CVE-2025-4588

The 360 Photo Spheres plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sphere' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-8400

The Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will...

The ADOdb sqlite3 driver allows SQL injection

Improper escaping of a query parameter may allow an attacker to execute arbitrary SQL statements when the code using ADOdb connects to a sqlite3 database and calls the metaColumns, metaForeignKeys or metaIndexes methods with a crafted table name. Note that the indicated Severity corresponds to a...

Important: httpd

Issue Overview: HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response. This vulnerability was described as CVE-2023-38709 but the patch included ...

Amazon Linux 2 : httpd (ALAS-2025-2958)

The version of httpd installed on the remote host is prior to 2.4.64-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2958 advisory. HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response...

Amazon Linux 2023 : httpd, httpd-core, httpd-devel (ALAS2023-2025-1125)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1125 advisory. HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the...

Linux Distros Unpatched Vulnerability : CVE-2020-25828

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. The non- jqueryMsg version of mw.message.parse doesn't escape HTML...

CVE-2025-5720

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘author’ parameter in all versions up to, and including, 5.80.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2025-8400

CVE-2025-8400 concerns the Image Gallery WordPress plugin (Bee-Quick-Gallery) with a reflected Cross-Site Scripting vulnerability. The issue affects all versions up to 1.0.0 due to insufficient input sanitization and output escaping, enabling unauthenticated attackers to inject scripts that execu...

WordPress plugin Ocean Social Sharing 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerability...

WordPress plugin 360 Photo Spheres 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin All in One Time Clock Lite 跨站脚本漏洞

WordPress All in One Time Clock Lite plugin is a plugin for tracking employee's working hours and supports employee/volunteer/contractor attendance recording and report generation. The WordPress All in One Time Clock Lite plugin suffers from a cross-site scripting vulnerability that stems from th...

PT-2025-31731 · WordPress · Mmm Unity Loader

Name of the Vulnerable Software and Affected Versions: Mmm Unity Loader plugin for WordPress versions prior to 1.0 Description: The Mmm Unity Loader plugin for WordPress is susceptible to Stored Cross-Site Scripting via the attributes parameter due to insufficient input sanitization and output...

PT-2025-31730 · WordPress · The Magic Edge – Lite

Name of the Vulnerable Software and Affected Versions: The Magic Edge – Lite plugin for WordPress versions up to and including 1.1.6 Description: The Magic Edge – Lite plugin for WordPress is susceptible to Stored Cross-Site Scripting via the height parameter due to insufficient input sanitizatio...

PT-2025-31723 · WordPress · 360 Photo Spheres

Name of the Vulnerable Software and Affected Versions: 360 Photo Spheres plugin for WordPress versions up to and including 1.3 Description: The 360 Photo Spheres plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'sphere' shortcode. Insufficient input sanitization and...

PT-2025-31729 · WordPress · All In One Time Clock Lite – Tracking Employee Time Has Never Been Easier

Name of the Vulnerable Software and Affected Versions: All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier plugin for WordPress versions up to and including 2.0 Description: The plugin is susceptible to Reflected Cross-Site Scripting due to insufficient input sanitization an...

PT-2025-31737 · WordPress · Ocean Social Sharing

Name of the Vulnerable Software and Affected Versions: Ocean Social Sharing plugin for WordPress versions prior to 2.2.2 Description: The Ocean Social Sharing plugin for WordPress is susceptible to Stored Cross-Site Scripting through social icon titles due to insufficient input sanitization and...

WordPress plugin SureForms 安全漏洞

WordPress SureForms plugin is designed for WordPress visual form builder plugin , support drag and drop operation , no programming foundation can quickly build responsive form . WordPress SureForms plugin suffers from a cross-site scripting vulnerability that stems from the lack of effective...

IBM Informix Dynamic Server Cross-Site Scripting Vulnerability

IBM Informix Dynamic Server IDS is a scalable object-relational database server from International Business Machines IBM that provides clustered data centers with features such as continuous data availability and disaster recovery. A cross-site scripting vulnerability exists in IBM Informix Dynam...

WordPress plugin Sina Extension for Elementor 跨站脚本漏洞

WordPress Sina Extension for Elementor Plugin is a visual editor extension plugin for the WordPress platform, designed for Elementor page builder, providing rich feature modules and layout tools to help users quickly build professional web pages. WordPress Sina Extension for Elementor Plugin...