19767 matches found
CVE-2025-39512 WordPress Bulk Term Editor plugin <= 1.1.4 - Cross Site Request Forgery (CSRF) Vulnerability
Cross-Site Request Forgery CSRF vulnerability in Yuya Hoshino Bulk Term Editor bulk-term-editor allows Cross Site Request Forgery.This issue affects Bulk Term Editor: from n/a through = 1.1.4...
CVE-2025-39512
CVE-2025-39512 describes a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Bulk Term Editor (versions
CVE-2025-39512 WordPress Bulk Term Editor <= 1.1.4 - Cross Site Request Forgery (CSRF) Vulnerability
Cross-Site Request Forgery CSRF vulnerability in Yuya Hoshino Bulk Term Editor allows Cross Site Request Forgery. This issue affects Bulk Term Editor: from n/a through 1.1.4...
CVE-2025-2314 User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.13.5 due to insufficient input sanitization and output escaping on...
WordPress plugin Bulk Term Editor 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site request forgery...
CVE-2025-39512: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Yuya Hoshino Bulk Term Editor bulk-term-editor allows Cross Site Request Forgery.This issue affects Bulk Term Editor: from n/a through = 1.1.4...
PT-2025-16626 · Unknown · Yuya Hoshino Bulk Term Editor
Name of the Vulnerable Software and Affected Versions: Yuya Hoshino Bulk Term Editor versions 1.1.4 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations: For Yuya Hoshin...
CVE-2025-39578: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CyberChimps Responsive Blocks responsive-block-editor-addons allows Stored XSS.This issue affects Responsive Blocks: from n/a through = 2.0.2...
The vulnerability of the EMACS text editor arises from the lack of measures taken to eliminate special elements, allowing attackers to execute arbitrary commands.
The vulnerability of the EMACS text editor exists because measures to neutralize special elements have not been taken. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...
Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2025-932)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-932 advisory. A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown code of the file src/main.c. The manipulation of the argument --log leads to memory...
EulerOS 2.0 SP11 : vim (EulerOS-SA-2025-1380)
According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow, because Vim does no...
PT-2026-60958
Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 2.0.5 SurrealDB versions 2.1.x prior to 2.1.5 SurrealDB versions 2.2.x prior to 2.2.2 Description Authenticated users with OWNER or EDITOR permissions at the root, namespace, or database level can cause a denial of...
PT-2026-60953
Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 2.0.5 SurrealDB versions 2.1.x prior to 2.1.5 SurrealDB versions 2.2.x prior to 2.2.2 Description The command-line export command fails to properly escape table and field names. An authenticated System User with OWN...
The vulnerability of Visual Studio Code’s source editor, related to access control deficiencies, allows attackers to escalate their privileges.
The vulnerability of Visual Studio Code’s source editor is related to lack of access control. Exploiting this vulnerability can allow attackers to enhance their privileges...
GHSA-RHX4-HVX9-J387 Silverstripe Framework has a XSS vulnerability in HTML editor
Impact A bad actor with access to edit content in the CMS could send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitised on the client-side, but server-side sanitisation doesn't catch...
Silverstripe Framework has a XSS vulnerability in HTML editor
Impact A bad actor with access to edit content in the CMS could send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitised on the client-side, but server-side sanitisation doesn't catch...
CVE-2025-30148 Silverstripe Framework has a XSS vulnerability in HTML editor
Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. Prior to 5.3.23, bad actor with access to edit content in the CMS could send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The...
ibexa/fieldtype-richtext allows access to external entities in XML
Impact This security advisory resolves a vulnerability in the RichText field type. By entering a maliciously crafted input into the RichText XML, an attacker could perform an attack using XML external entity XXE injection, which might be able to read files on the server. To exploit this...
CVE-2025-3064
The WPFront User Role Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.1. This is due to missing or incorrect nonce validation on the whitelistoptions function. This makes it possible for unauthenticated attackers to update the...
