9517 matches found
CVE-2025-30813
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in listamester Listamester listamester allows Stored XSS.This issue affects Listamester: from n/a through = 2.3.5...
CVE-2025-30883 WordPress Trust.Reviews plugin <= 2.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in richplugins Trust.Reviews fb-reviews-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trust.Reviews: from n/a through = 2.3...
CVE-2025-29993
The affected versions of PowerCMS allow HTTP header injection. This vulnerability can be leveraged to direct the affected product to send email with a tampered URL, such as password reset mail...
CVE-2025-27551
DBIx::Class::EncodedColumn use the rand function, which is not cryptographically secure to salt password hashes. This vulnerability is associated with program files lib/DBIx/Class/EncodedColumn/Digest.pm. This issue affects DBIx::Class::EncodedColumn until 0.00032. Mitigation Mitigation for this...
CVE-2024-48944
creationtimestamp| type| source ---|---|--- 2025-03-27 02:03:49+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3lld7ipbs3y2k 2025-03-27 16:27:05+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/9139...
electron{33,34} -- Incorrect handle provided in unspecified circumstances in Mojo
Electron developers report: This update fixes the following vulnerability: Security: backported fix for CVE-2025-2783...
CVE-2025-29489
libming v0.4.8 was discovered to contain a memory leak via the parseSWFMORPHLINESTYLES function...
CVE-2025-30093
HTCondor 23.0.x before 23.0.22, 23.10.x before 23.10.22, 24.0.x before 24.0.6, and 24.6.x before 24.6.1 allows authenticated attackers to bypass authorization restrictions...
lunary access control error vulnerability (CNVD-2025-07600)
lunary is lunary open source a production toolkit for LLM . An access control error vulnerability exists in lunary that stems from improper access control on the /prompts/promptid endpoint, and no detailed vulnerability details are provided at this time...
CVE-2025-20230 Missing Access Control and Incorrect Ownership of Data in App Key Value Store (KVStore) collections in the Splunk Secure Gateway App
In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could edit and delete other user data in App Key Value...
CVE-2025-20227 Information Disclosure through external content warning modal dialog box bypass in Splunk Enterprise Dashboard Studio
In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.112, 9.2.2403.115, 9.1.2312.208 and 9.1.2308.214, a low-privileged user that does not hold the "admin" or "power" Splunk roles could bypass the external content...
CVE-2025-2838
CVE-2025-2838 affects Silicon Labs Gecko OS. The issue is a logic error in DNS response processing that can cause an infinite loop, leading to denial of service. Attack requires network adjacency and no authentication. Impact is Availability (per CVSS: AV:A, AC:L, PR:N, UI:N, S:U, C:N, I:N, A:H; ...
CVE-2025-2528
Improper authorization in application password policy in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a configuration different from the one mandated by the system administrators. This issue affects Remote Desktop Manager versions from 2025.1.24 through...
CVE-2025-26747 WordPress RainbowNews theme <= 1.0.7 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 99colorthemes RainbowNews allows Stored XSS.This issue affects RainbowNews: from n/a through 1.0.7...
CVE-2025-26560 WordPress WP Contact Form III Plugin <= 1.6.2d - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NotFound WP Contact Form III allows Reflected XSS. This issue affects WP Contact Form III: from n/a through 1.6.2d...
CVE-2024-13801 BWL Advanced FAQ Manager <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update
The BWL Advanced FAQ Manager plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'bafsetnoticestatus' AJAX action in all versions up to, and including, 2.1.4. This makes it possible for authenticated...
CVE-2025-26010
Telesquare TLR-2005KSH 1.1.4 allows unauthorized password modification when requesting the admin.cgi parameter with setUserNamePassword...
CVE-2025-27830
creationtimestamp| type| source ---|---|--- 2025-03-25 23:40:39+00:00| seen| https://t.me/cvedetector/21125 2025-03-26 01:04:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3llalpbbiml26...
CVE-2025-30222
Shescape vulnerability (CVE-2025-30222) affects versions 1.7.2–2.1.1 of the JavaScript shell-escape library. On Windows, when shell: 'cmd.exe' or shell: true is configured and any of quote/quoteAll/escape/escapeAll is used, an attacker may gain read-only access to environment variables due to env...
