CVE-2025-14072 Ninja Forms < 3.13.3 - Unauthenticated Token Generation and Submission Disclosure

The Ninja Forms WordPress plugin before 3.13.3 allows unauthenticated attackers to generate valid access tokens via the REST API which can then be used to read form submissions...

CVE-2025-14072 Ninja Forms < 3.13.3 - Unauthenticated Token Generation and Submission Disclosure

The Ninja Forms WordPress plugin before 3.13.3 allows unauthenticated attackers to generate valid access tokens via the REST API which can then be used to read form submissions...

EUVD-2026-0708

The Ninja Forms WordPress plugin before 3.13.3 allows unauthenticated attackers to generate valid access tokens via the REST API which can then be used to read form submissions...

CVE-2025-14072

The Ninja Forms WordPress plugin, in versions prior to 3.13.3 , contains a vulnerability allowing unauthenticated attackers to generate valid access tokens via the REST API . An attacker can leverage these tokens to unauthorizedly read form submissions. The root cause is an API endpoint that perm...

CVE-2026-21451: Improper Neutralization of Input During Web Page Generation

Bagisto is an open source laravel eCommerce platform. A stored Cross-Site Scripting XSS vulnerability exists in Bagisto prior to version 2.3.10 within the CMS page editor. Although the platform normally attempts to sanitize...

CVE-2025-11837: Improper Control of Generation of Code

An improper control of generation of code vulnerability has been reported to affect Malware Remover. The remote attackers can then exploit the vulnerability to bypass protection mechanism. We have already fixed the vulnerability in the following version: Malware Remover 6.6.8.20251023 and later...

QNAP Systems Malware Remover 代码注入漏洞

QNAP Systems Malware Remover is a built-in security application from Taiwan, China-based QNAP Systems. A code injection vulnerability exists in QNAP Systems Malware Remover, which stems from improper code generation controls that could lead to a bypass of protection mechanisms...

PT-2026-1053

Name of the Vulnerable Software and Affected Versions Ninja Forms WordPress plugin versions prior to 3.13.3 Description An unauthenticated attacker can generate valid access tokens through the REST API. These tokens can then be used to read form submissions. The affected API endpoint allows acces...

CVE-2025-14072: Undefined Security Weakness

The Ninja Forms WordPress plugin before 3.13.3 allows unauthenticated attackers to generate valid access tokens via the REST API which can then be used to read form submissions...

CVE-2025-69286

RAGFlow is an open-source RAG Retrieval-Augmented Generation engine. In versions prior to 0.22.0, the use of an insecure key generation algorithm in the API key and beta assistant/agent share auth token generation process allows these tokens to be mutually derivable. Specifically, both tokens are...

CVE-2025-59135

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Stored XSS.This issue affects Behance Portfolio Manager: from n/a through = 1.7.5...

CVE-2025-49355

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ikaes Accessibility Press ilogic-accessibility allows Stored XSS.This issue affects Accessibility Press: from n/a through = 1.0.2...

CVE-2025-63021

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in codetipi Valenti Engine valenti-engine allows DOM-Based XSS.This issue affects Valenti Engine: from n/a through = 1.0.3...

CVE-2025-62989

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Gora Tech Cooked cooked allows Stored XSS.This issue affects Cooked: from n/a through = 1.11.3...

CVE-2025-63020

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wayne Allen Postie postie allows Stored XSS.This issue affects Postie: from n/a through = 1.9.73...

CVE-2025-49357

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in audiomack Audiomack audiomack allows Stored XSS.This issue affects Audiomack: from n/a through = 1.4.8...

CVE-2025-62095

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in neilgee Bootstrap Modals bootstrap-modals allows Stored XSS.This issue affects Bootstrap Modals: from n/a through = 1.3.2...

CVE-2025-62125

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Anshul Gangrade Custom Background Changer custom-background-changer allows Stored XSS.This issue affects Custom Background Changer: from n/a through = 3.0...

CVE-2025-62990

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in livemesh Livemesh Addons for Beaver Builder addons-for-beaver-builder allows Stored XSS.This issue affects Livemesh Addons for Beaver Builder: from n/a through = 3.9.2...

CVE-2025-49358

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ruhul Amin Content Fetcher content-fetcher allows DOM-Based XSS.This issue affects Content Fetcher: from n/a through = 1.1...