

MRCMS 代码注入漏洞

MRCMS is a content management system by marker personal developer. A code injection vulnerability exists in MRCMS version 3.1.2, which stems from improper manipulation of the parameter Title in the component Edit Article Page, which could lead to a cross-site scripting attack...

WordPress plugin LayoutBoxx 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code injection...

MRCMS 代码注入漏洞

MRCMS is a content management system by the individual developer of marker. A code injection vulnerability exists in MRCMS version 3.1.2, which stems from the improper handling of the parameter Name in the file /admin/category/add.do in the component Category Management Page, which could lead to ...

MRCMS 代码注入漏洞

MRCMS is a content management system by the individual developer of marker. A code injection vulnerability exists in MRCMS version 3.1.2, which stems from improper manipulation of the file /admin/link/edit.do in the component External Link Management Page, which could lead to a cross-site scripti...

CVE-2025-46719

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.6, a vulnerability in the way certain html tags in chat messages are rendered allows attackers to inject JavaScript code into a chat transcript. The JavaScript code will be...

CVE-2025-43845

Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to code injection. The ckptpath2 variable takes user input e.g. a path to a model and passes it to changeinfo function, which opens and reads the file on the given path...