20479 matches found
Trix has a stored XSS vulnerability through its attachment attribute
The Trix editor, in versions prior to 2.1.16, is vulnerable to XSS attacks through attachment payloads. An attacker could inject malicious code into a data-trix-attachment attribute that, when rendered as HTML and clicked on, could execute arbitrary JavaScript code within the context of the user'...
CVE-2025-13592
The Advanced Ads plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.0.14 via the 'change-adcontent' shortcode parameter. This allows authenticated attackers with editor-level permissions or above, to execute code on the server...
CVE-2025-13592
The Advanced Ads plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.0.14 via the 'change-adcontent' shortcode parameter. This allows authenticated attackers with editor-level permissions or above, to execute code on the server...
CVE-2025-13592 Advanced Ads <= 2.0.14 - Authenticated (Editor+) Remote Code Execution via Shortcode
The Advanced Ads plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.0.14 via the 'change-adcontent' shortcode parameter. This allows authenticated attackers with editor-level permissions or above, to execute code on the server...
CVE-2025-13592 Advanced Ads <= 2.0.14 - Authenticated (Editor+) Remote Code Execution via Shortcode
The Advanced Ads plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.0.14 via the 'change-adcontent' shortcode parameter. This allows authenticated attackers with editor-level permissions or above, to execute code on the server...
CVE-2025-61914
n8n is an open source workflow automation platform. Prior to version 1.114.0, a stored Cross-Site Scripting XSS vulnerability may occur in n8n when using the “Respond to Webhook” node. When this node responds with HTML content containing executable scripts, the payload may execute directly in the...
CVE-2025-13592: Improper Control of Generation of Code
The Advanced Ads plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.0.14 via the 'change-adcontent' shortcode parameter. This allows authenticated attackers with editor-level permissions or above, to execute code on the server...
PT-2025-62921
Уязвимость редактора документов корпоративного сервера Р7-Офис связана с непринятием мер по нейтрализации специальных элементов. Эксплуатация уязвимости может позволить выполнить произвольный код...
R7-Officer document editor XSS
The vulnerability of the R7-Officer corporate server document editor is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow an attacker to carry out XSS attacks...
R7-Officer document editor XSS
The vulnerability of the R7-Officer corporate server document editor is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability can allow attackers to carry out XSS attacks...
R7-Officer document editor Path Traversal
Vulnerability of the document editor of the R7-Officer corporate server, with an exploit through a relative path. Exploiting this vulnerability allows an attacker to execute arbitrary code...
R7-Officer document editor XSS
The vulnerability of the R7-Officer corporate server document editor is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow an attacker to carry out XSS attacks...
R7-Officer document editor XSS
The vulnerability of the R7-Officer corporate server document editor is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability can allow attackers to carry out XSS attacks...
R7-Officer document editor XSS
The vulnerability of the R7-Officer corporate server document editor is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability can allow attackers to carry out XSS attacks...
R7-Officer document editor XSS
The vulnerability of the R7-Office corporate server document editor is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow an attacker to carry out XSS attacks...
CVE-2025-61914
n8n is an open source workflow automation platform. Prior to version 1.114.0, a stored Cross-Site Scripting XSS vulnerability may occur in n8n when using the “Respond to Webhook” node. When this node responds with HTML content containing executable scripts, the payload may execute directly in the...
CVE-2025-68697
n8n is an open source workflow automation platform. Prior to version 2.0.0, in self-hosted n8n instances where the Code node runs in legacy non-task-runner JavaScript execution mode, authenticated users with workflow editing access can invoke internal helper functions from within the Code node...
CVE-2025-61914
n8n is an open source workflow automation platform. Prior to version 1.114.0, a stored Cross-Site Scripting XSS vulnerability may occur in n8n when using the “Respond to Webhook” node. When this node responds with HTML content containing executable scripts, the payload may execute directly in the...
CVE-2025-61914
Summary: CVE-2025-61914 affects n8n before version 1.114.0, where a stored XSS in the “Respond to Webhook” node could execute malicious JavaScript in the editor interface. The root cause is HTML responses with executable scripts not sandboxed as in 1.103.0, enabling a user with workflow creation ...
CVE-2025-61914 n8n's Possible Stored XSS in "Respond to Webhook" Node May Execute Outside iframe Sandbox
n8n is an open source workflow automation platform. Prior to version 1.114.0, a stored Cross-Site Scripting XSS vulnerability may occur in n8n when using the “Respond to Webhook” node. When this node responds with HTML content containing executable scripts, the payload may execute directly in the...