Arbitrary Command Injection

Overview figma-developer-mcp is a Give your coding agent access to your Figma data. Implement designs in any framework in one-shot. Affected versions of this package are vulnerable to Arbitrary Command Injection via the childprocess.exec call using unvalidated user input directly within...

GHSA-GXW4-4FC5-9GR5 figma-developer-mcp vulnerable to command injection in get_figma_data tool

Summary A command injection vulnerability exists in the figma-developer-mcp MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to childprocess.exec, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote...

figma-developer-mcp vulnerable to command injection in get_figma_data tool

Summary A command injection vulnerability exists in the figma-developer-mcp MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to childprocess.exec, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote...

PT-2025-40054

Name of the Vulnerable Software and Affected Versions Framelink Figma MCP Server versions prior to 0.6.3 Figma-developer-mcp versions prior to 0.6.3 Description A command injection flaw exists in the Framelink Figma MCP Server, allowing an unauthenticated remote attacker to execute arbitrary...

PT-2025-40046

Summary A command injection vulnerability exists in the figma-developer-mcp MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to child process.exec, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote...

CourseSelectionSystem SQL Injection Vulnerability

CourseSelectionSystem is a simple online course selection system by the individual developer of kidaze. CourseSelectionSystem suffers from a SQL injection vulnerability, which stems from an incorrect manipulation of the parameter cbranch in the file /Profilers/PriProfile/COUNT3s4.php, which could...

CVE-2025-10949

CVE-2025-10949 affects Changsha Developer Technology iView Editor

PT-2025-39392

Name of the Vulnerable Software and Affected Versions Changsha Developer Technology iView Editor versions up to 1.1.1 Description A flaw exists in the Markdown Handler component of the software that allows for cross site scripting. The issue is remotely exploitable and details of the exploit are...

CVE-2025-58231

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bitlydeveloper Bitly wp-bitly allows Stored XSS.This issue affects Bitly: from n/a through = 2.8.0...

CVE-2025-57924

Cross-Site Request Forgery CSRF vulnerability in Automattic Developer allows Cross Site Request Forgery. This issue affects Developer: from n/a through 1.2.6...

Lean Teams, Higher Stakes: Why CISOs Must Rethink Incident Remediation

Big companies are getting smaller, and their CEOs want everyone to know it. Wells Fargo has cut its workforce by 23% over five years, Bank of America has shed 88,000 employees since 2010, and Verizon's CEO recently boasted that headcount is "going down all the time." What was once a sign of...

WordPress Developer Plugin <= 1.2.6 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nabil Irawan in WordPress Plugin Developer versions = 1.2.6...

CVE-2025-57924

Cross-Site Request Forgery CSRF vulnerability in Automattic Developer allows Cross Site Request Forgery. This issue affects Developer: from n/a through 1.2.6...

CVE-2025-57924 WordPress Developer Plugin <= 1.2.6 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in Automattic Developer allows Cross Site Request Forgery. This issue affects Developer: from n/a through 1.2.6...

CVE-2025-57924

Cross-Site Request Forgery CSRF vulnerability in Automattic Developer developer allows Cross Site Request Forgery.This issue affects Developer: from n/a through = 1.2.6...

CVE-2025-57924 WordPress Developer Plugin <= 1.2.6 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in Automattic Developer allows Cross Site Request Forgery. This issue affects Developer: from n/a through 1.2.6...

CVE-2025-57924

CVE-2025-57924 is a CSRF vulnerability in the Automattic Developer WordPress plugin, affecting versions up to 1.2.6. The provided data include CVSS 3.1 metrics (3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N with base score 4.3). No exploit details or remediation are provided in the documents.

PT-2025-38896

Name of the Vulnerable Software and Affected Versions Bitly versions through 2.7.4 Description A flaw exists in Bitly that allows for Stored Cross-site Scripting XSS. This issue is due to improper neutralization of input during web page generation. The vulnerability could potentially allow an...

CVE-2025-57924: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Automattic Developer allows Cross Site Request Forgery. This issue affects Developer: from n/a through 1.2.6...

WordPress plugin Automattic Developer has a cross-site request forgeing vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site request...