24461 matches found
CVE-2023-53940 Codigo Markdown Editor 1.0.1 Electron Arbitrary Code Execution via Markdown File
Codigo Markdown Editor 1.0.1 contains a code execution vulnerability that allows attackers to run arbitrary system commands by crafting a malicious markdown file. Attackers can embed a video source with an onerror event that executes shell commands through Node.js childprocess module when the fil...
CVE-2025-65009
creationtimestamp| type| source ---|---|--- 2025-12-18 18:04:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mabr6vwgpf2e...
CVE-2025-60053
creationtimestamp| type| source ---|---|--- 2025-12-18 09:52:51+00:00| seen| https://gist.github.com/Darkcrai86/e464d8d154121a71b1db7ccfcf6474e4...
CVE-2025-13977
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple attack vectors in all versions up to, and including, 6.5.3. This is due to insufficient input sanitization and output escaping in the Event...
CVE-2025-68143
creationtimestamp| type| source ---|---|--- 2025-12-18 01:19:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ma7z2vaucw2y 2026-01-21 01:53:22+00:00| seen| https://bsky.app/profile/cryptonews-poster.bsky.social/post/3mcvks7wnai24 2026-01-21 01:54:01+00:00| seen|...
CVE-2025-68112
ChurchCRM is an open-source church management system. In versions prior to 6.5.3, a SQL injection vulnerability in ChurchCRM's Event Attendee Editor allows authenticated users to execute arbitrary SQL commands, leading to complete database compromise, administrative credential theft, and potentia...
EUVD-2025-203987
ChurchCRM is an open-source church management system. In versions prior to 6.5.3, a SQL injection vulnerability in ChurchCRM's Event Attendee Editor allows authenticated users to execute arbitrary SQL commands, leading to complete database compromise, administrative credential theft, and potentia...
CVE-2025-68112 ChurchCRM has SQL injection in EditEventAttendees.php
ChurchCRM is an open-source church management system. In versions prior to 6.5.3, a SQL injection vulnerability in ChurchCRM's Event Attendee Editor allows authenticated users to execute arbitrary SQL commands, leading to complete database compromise, administrative credential theft, and potentia...
CVE-2025-68112 ChurchCRM has SQL injection in EditEventAttendees.php
ChurchCRM is an open-source church management system. In versions prior to 6.5.3, a SQL injection vulnerability in ChurchCRM's Event Attendee Editor allows authenticated users to execute arbitrary SQL commands, leading to complete database compromise, administrative credential theft, and potentia...
CVE-2025-68112
ChurchCRM (open-source church management system) has a SQL injection vulnerability in the Event Attendee Editor (and Event Participant Editor) affecting versions prior to 6.5.3. The issue allows authenticated users to submit arbitrary SQL, enabling complete database compromise, extraction of sens...
CVE-2025-66395 SQL Injection in Event List via `WhichType` Parameter
ChurchCRM is an open-source church management system. Prior to version 6.5.3, a SQL injection vulnerability exists in the src/ListEvents.php file. When filtering events by type, the WhichType POST parameter is not properly sanitized or type-casted before being used in multiple SQL queries. This...
CVE-2025-66395 SQL Injection in Event List via `WhichType` Parameter
ChurchCRM is an open-source church management system. Prior to version 6.5.3, a SQL injection vulnerability exists in the src/ListEvents.php file. When filtering events by type, the WhichType POST parameter is not properly sanitized or type-casted before being used in multiple SQL queries. This...
CVE-2025-66395
CVE-2025-66395 affects ChurchCRM prior to 6.5.3. The vulnerability is a SQL injection in src/ListEvents.php when filtering events by type using the WhichType POST parameter, which is not properly sanitized or type-casted before multiple SQL queries. Any authenticated user, regardless of privilege...
CVE-2025-66395 SQL Injection in Event List via `WhichType` Parameter
ChurchCRM is an open-source church management system. Prior to version 6.5.3, a SQL injection vulnerability exists in the src/ListEvents.php file. When filtering events by type, the WhichType POST parameter is not properly sanitized or type-casted before being used in multiple SQL queries. This...
CVE-2025-14266
creationtimestamp| type| source ---|---|--- 2025-12-17 17:46:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ma77qda4522c...
CVE-2025-20393
creationtimestamp| type| source ---|---|--- 2025-12-17 17:03:45+00:00| seen| https://infosec.exchange/users/AAKL/statuses/115735906228666088 2025-12-17 17:17:20+00:00| seen| https://bsky.app/profile/pylos.co/post/3ma7645ozwk2t 2025-12-17 17:23:48+00:00| seen|...
EUVD-2025-203911
Cisco is aware of a potential vulnerability. Cisco is currently investigating and will update these details as appropriate as more information becomes available...
CVE-2025-13977
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple attack vectors in all versions up to, and including, 6.5.3. This is due to insufficient input sanitization and output escaping in the Event...
CVE-2025-13977 Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple attack vectors in all versions up to, and including, 6.5.3. This is due to insufficient input sanitization and output escaping in the Event...
CVE-2025-13977
The CVE-2025-13977 entry concerns the WordPress plugin Essential Addons for Elementor – Popular Elementor Templates & Widgets. It is vulnerable to Stored Cross-Site Scripting in all versions up to 6.5.3, due to insufficient input sanitization and output escaping in the Event Calendar widget’s cus...