132 matches found
WordPress Popover Windows plugin <= 1.2 - Missing Authorization to Authenticated (Subscriber+) Popover Configuration Update via AJAX Actions vulnerability
Missing Authorization to Authenticated Subscriber+ Popover Configuration Update via AJAX Actions vulnerability discovered by dayea song - Ahnlab in WordPress Plugin Popover Windows versions = 1.2...
phpMyFAQ < 4.0.14 SQLi Vulnerability (GHSA-fxm2-cmwj-qvx4)
phpMyFAQ is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:phpmyfaq:phpmyfaq"; if...
phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality
Summary An authenticated SQL injection vulnerability in the main configuration update functionality of phpMyFAQ v4.0.13 and prior allows a privileged user with 'Configuration Edit' permissions to execute arbitrary SQL commands. Successful exploitation can lead to a full compromise of the database...
GHSA-FXM2-CMWJ-QVX4 phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality
Summary An authenticated SQL injection vulnerability in the main configuration update functionality of phpMyFAQ v4.0.13 and prior allows a privileged user with 'Configuration Edit' permissions to execute arbitrary SQL commands. Successful exploitation can lead to a full compromise of the database...
CVE-2025-62519
phpMyFAQ is an open source FAQ web application. Prior to version 4.0.14, an authenticated SQL injection vulnerability in the main configuration update functionality of phpMyFAQ allows a privileged user with 'Configuration Edit' permissions to execute arbitrary SQL commands. Successful exploitatio...
CVE-2025-62519 phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality
phpMyFAQ is an open source FAQ web application. Prior to version 4.0.14, an authenticated SQL injection vulnerability in the main configuration update functionality of phpMyFAQ allows a privileged user with 'Configuration Edit' permissions to execute arbitrary SQL commands. Successful exploitatio...
CVE-2025-62519
Summary: CVE-2025-62519 affects phpMyFAQ prior to 4.0.14, where an authenticated attacker with Configuration Edit permissions can exploit an SQL injection in the configuration update flow. The vulnerability stems from unsafely using user-supplied form keys as SQL identifiers in the update path (C...
CVE-2025-62519 phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality
phpMyFAQ is an open source FAQ web application. Prior to version 4.0.14, an authenticated SQL injection vulnerability in the main configuration update functionality of phpMyFAQ allows a privileged user with 'Configuration Edit' permissions to execute arbitrary SQL commands. Successful exploitatio...
CVE-2025-62519 phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality
phpMyFAQ is an open source FAQ web application. Prior to version 4.0.14, an authenticated SQL injection vulnerability in the main configuration update functionality of phpMyFAQ allows a privileged user with 'Configuration Edit' permissions to execute arbitrary SQL commands. Successful exploitatio...
PT-2025-47176
Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.0.14 Description phpMyFAQ is an open source FAQ web application. A privileged user with 'Configuration Edit' permissions can execute arbitrary SQL commands due to an authenticated SQL injection flaw in the main...
MAL-2025-68733 Malicious code in human-indigo-vicuna (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36c119599ba1e6ee1246e51d7459424f5c002d8cc3247086d98f44a01d8c8f0d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
CVE-2025-34310 IPFire < v2.29 Stored XSS via Quality of Service (QoS) Settings
IPFire versions prior to 2.29 Core Update 198 contain a stored cross-site scripting XSS vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the INCSPD, OUTSPD, DEFCLASSINC, and DEFCLASSOUT parameters when updating Quality of Service QoS settings. When a...
Rockwell Automation Comms-1783-NATR Cross-Site Scripting Vulnerability
Rockwell Automation Comms-1783-NATR is an industrial Ethernet address translation device from Rockwell Automation. The Rockwell Automation Comms-1783-NATR is vulnerable to a cross-site scripting vulnerability that is caused by improper validation of user-supplied input. An attacker could exploit...
EUVD-2025-34189
A Stored Cross-Site Scripting security issue exists in the affected product that could potentially allow a malicious user to view and modify sensitive data or make the webpage unavailable. The vulnerability stems from missing special character filtering and encoding. Successful exploitation...
CVE-2025-7329
A Stored Cross-Site Scripting security issue exists in the affected product that could potentially allow a malicious user to view and modify sensitive data or make the webpage unavailable. The vulnerability stems from missing special character filtering and encoding. Successful exploitation...
CVE-2025-7329
CVE-2025-7329 describes a Stored Cross-Site Scripting vulnerability in Rockwell Automation Comms-1783-NATR (industrial Ethernet translation device). The issue arises from missing filtering/encoding of user input, allowing a logged-in administrator to update configuration fields and potentially vi...
Rockwell Automation Comms-1783-NATR å®å Øę¼ę“
Rockwell Automation Comms-1783-NATR is an industrial Ethernet address translation device from Rockwell Automation. The Rockwell Automation Comms-1783-NATR is vulnerable to a cross-site scripting vulnerability that is caused by improper validation of user-supplied input. An attacker could exploit...
EUVD-2025-18787
Malicious code in bioql PyPI...