PT-2025-6791

Name of the Vulnerable Software and Affected Versions Post SMTP plugin for WordPress versions up to, and including, 3.0.2 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject...

WordPress plugin Post SMTP 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-0521: Improper Neutralization of Input During Web Page Generation

The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the from and subject parameter in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2025-23525

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in kvvaradha Kv Compose Email From Dashboard kv-send-email-from-admin allows Reflected XSS.This issue affects Kv Compose Email From Dashboard: from n/a through = 1.1...

CVE-2025-23525

CVE-2025-23525 is a reflected cross-site scripting vulnerability in the WordPress plugin Kv Compose Email From Dashboard (Kv Send Email From Admin) with affected versions up to 1.1. The issue arises from improper input neutralization during web page generation, enabling Reflected XSS. Public sour...

CVE-2023-26848

creationtimestamp| type| source ---|---|--- 2025-02-14 10:05:59+00:00| seen| Telegram/-y8Q7cPOGDwQ7kQgR7hj7Fp3R34Xvi8A-b5CjVGCA4M5OBR...

SUSE CVE-2023-0459

Copyfromuser on 64-bit versions of the Linux kernel does not implement the uaccessbeginnospec allowing a user to bypass the "accessok" check and pass a kernel pointer to copyfromuser. This would allow an attacker to leak information. We recommend upgrading beyond commit...

CVE-2025-23525: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in kvvaradha Kv Compose Email From Dashboard kv-send-email-from-admin allows Reflected XSS.This issue affects Kv Compose Email From Dashboard: from n/a through = 1.1...

thunderbird: Address of e-mail sender can be spoofed by malicious email

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Thunderbird displayed an incorrect sender address if the From field of an email used the invalid group name syntax that is described in CVE-2024-49040...

thunderbird: Address of e-mail sender can be spoofed by malicious email

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Thunderbird displayed an incorrect sender address if the From field of an email used the invalid group name syntax that is described in CVE-2024-49040...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: fs: Fixed an issue with uninitialized values in fromkuid and fromkgid. ocfs2setattr uses attr-iamode, attr-iauid, and attr-iagid in a trace point, even though ATTRMODE, ATTRUID, and ATTRGID are not set. All fields of newattrs...

Prototype Pollution

module-from-string is vulnerable to Prototype pollution. The vulnerability is due to improper handling of user-supplied input in the lib.requireFromString function, allowing attackers to supply a crafted payload, leading to a Denial of Service DoS...

DVPSSoftcopyVOI_PList Heap Buffer Overflow DoS

The vulnerability of the DVPSSoftcopyVOIPList::createFromImage function in the library for working with DICOM format is related to incorrect data type conversion. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

CVE-2024-57072

A prototype pollution in the lib.requireFromString function of module-from-string v3.3.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

module-from-string prototype pollution

A prototype pollution in the lib.requireFromString function of module-from-string v3.3.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

GHSA-Q5J8-9M9G-X2JH module-from-string prototype pollution

A prototype pollution in the lib.requireFromString function of module-from-string v3.3.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

@alvori/app (>=1.0.0-beta.11, <=1.0.0-beta.12), @enhanced-dom/intl (>=0.0.1, <=0.2.0) +111 more potentially affected by CVE-2024-57072 via module-from-string (>=3.3.0, <=3.3.1)

module-from-string NPM version =3.3.0, =1.0.0-beta.11, =0.0.1, =0.0.2, =0.0.1, =0.0.1, =0.0.2, =0.0.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.1, =0.1.1, =0.4.0 and more Source cves: CVE-2024-57072 Source advisory: OSV:GHSA-Q5J8-9M9G-X2JH...

CVE-2024-36942

creationtimestamp| type| source ---|---|--- 2025-02-06 02:39:18+00:00| seen| Telegram/peDCfIXDudcmYZeohNb1-aewMZp4J5Ke48SfPFpN0taenzWk...

CVE-2024-57072

A prototype pollution in the lib.requireFromString function of module-from-string v3.3.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2022-2992

A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint...