CVE-2025-63638

Sourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting XSS in the "Task Title" and "Description Optional" fields when creating a Task, allowing an attacker to inject arbitrary potentially malicious HTML/JavaScript code that executes in the victim's browser upon clicki...

CVE-2025-63638

Sourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting XSS in the "Task Title" and "Description Optional" fields when creating a Task, allowing an attacker to inject arbitrary potentially malicious HTML/JavaScript code that executes in the victim's browser upon clicki...

CVE-2025-12352 Gravity Forms <= 2.9.20 - Unauthenticated Arbitrary File Upload via 'copy_post_image'

The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the copypostimage function in all versions up to, and including, 2.9.20. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's serv...

[SECURITY] Fedora 42 Update: GeographicLib-2.5.2-1.fc42

GeographicLib is a small set of C++ classes for performing conversions between geographic, UTM, UPS, MGRS, geocentric, and local Cartesian coordinates, for gravity e.g., EGM2008, geoid height and geomagnetic field e.g., WMM2010 calculations, and for solving geodesic problems. The emphasis is on...

[SECURITY] Fedora 43 Update: GeographicLib-2.5.2-1.fc43

GeographicLib is a small set of C++ classes for performing conversions between geographic, UTM, UPS, MGRS, geocentric, and local Cartesian coordinates, for gravity e.g., EGM2008, geoid height and geomagnetic field e.g., WMM2010 calculations, and for solving geodesic problems. The emphasis is on...

CVE-2025-63640

Sourcecodester Medicine Reminder App v1.0 is vulnerable to Cross-Site Scripting XSS in the "Medicine Name" and "Notes Optional" fields when creating an "Upcoming Reminder", allowing an attacker to inject arbitrary potentially malicious HTML/JavaScript code that executes in the victim's browser up...

PT-2025-45497

Name of the Vulnerable Software and Affected Versions Sourcecodester Medicine Reminder App version 1.0 Description The application is susceptible to Cross-Site Scripting XSS. An attacker can inject potentially malicious HTML/JavaScript code into the "Medicine Name" and "Notes Optional" fields whe...

CVE-2025-63638

Sourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting XSS in the "Task Title" and "Description Optional" fields when creating a Task, allowing an attacker to inject arbitrary potentially malicious HTML/JavaScript code that executes in the victim's browser upon clicki...

SourceCodester User Account Generator Security Vulnerabilities

SourceCodester User Account Generator is an open source user account generator from SourceCodester. A security vulnerability exists in SourceCodester User Account Generator version 1.0, which stems from improper input cleanup of the Username Prefix field, and could lead to a cross-site scripting...

CVE-2025-63638

Sourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting XSS in the "Task Title" and "Description Optional" fields when creating a Task, allowing an attacker to inject arbitrary potentially malicious HTML/JavaScript code that executes in the victim's browser upon clicki...

CVE-2025-63638

The Sourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. Specifically, the "Task Title" and "Description (Optional)" fields do not adequately validate input when creating a new task. An attack...

PT-2025-45495

Name of the Vulnerable Software and Affected Versions Sourcecodester AI-Powered To-Do List App version 1.0 Description The application is susceptible to Cross-Site Scripting XSS attacks. Specifically, the "Task Title" and "Description Optional" fields are vulnerable when creating a new task. An...

PT-2025-45474

Name of the Vulnerable Software and Affected Versions SourceCodester User Account Generator version 1.0 Description A Cross-Site Scripting XSS issue exists in SourceCodester User Account Generator version 1.0. This allows remote attackers to execute arbitrary JavaScript code within a user’s brows...

ClipBucket V5 Cross-Site Script Vulnerability

ClipBucket V5 is a video hosting platform for MacWarrior individual developers. A cross-site scripting vulnerability exists in ClipBucket V5 5.5.2-146 and prior versions, which stems from the Playlist Name field not being properly cleaned and escaped, and could lead to a stored cross-site scripti...

CVE-2025-57244

OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting XSS in the user account creation interface. The Name field accepts script tags and the Email field is vulnerable when the POST request is modified to include encoded script tags, by passing frontend validation...

kernel: pstore/ram: Check start of empty przs during init

An out of bounds array vulnerability exists in the linux kernel, such that a missing check on the start field of a PRZ persistent ram zone during initialization leads to damage to the availability and integrity of the system...

PT-2025-45387

Name of the Vulnerable Software and Affected Versions 3scale Developer Portal affected versions not specified Description A flaw exists in the 3scale developer portal that could allow account creation or updates through hidden or read-only fields. This allows an attacker to potentially access or...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990386)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990386 advisory. In the Linux kernel, the following vulnerability has been resolved: traceeventshist: add check for return value of 'createhistfield' Function 'createhistfield' is...

CVE-2025-57244

OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting XSS in the user account creation interface. The Name field accepts script tags and the Email field is vulnerable when the POST request is modified to include encoded script tags, by passing frontend validation...

caluma (>=6.0.0, <=6.3.1), mycms (>=0.1.9, <=0.1.12) +1 more potentially affected by CVE-2025-64459 via django (2.2.14)

django PYPI version 2.2.14 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - caluma =6.0.0, =0.1.9, =0.1.12 - x-net-django-color-field 1.0.0 Source cves: CVE-2025-64459 Source advisory: OSV:GHSA-FRMV-PR5F-9MCR...