CVE-2025-0547

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Paraşüt Software Bizmu allows Cross-Site Scripting XSS. This issue affects Bizmu: from 2.27.0 through 20250212...

CVE-2025-0547 XSS in Mikrogrup's Bizmu

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Paraşüt Software Bizmu allows Cross-Site Scripting XSS. This issue affects Bizmu: from 2.27.0 through 20250212...

CVE-2025-5305

The Password Reset with Code for WordPress REST API WordPress plugin before 0.0.17 does not use cryptographically sound algorithms to generate OTP codes, potentially leading to account takeovers...

CVE-2025-5305 Password Reset with Code < 0.0.17 - Insecure Password Reset Code Creation

The Password Reset with Code for WordPress REST API WordPress plugin before 0.0.17 does not use cryptographically sound algorithms to generate OTP codes, potentially leading to account takeovers...

[SECURITY] Fedora 41 Update: lemonldap-ng-2.21.3-1.fc41

LemonLdap::NG is a modular Web-SSO based on Apache::Session modules. It simplifies the build of a protected area with a few changes in the application. It manages both authentication and authorization and provides headers for accounting. So you can have a full AAA protection for your web space as...

PT-2025-38299

Name of the Vulnerable Software and Affected Versions Password Reset with Code for WordPress REST API plugin versions prior to 0.0.17 Description The plugin does not employ cryptographically secure algorithms for generating One-Time Password OTP codes, which could allow for account takeovers...

CVE-2025-5305: Undefined Security Weakness

The Password Reset with Code for WordPress REST API WordPress plugin before 0.0.17 does not use cryptographically sound algorithms to generate OTP codes, potentially leading to account takeovers...

E-learning security feature vulnerabilities

e-learning is an exam system for youth-is-as-pale-as-poetry individual developers. A security feature issue vulnerability exists in e-learning version 1.0, which stems from insufficient generation of random values by the encryptSecret function in the JwtUtils.java file in the JWT Token Handler...

CVE-2025-0420

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Paraşüt Software Paraşüt allows Cross-Site Scripting XSS. This issue affects Paraşüt: from 0.0.0.65efa44e through 20250204...

CVE-2025-0420

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Paraşüt Software Paraşüt allows Cross-Site Scripting XSS. This issue affects Paraşüt: from 0.0.0.65efa44e through 20250204...

CVE-2025-0420

Paraşüt XSS (CVE-2025-0420) is due to improper input neutralization during web page generation. Affected versions range from 0.0.0.65efa44e through 20250204. Multiple sources (Red Hat, NVD, CVE List, VulnEnrichment, PT Security) confirm the issue and consistent remediation guidance: upgrade Paraş...

CVE-2025-59399

libocpp before 0.28.0 allows a denial of service EVerest crash because a secondary exception is thrown during error message generation...

PT-2025-38128

Name of the Vulnerable Software and Affected Versions: Zirve Nova versions 235 through 20250131 Description: Zirve Nova is susceptible to a Cross-Site Scripting XSS issue due to improper neutralization of input during web page generation. This allows for the injection of malicious scripts into we...

OpenBao Secret Encryption Management System Code Execution

The vulnerability of the OpenBao encryption and secret management system lies in improper handling of code generation, particularly by manipulating the prefixes of logs. Exploiting this vulnerability allows a remote attacker to generate arbitrary codes...

Shopside App Cross-Site Script Vulnerability

Shopside App is a shopping application from the Turkish company Shopside. A cross-site scripting vulnerability exists in Shopside App versions prior to 17.02.2025, which stems from improper input neutralization during web page generation and could lead to cross-site scripting attacks...

Zirve Nova cross-site scripting vulnerability

Zirve Nova is an accounting and financial management software from the Turkish company Zirve Nova. A cross-site scripting vulnerability exists in Zirve Nova versions 235 through 20250131, which stems from improper input neutralization during web page generation and could lead to cross-site...

CVE-2023-53328 fs/ntfs3: Enhance sanity check while generating attr_list

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Enhance sanity check while generating attrlist nicreateattrlist uses WARNON to catch error cases while generating attribute list, which only prints out stack trace and may not be enough. This repalces them with more...

CVE-2023-53304

CVE-2023-53304 concerns the Linux kernel netfilter nft_set_rbtree code. The advisory describes three concrete issues resolved by patching: 1) a lazy garbage-collection on insert that may fail to release the other half of an interval, impacting interval timing expiration walks; 2) incorrect use of...

CVE-2024-12796

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Holistic IT, Consultancy Coop. Workcube ERP allows Reflected XSS. This issue affects Workcube ERP: from V12 - V14 before Cognitive...

CVE-2025-2404

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Ubit Information Technologies STOYS allows Cross-Site Scripting XSS. This issue affects STOYS: from 2 before 20250916...