CVE-2025-28935

CVE-2025-28935 is a Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin FancyBox Plus up to version 1.0.1 . The issue is described as an improper neutralization of input during web page generation, enabling reflected XSS attempts. The connected documents provide the same de...

CVE-2025-30571

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in STEdb Corp. STEdb Forms stedb-forms allows SQL Injection.This issue affects STEdb Forms: from n/a through = 1.0.4...

CVE-2025-30553

CVE-2025-30553 (GMO Font Agent) : The GMO Font Agent WordPress plugin is affected up to version 1.6, with an authenticated Stored Cross-Site Scripting vulnerability (type: Cross-site Scripting via improper input neutralization during page generation). The issue can be triggered by an authenticate...

CVE-2025-27888

Affected software and issue: Apache Druid with the management proxy enabled is vulnerable to SSRF, XSS, and Open Redirect via specially crafted URLs. Root cause / vulnerability details: When a request is proxied through the Druid management proxy, a crafted URL can redirect to an arbitrary server...

CVE-2024-8997

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Vestel EVC04 Configuration Interface allows SQL Injection. This issue affects EVC04 Configuration Interface: before V3.187, V4.53...

Tiki Wiki CMS Groupware < 28.0 Multiple Vulnerabilities

Tiki Wiki CMS Groupware is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2024-12992

Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection via RCE. This issue affects Pandora FMS from 700 to 777.6...

CVE-2024-12971

Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection.This issue affects Pandora FMS from 700 to 777.6...

CVE-2024-12971

CVE-2024-12971 affects Pandora FMS versions 700–777.6. The issue is an OS command injection caused by improper neutralization of special elements in commands, enabling execution of arbitrary commands. Public exploitation is demonstrated by a Metasploit module that requires admin access to Pandora...

Dell SmartFabric OS10 命令注入漏洞

Dell SmartFabric OS10 is a software-defined network operating system from Dell Networking, based on Linux and open source technologies, designed to enable flexible management and automated deployment of data center network resources. Dell SmartFabric OS10 suffers from a command injection...

CVE-2025-26553 WordPress Pre Order Addon for WooCommerce plugin<= 1.0.7 - Reflected Cross-Site Scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Spring Devs Pre Order Addon for WooCommerce – Advance Order/Backorder Plugin wc-pre-order allows Reflected XSS.This issue affects Pre Order Addon for WooCommerce – Advance Order/Backorder Plugin:...

CVE-2025-23744 WordPress Random Posts, Mp3 Player + ShareButton plugin <= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in dvs11 Random Posts, Mp3 Player + ShareButton random-posts-mp3-player-sharebutton allows Reflected XSS.This issue affects Random Posts, Mp3 Player + ShareButton: from n/a through = 1.4.1...

CVE-2025-28929

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Vivek Marakana Tabbed Login Widget tabbed-login allows Stored XSS.This issue affects Tabbed Login Widget: from n/a through = 1.1.2...

CVE-2025-26633

Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally...

CVE-2025-26633

Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally...

CVE-2025-26633

CVE-2025-26633 is a local-privilege-escalation in Microsoft Management Console (MMC) caused by improper neutralization in how MMC loads language-twin .msc files. A malicious “evil twin” .msc in a language directory can execute payloads with the user’s privileges when a user opens a legitimate MMC...

CVE-2024-54018

Multiple improper neutralization of special elements used in an OS Command vulnerabilities CWE-78 in FortiSandbox before 4.4.5 allows a privileged attacker to execute unauthorized commands via crafted requests...

CVE-2024-54026

An improper neutralization of special elements used in an sql command 'sql injection' in Fortinet FortiSandbox 4.4.0 through 4.4.6, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions, FortiSandb...

CVE-2024-52961

An improper neutralization of special elements used in an OS Command vulnerability CWE-78 vulnerability in Fortinet FortiSandbox 5.0.0, FortiSandbox 4.4.0 through 4.4.6, FortiSandbox 4.2.1 through 4.2.7, FortiSandbox 4.0.0 through 4.0.5, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all version...

CVE-2024-54018

CVE-2024-54018 affects Fortinet FortiSandbox prior to 4.4.5, where improper neutralization of special elements in OS commands (CWE-78) allows a privileged attacker to execute unauthorized commands via crafted requests. Impact per provided data includes high confidentiality, integrity, and availab...