WordPress WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) plugin <= 3.20.3 - Unauthenticated Stored Cross-Site Scripting via External Content Import vulnerability

Unauthenticated Stored Cross-Site Scripting via External Content Import vulnerability discovered by Kishan Vyas in WordPress Plugin WP Social Ninja versions = 3.20.3...

Malicious code in btc-transaction-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 291d3fea363888c43824aaaa26f2eb389674822baacb18e5ff7498c9cfc74dee The package btc-transaction-helper was found to contain malicious code. Source: ghsa-malware...

CVE-2025-13007 WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) <= 3.20.3 - Unauthenticated Stored Cross-Site Scripting via External Content Import

The WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.20.3 due to insufficient input sanitization and output escaping on externally-sourced content. This makes it possible...

CVE-2025-13007

CVE-2025-13007 is a stored XSS vulnerability in the WordPress plugin WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets (versions ≤ 3.20.3). It arises from insufficient input sanitization and output escaping of externally sourced content, allowing unauthenticated attackers to in...

CVE-2025-13007 WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) <= 3.20.3 - Unauthenticated Stored Cross-Site Scripting via External Content Import

The WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.20.3 due to insufficient input sanitization and output escaping on externally-sourced content. This makes it possible...

MAL-2025-191548 Malicious code in internallib_v881 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88a05ce6f3ec9a36ea97ed0f3c3b1ad47d759be64104c2b2520d695f5da2c8d8 The package internallibv881 was found to contain malicious code. Source: ghsa-malware bd5f984f8edb8d28061ac400a32ca61e7ce24ab864d705ed39b96e2d69b405b...

CVE-2025-12529

creationtimestamp| type| source ---|---|--- 2025-12-02 04:34:17+00:00| seen| https://infosec.exchange/users/offseq/statuses/115648106027745721 2025-12-02 04:34:18+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3m6y4hwvlmo2t 2025-12-02 04:58:59+00:00| seen|...

Malicious code in bignumx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 745b8508e8818e81e53f71cf2467fa31620191825b820f424eb9f86ab1e5f49e The package bignumx was found to contain malicious code. Source: ghsa-malware 98b45b53c91ebee4c77ebf3ba359608318ce17878eb8edb1cbd2a7e65238dbff Any...

MAL-2025-191541 Malicious code in bignumx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 745b8508e8818e81e53f71cf2467fa31620191825b820f424eb9f86ab1e5f49e The package bignumx was found to contain malicious code. Source: ghsa-malware 98b45b53c91ebee4c77ebf3ba359608318ce17878eb8edb1cbd2a7e65238dbff Any...

Ubuntu 25.04 / 25.10 : CRaC JDK 21 vulnerabilities (USN-7901-1)

The remote Ubuntu 25.04 / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7901-1 advisory. Jinfeng Guo discovered that the Security component of CRaC JDK 21 did not correctly handle certain representations of encoded strings. An...

PT-2025-48785

Name of the Vulnerable Software and Affected Versions Vim for Windows versions prior to 9.1.1947 Description Vim is a command line text editor. A flaw exists in Vim for Windows due to an uncontrolled search path issue. When using cmd.exe as a shell, Vim resolves external commands by searching the...

PT-2025-48647

The WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.20.3 due to insufficient input sanitization and output escaping on externally-sourced content. This makes it possible...

Ubuntu 25.10 : CRaC JDK 25 vulnerabilities (USN-7902-1)

The remote Ubuntu 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7902-1 advisory. Jinfeng Guo discovered that the Security component of CRaC JDK 25 did not correctly handle certain representations of encoded strings. An unauthenticated...

CVE-2025-66405

Portkey.ai Gateway is a blazing fast AI Gateway with integrated guardrails. Prior to 1.14.0, the gateway determined the destination baseURL by prioritizing the value in the x-portkey-custom-host request header. The proxy route then appends the client-specified path to perform an external fetch...

CVE-2025-66405 Portkey.ai Gateway: Server-Side Request Forgery (SSRF) in Custom Host

Portkey.ai Gateway is a blazing fast AI Gateway with integrated guardrails. Prior to 1.14.0, the gateway determined the destination baseURL by prioritizing the value in the x-portkey-custom-host request header. The proxy route then appends the client-specified path to perform an external fetch...

CVE-2025-66405

Portkey.ai Gateway has an SSRF vulnerability prior to v1.14.0 where the destination baseURL is chosen from the x-portkey-custom-host header and the proxy appends the client path to fetch external resources. This can allow an attacker to make requests to arbitrary hosts, potentially leaking data f...

External Control of File Name or Path

Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to External Control of File Name or Path via the getBaseURL function. An attacker can cause all routes to return 404 errors for all users by sending a crafted...

EUVD-2025-200097

Better Auth affected by external request basePath modification DoS...

GHSA-569Q-MPPH-WGWW Better Auth affected by external request basePath modification DoS

Summary Affected versions of Better Auth allow an external request to configure baseURL when it isn’t defined through any other means. This can be abused to poison the router’s base path, causing all routes to return 404 for all users. This issue is only exploitable when baseURL is not explicitly...

cyclonedx-core-java: CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection

An XML External Entity XXE injection vulnerability was found in the CycloneDX Java core library’s XML validation step where the XML Validator was not configured securely. When a specially crafted CycloneDX BOM XML is validated, external XML entities can be processed XXE, allowing an attacker to...