29030 matches found
CVE-2025-58867
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Remi Corson Easy Download Media Counter easy-download-media-counter allows Stored XSS.This issue affects Easy Download Media Counter: from n/a through = 1.2...
CVE-2025-58849
Cross-Site Request Forgery CSRF vulnerability in Deepak S Hide Real Download Path hide-real-download-path allows Stored XSS.This issue affects Hide Real Download Path: from n/a through = 1.6...
CVE-2025-58867
CVE-2025-58867 is a stored XSS in the WordPress plugin Easy Download Media Counter (
CVE-2025-58849
CVE-2025-58849 is a CSRF vulnerability in the WordPress plugin Hide Real Download Path up to version 1.6 that can trigger Stored XSS. The provided documents do not specify a patched version; monitor for vendor updates and apply fixes when available.
CVE-2025-58849 WordPress Hide Real Download Path Plugin <= 1.6 - Cross Site Request Forgery (CSRF) Vulnerability
Cross-Site Request Forgery CSRF vulnerability in Deepak S Hide Real Download Path hide-real-download-path allows Stored XSS.This issue affects Hide Real Download Path: from n/a through = 1.6...
WordPress Easy Download Media Counter Plugin <= 1.2 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by Mika in WordPress Plugin Easy Download Media Counter versions = 1.2...
WordPress Hide Real Download Path Plugin <= 1.6 - Cross Site Request Forgery (CSRF) Vulnerability
Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Hide Real Download Path versions = 1.6...
OESA-2025-2112 aide security update
Security Fixes: A vulnerability was found in AIDE up to 0.19.1 and classified as problematic.Using CWE to declare the problem leads to CWE-117. The product does not neutralize or incorrectly neutralizes output that is written to logs.Impacted is integrity.Upgrading to version 0.19.2 eliminates th...
Symlink Attack
github.com/hashicorp/go-getter is vulnerable to Symlink Attack. The vulnerability is due to the subdirectory download feature allowing symbolic links to escape designated directory boundaries and access unauthorized files...
CVE-2025-48395
An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited shell of the CLI. This security issue has been fixed in the latest version of NMC G2 which is available on the Eaton download center...
CVE-2025-48395
CVE-2025-48395 affects Eaton NMC G2. The issue allows an attacker with authenticated privileged access to modify the contents of a non-sensitive file by traversing a path in the CLI’s limited shell. Root cause: path traversal in the restricted CLI shell. Impact is limited to file contents modific...
CVE-2025-48395
An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited shell of the CLI. This security issue has been fixed in the latest version of NMC G2 which is available on the Eaton download center...
CVE-2025-48395
An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited shell of the CLI. This security issue has been fixed in the latest version of NMC G2 which is available on the Eaton download center...
VirusTotal Finds 44 Undetected SVG Files Used to Deploy Base64-Encoded Phishing Pages
Cybersecurity researchers have flagged a new malware campaign that has leveraged Scalable Vector Graphics SVG files as part of phishing attacks impersonating the Colombian judicial system. The SVG files, according to VirusTotal, are distributed via email and designed to execute an embedded...
PT-2025-36397
Name of the Vulnerable Software and Affected Versions internetarchive versions 5.5.0 and below Description The internetarchive library contains a directory traversal vulnerability in the File.download method. The method does not properly sanitize user-supplied filenames or validate the final...
WordPress plugin Easy Download Media Counter Cross Site Scripting Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...
PT-2025-36206
Name of the Vulnerable Software and Affected Versions: Easy Download Media Counter versions through 1.2 Description: The software contains a cross-site scripting XSS vulnerability due to improper neutralization of input during web page generation. This allows for stored XSS attacks...
WordPress plugin Hide Real Download Path 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...
PT-2025-36188
Name of the Vulnerable Software and Affected Versions: Hide Real Download Path versions n/a through 1.6 Description: A Cross-Site Request Forgery CSRF vulnerability exists in Deepak S Hide Real Download Path, which can also lead to Stored Cross-Site Scripting XSS. Recommendations: At the moment,...
