GO-2024-3355 Remote Command Execution in file editing in gogs in gogs.io/gogs

Remote Command Execution in file editing in gogs in gogs.io/gogs...

CVE-2025-22352

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows Blind SQL Injection.This issue affects ELEX...

CVE-2025-22388

An issue was discovered in Optimizely EPiServer.CMS.Core before 12.22.0. A high-severity Stored Cross-Site Scripting XSS vulnerability exists in the CMS, allowing malicious actors to inject and execute arbitrary JavaScript code, potentially compromising user data, escalating privileges, or...

CVE-2025-22388

An issue was discovered in Optimizely EPiServer.CMS.Core before 12.22.0. A high-severity Stored Cross-Site Scripting XSS vulnerability exists in the CMS, allowing malicious actors to inject and execute arbitrary JavaScript code, potentially compromising user data, escalating privileges, or...

CVE-2025-22388: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Optimizely EPiServer.CMS.Core before 12.22.0. A high-severity Stored Cross-Site Scripting XSS vulnerability exists in the CMS, allowing malicious actors to inject and execute arbitrary JavaScript code, potentially compromising user data, escalating privileges, or...

CVE-2025-22388

A high-severity Stored Cross-Site Scripting (XSS) vulnerability exists in Optimizely EPiServer.CMS.Core versions prior to 12.22.0 . The flaw allows malicious actors to inject and execute arbitrary JavaScript code across multiple functional areas, including content editing , link management , and ...

PT-2025-4484

Name of the Vulnerable Software and Affected Versions Optimizely EPiServer.CMS.Core versions prior to 12.22.0 Description A high-severity Stored Cross-Site Scripting XSS issue exists in the CMS, allowing malicious actors to inject and execute arbitrary JavaScript code, potentially compromising us...

CVE-2024-56018

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BU Web Team BU Section Editing bu-section-editing allows Reflected XSS.This issue affects BU Section Editing: from n/a through = 0.9.9...

CVE-2024-56018

CVE-2024-56018 is a Reflected XSS in BU Section Editing (Boston University IS&T). Affected: BU Section Editing versions from n/a to 0.9.9. Root cause and precise exploit details are not provided beyond the XSS description in the initial document; no patch/version fix is documented in the connecte...

CVE-2024-56018: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BU Web Team BU Section Editing bu-section-editing allows Reflected XSS.This issue affects BU Section Editing: from n/a through = 0.9.9...

WordPress plugin BU Section Editing 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists i...

PT-2025-3168

Name of the Vulnerable Software and Affected Versions BU Section Editing versions 0.9.9 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS in BU Section Editing...

Remote Command Execution in file editing in gogs

Impact The malicious user is able to commit and edit a crafted symlink file to a repository to gain SSH access to the server. Patches Editing symlink while changing the file name has been prohibited via the repository web editor https://github.com/gogs/gogs/pull/7857. Users should upgrade to 0.13...

CVE-2024-54148

The Gogs open-source self-hosted Git service is vulnerable to a symbolic link handling issue. A malicious user can commit and edit a crafted symlink file to a repository, which can lead to the attacker gaining SSH access to the server. Additionally, exploitation of this interface vulnerability ma...

CVE-2024-54148 Gogs has a Path Traversal in file editing UI

Gogs is an open source self-hosted Git service. A malicious user is able to commit and edit a crafted symlink file to a repository to gain SSH access to the server. The vulnerability is fixed in 0.13.1...

WordPress BU Section Editing Plugin <= 0.9.9 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin BU Section Editing versions = 0.9.9...

CVE-2024-55085

GetSimple CMS CE 3.3.19 suffers from arbitrary code execution in the template editing function in the background management system, which can be used by an attacker to implement RCE...

CVE-2024-55085: Improper Control of Generation of Code

GetSimple CMS CE 3.3.19 suffers from arbitrary code execution in the template editing function in the background management system, which can be used by an attacker to implement RCE...

PT-2024-36473

Name of the Vulnerable Software and Affected Versions GetSimple CMS CE version 3.3.19 Description The issue concerns arbitrary code execution in the template editing function within the background management system. This can be exploited by an attacker to implement Remote Code Execution RCE...

CVE-2024-55085

GetSimple CMS CE 3.3.19 suffers from arbitrary code execution in the template editing function in the background management system, which can be used by an attacker to implement RCE...