firefox: thunderbird: Potential user-assisted code execution in “Copy as cURL” command

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Insufficient escaping in the “Copy as cURL” feature could potentially be used to trick a user into executing unexpected code...

firefox: thunderbird: Potential user-assisted code execution in “Copy as cURL” command

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Insufficient escaping in the “Copy as cURL” feature could potentially be used to trick a user into executing unexpected code...

CVE-2025-7726

The The7 theme for WordPress is vulnerable to Stored Cross-Site Scripting via its lightbox rendering code in all versions up to, and including, 12.6.0 due to insufficient input sanitization and output escaping. The theme’s JavaScript reads user-supplied 'title' and 'data-dt-img-description'...

BIT-LIBPHP-2025-1735 pgsql extension does not check for errors during escaping

In PHP versions:8.1. before 8.1.33, 8.2. before 8.2.29, 8.3. before 8.3.23, 8.4. pgsql and pdopgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid...

BIT-LIBPHP-2024-1874 Command injection via array-ish $command parameter of proc_open()

In PHP versions 8.1. before 8.1.28, 8.2. before 8.2.18, 8.3. before 8.3.5, when using procopen command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands ...

WordPress Employee Directory plugin cross-site scripting vulnerability

WordPress Employee Directory plugin is specially designed for WordPress websites to create and manage employee profile directories. The WordPress Employee Directory plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping ...

WordPress WP Easy Contact plugin cross-site scripting vulnerability

WordPress WP Easy Contact plugin is mainly used for website message function management, support users to submit messages and send them to the administrator's mailbox. WordPress WP Easy Contact plugin suffers from a cross-site scripting vulnerability that stems from the lack of effective filterin...

WordPress Stratum plugin cross-site scripting vulnerability

WordPress Stratum plugin is a third-party extension plugin that is mainly used to enhance page building functionality. It offers 20+ free business-oriented extension components that support automatic adaptation of the current theme's visual style while keeping the site running efficiently...

WordPress GiveWP plugin cross-site scripting vulnerability

WordPress GiveWP plugin is an open source online donation system plugin, mainly used to help the website to realize the online fundraising function. WordPress GiveWP plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping...

WordPress SureForms plugin cross-site scripting vulnerability

WordPress SureForms plugin is designed for WordPress visual form builder plugin , support drag and drop operation , no programming foundation can quickly build responsive form . WordPress SureForms plugin suffers from a cross-site scripting vulnerability that stems from the lack of effective...

CVE-2025-7726

The7 theme for WordPress (

WordPress plugin The7 跨站脚本漏洞

WordPress The7 plugin is a highly customizable WordPress theme. WordPress The7 plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied data, which can be exploited by an attacker to execute arbitrary web...

BIT-MOODLE-2024-38274 moodle: stored XSS via calendar's event title when deleting the event

Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt...

CVE-2025-6256

The Flex Guten plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘thumbnailHoverEffect’ parameter in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

Linux Distros Unpatched Vulnerability : CVE-2025-5265

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Due to insufficient escaping of the ampersand character in the Copy as cURL feature, an attacker could trick a user into using this command, potentially leading...

Linux Distros Unpatched Vulnerability : CVE-2025-4089

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Due to insufficient escaping of special characters in the copy as cURL feature, an attacker could trick a user into using this command, potentially leading to...

Linux Distros Unpatched Vulnerability : CVE-2017-6927

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain JavaScript function which is used to escape potentially dangerous...

Linux Distros Unpatched Vulnerability : CVE-2022-34912

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in MediaWiki before 1.37.3 and 1.38.x before 1.38.1. The contributions-title, used on Special:Contributions, is used as page title witho...

Linux Distros Unpatched Vulnerability : CVE-2021-43541

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly escaped. This vulnerability affects...

pgsql extension does not check for errors during escaping

...