CVE-2025-41099

CVE-2025-41099 describes an insecure direct object reference in Bold Workplanner before version 2.5.25 (build 4935b438f9b). The issue arises from insufficient input validation, allowing an authenticated user to access the internal list of permissions using unauthorized internal identifiers, with ...

PT-2025-40003

Name of the Vulnerable Software and Affected Versions Versions prior to 2025-54476 Description Improper handling of input can result in a cross-site scripting XSS vector within the checkAttribute method of the input filter framework class. Recommendations At the moment, there is no information...

Security Bulletin: IBM InfoSphere Information Server is affected by an improper input validation vulnerability in Apache POI (CVE-2025-31672)

Summary An improper input validation vulnerability in Apache POI that is used by InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2025-31672 DESCRIPTION: Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xls...

PT-2025-39818

Name of the Vulnerable Software and Affected Versions Perfex CRM version 3.2.1 Description An HTML injection issue exists in Perfex CRM version 3.2.1. This is due to insufficient validation of user-supplied data. The issue occurs when sending a POST request to the /admin/leads/lead endpoint with...

Chef Software Chef Automate SQL注入漏洞

Chef Software Chef Automate is an automation platform from Chef Software for automating and managing infrastructure, applications, and compliance to help organizations achieve continuous delivery, automated operations, and security compliance. A SQL injection vulnerability exists in Chef Software...

GE UR family Improper Input Validation (CVE-2021-27418)

GE UR firmware versions prior to version 8.1x supports web interface with read-only access. The device fails to properly validate user input, making it possible to perform cross-site scripting attacks, which may be used to send a malicious script. Also, UR Firmware web server does not perform HTM...

GE UR family Improper Input Validation (CVE-2021-27420)

GE UR firmware versions prior to version 8.1x web server task does not properly handle receipt of unsupported HTTP verbs, resulting in the web server becoming temporarily unresponsive after receiving a series of unsupported HTTP requests. When unresponsive, the web server is inaccessible. By...

CVE-2025-6396

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Webbeyaz Website Design Website Software allows Cross-Site Scripting XSS.This issue affects Website Software: through 2025.07.14...

CVE-2025-48107

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in undsgn Uncode uncode allows Reflected XSS.This issue affects Uncode: from n/a through 2.9.4.4...

GHSA-FMJH-F678-CV3X github.com/nyaruka/phonenumbers Vulnerable to Improper Validation of Syntactic Correctness of Input

Versions of the package github.com/nyaruka/phonenumbers before 1.2.2 are vulnerable to Improper Validation of Syntactic Correctness of Input in the phonenumbers.Parse function. An attacker can cause a panic by providing crafted input causing a "runtime error: slice bounds out of range"...

CVE-2025-10954

Versions of the package github.com/nyaruka/phonenumbers before 1.2.2 are vulnerable to Improper Validation of Syntactic Correctness of Input in the phonenumbers.Parse function. An attacker can cause a panic by providing crafted input causing a "runtime error: slice bounds out of range"...

CVE-2025-6396 XSS in Webbeyaz's web site

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Webbeyaz Website Design Website Software allows Cross-Site Scripting XSS. This issue affects Website Software: through 2025.07.14...

CVE-2025-6396

CVE-2025-6396 affects Webbeyaz Website Design Website Software (versions through 2025.07.14). The root cause is improper neutralization of input during web page generation, leading to cross-site scripting (XSS). The CVSS–3.1 vector indicates NETWORK access, LOW attack complexity, no privileges re...

CVE-2025-6396

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Webbeyaz Website Design Website Software allows Cross-Site Scripting XSS. This issue affects Website Software: through 2025.07.14...

CVE-2025-60162

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PickPlugins Job Board Manager job-board-manager allows DOM-Based XSS.This issue affects Job Board Manager: from n/a through = 2.1.61...

CVE-2025-60142

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in DaganLev Simple Meta Tags simple-meta-tags allows DOM-Based XSS.This issue affects Simple Meta Tags: from n/a through = 1.5...

CVE-2025-60133

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in DJ-Extensions.com PE Easy Slider pe-easy-slider allows Stored XSS.This issue affects PE Easy Slider: from n/a through = 1.1.0...

CVE-2025-60124

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ryan Hellyer Simple Colorbox simple-colorbox allows Stored XSS.This issue affects Simple Colorbox: from n/a through = 1.6.1...

CVE-2025-60177

CVE-2025-60177 describes a Stored XSS in the Recaptcha – wp WordPress plugin. Affected: Recaptcha – wp from n/a through 0.2.6. Root cause: improper neutralization of input during web page generation. Impact per CVSS: Confidentiality/Integrity/Availability Low, but attacker requires High privilege...

CVE-2025-60160

CVE-2025-60160 affects the WordPress plugin Smart Related Products (WooCommerce). The issue is a stored XSS caused by improper input neutralization during web page generation. Affected versions include up to 2.0.6 (initial description lists up to 2.0.5; connected doc shows