EUVD-2024-27716

Malicious code in bioql PyPI...

EUVD-2023-32417

Malicious code in bioql PyPI...

EUVD-2024-44306

Malicious code in bioql PyPI...

EUVD-2024-16904

Malicious code in bioql PyPI...

EUVD-2024-40648

Malicious code in bioql PyPI...

EUVD-2021-34194

Malicious code in bioql PyPI...

EUVD-2023-42203

Malicious code in bioql PyPI...

EUVD-2022-51542

Malicious code in bioql PyPI...

EUVD-2024-47623

Malicious code in bioql PyPI...

EUVD-2024-17383

Malicious code in bioql PyPI...

EUVD-2024-45086

Malicious code in bioql PyPI...

EUVD-2025-11513

Malicious code in bioql PyPI...

CVE-2025-49557

CVE-2025-49557 refers to a stored Cross-site Scripting (XSS) vulnerability in Adobe Commerce/Magento Open Source versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier. The issue allows a low-privileged attacker to inject malicious scripts into vulnerable form fiel...

WordPress Gravity Forms Plugin < 1.9.16 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mediaburst:gravityforms"; if description...

WordPress Gravity Forms Plugin < 2.9.2 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mediaburst:gravityforms"; if description...

PT-2025-30022 · Joomla · Balbooa Forms

Name of the Vulnerable Software and Affected Versions: Balbooa Forms versions 1.0.0 through 2.3.1.1 Description: A SQL injection issue exists in the Balbooa Forms plugin for Joomla. Privileged users can execute arbitrary SQL commands through the id parameter. Recommendations: Balbooa Forms versio...

CVE-2025-6464 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.44.2 via deserialization of untrusted input in the 'entrydeleteuploadfiles' function. This makes it possible for unauthenticat...

WordPress Everest Forms Plugin <= 3.2.2 is vulnerable to PHP Object Injection

Software Everest Forms Type Plugin Vulnerable versions = 3.2.2 Fixed in 3.2.3 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-52709 Patch priority High CVSS severity High 9.8 Developer Everest Forms PSID ed6f018dd59f Credits Phat RiO - BlueRock Required privilege...

PT-2025-27072 · WordPress · Ninja Forms

Name of the Vulnerable Software and Affected Versions: Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress versions up to, and including, 3.10.2.1 Description: The issue is related to Stored Cross-Site Scripting via the use of a templating engine due to insufficient...

CVE-2025-5927

The Everest Forms Pro plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteentryfiles function in all versions up to, and including, 1.9.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server,...