8354 matches found
CVE-2025-8568: Improper Neutralization of Input During Web Page Generation
The GMap Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘h’ parameter in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...
IAG: Input-Aware Backdoor Attack on VLMs for Visual Grounding
Vision-language models VLMs have shown significant advancements in tasks such as visual grounding, where they localize specific objects in images based on natural language queries and images. However, security issues in visual grounding tasks for VLMs remain underexplored, especially in the conte...
WordPress plugin Wp chart generator 跨站脚本漏洞
WordPress Wp chart generator plugin is a plugin for generating charts in WordPress blogs. Users can create multiple charts through the backend admin interface and embed them in posts or pages using the generated shortcode. A cross-site scripting vulnerability exists in the WordPress Wp chart...
PT-2025-32618 · WordPress · Gmap Generator
Name of the Vulnerable Software and Affected Versions: GMap Generator plugin for WordPress versions up to and including 1.1 Description: The GMap Generator plugin for WordPress is susceptible to Stored Cross-Site Scripting through the h parameter. Insufficient input sanitization and output escapi...
PT-2025-32620 · WordPress · Wp Chart Generator
Name of the Vulnerable Software and Affected Versions: Wp chart generator versions up to and including 1.0.4 Description: The Wp chart generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting through the plugin’s wpchart shortcode due to insufficient input sanitization and outp...
WordPress plugin GMap Generator 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. The WordPress GMap Generator plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied...
CVE-2025-8621: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
The Mosaic Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘c’ parameter in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access an...
PT-2025-32619 · WordPress · Mosaic Generator
Name of the Vulnerable Software and Affected Versions: Mosaic Generator plugin for WordPress versions up to and including 1.0.5 Description: The Mosaic Generator plugin for WordPress is susceptible to Stored Cross-Site Scripting through the c parameter due to insufficient input sanitization and...
WordPress Mosaic Generator plugin <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'c' Parameter vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via 'c' Parameter vulnerability discovered by muhammad yudha in WordPress Plugin Mosaic Generator versions = 1.0.5...
WordPress Wp chart generator plugin <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpchart Shortcode vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via wpchart Shortcode vulnerability discovered by muhammad yudha in WordPress Plugin Wp chart generator versions = 1.0.4...
WordPress GMap - Venturit plugin <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'h' Parameter vulnerability
WordPress GMap - Venturit plugin = 1.1 - Authenticated Contributor+ Stored Cross-Site Scripting via 'h' Parameter vulnerability discovered by muhammad yudha in WordPress Plugin GMap Generator versions = 1.1...
firefox: thunderbird: Incorrect JavaScript state machine for generators
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: The JavaScript engine did not handle closed generators correctly, and it was possible to resume them, resulting in a nullptr dereference...
firefox: thunderbird: Incorrect JavaScript state machine for generators
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: The JavaScript engine did not handle closed generators correctly, and it was possible to resume them, resulting in a nullptr dereference...
BIT-LIBPHP-2023-3247 Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP
In PHP versions 8.0. before 8.0.29, 8.1. before 8.1.20, 8.2. before 8.2.7 when using SOAP HTTP Digest Authentication, random value generator was not checked for failure, and was using narrower range of values than it should have. In case of random generator failure, it could lead to a disclosure ...
Linux Distros Unpatched Vulnerability : CVE-2025-21925
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - llc: do not use skbget before devqueuexmit syzbot is able to crash hosts 1, using llc and devices not supporting IFFTXSKBSHARING. In this case, e1000 driver cal...
Linux Distros Unpatched Vulnerability : CVE-2023-52753
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amd/display: Avoid NULL dereference of timing generator Why & How Check whether assigned timing generator is NULL or not before accessing its funcs to preve...
Linux Distros Unpatched Vulnerability : CVE-2017-15116
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The rngapireset function in crypto/rng.c in the Linux kernel before 4.2 allows attackers to cause a denial of service NULL pointer dereference. CVE-2017-15116...
UBUNTU-CVE-2025-8733
A flaw has been found in GNU Bison up to 3.8.2. This affects the function obstackvprintfinternal of the file obprintf.c. Executing manipulation can lead to reachable assertion. The attack requires local access. The exploit has been published and may be used. It is still unclear if this...