CVE-2025-48237

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPFactory Wishlist for WooCommerce wish-list-for-woocommerce allows Stored XSS.This issue affects Wishlist for WooCommerce: from n/a through = 3.2.2...

CVE-2025-48280

CVE-2025-48280 (AutomatorWP) — SQL Injection in AutomatorWP prior to 5.2.1.3 due to improper neutralization of special elements in SQL commands, enabling blind SQL injection. Affected: AutomatorWP up to 5.2.1.3. Mitigation: upgrade to a version later than 5.2.1.3 (patches/updates referenced in Pa...

CVE-2025-48278

CVE-2025-48278 affects the WordPress RSVPMarker plugin (versions n/a through 11.5.6). The vulnerability is an SQL Injection caused by improper neutralization of special elements in SQL commands. The connected documents confirm the issue exists in RSVPMarker up to 11.5.6, with PatchStack and CVE r...

CVE-2025-48278 WordPress RSVPMarker <= 11.5.6 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in davidfcarr RSVPMarker allows SQL Injection. This issue affects RSVPMarker : from n/a through 11.5.6...

CVE-2025-48113

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Broadstreet Broadstreet Ads broadstreet allows Stored XSS.This issue affects Broadstreet Ads: from n/a through = 1.51.2...

CVE-2025-4804 WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Hotpot Configuration

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in WatchGuard Fireware OS allows Stored XSS via the spamBlocker module. This vulnerability requires an authenticated administrator session to a locally managed Firebox...

CVE-2025-48137

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in proxymis Interview allows SQL Injection. This issue affects Interview: from n/a through 1.01...

CVE-2025-32301

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in LambertGroup CountDown Pro WP Plugin circularcountdown allows SQL Injection.This issue affects CountDown Pro WP Plugin: from n/a through = 2.7...

CVE-2025-31926

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in LambertGroup Sticky Radio Player lbg-audio5-html5-shoutcaststicky allows SQL Injection.This issue affects Sticky Radio Player: from n/a through = 3.4...

CVE-2025-31926

CVE-2025-31926 : LambertGroup Sticky Radio Player for WordPress (vulnerable up to 3.4) suffers an SQL Injection due to improper neutralization of input elements. According to the sources, the CVSS v3.1 base score is 8.5 (HIGH) with Network attack vector, LOW attack complexity, and LOW privileges ...

CVE-2025-31928

CVE-2025-31928 affects LambertGroup’s WordPress plugin Multimedia Responsive Carousel with Image Video Audio Support (versions

CVE-2025-48137

CVE-2025-48137 refers to a SQL Injection in the WordPress Interview plugin (Interview) affecting versions up to 1.01 due to improper neutralization of SQL elements. Public sources (NVD/PATCHSTACK/Red Hat/ Circl/CVE lists) confirm the issue and its CVE coverage; exploitation details are not provid...

WordPress plugin UberSlider SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...

WordPress plugin Apollo SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...

WordPress plugin Sticky HTML5 Music Player SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

Security Bulletin: Astronomer with IBM is vulnerable to arbitrary code execution due to the LangChain package (CVE-2023-38896).

Summary LangChain is used by Astronomer with IBM as part of LLM processing. Vulnerability Details CVEID:CVE-2023-38896 DESCRIPTION: LangChain could allow a remote attacker to execute arbitrary code on the system, caused by improper neutralization of user supplied-input by the frommathprompt and...

CVE-2025-46786 Zoom Workplace Apps - Cross-site Scripting

Cross-site scripting in some Zoom Workplace Apps may allow an authenticated user to impact app integrity via network access...

CVE-2025-30664 Zoom Workplace Apps - Cross-site Scripting

Cross-site scripting in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via local access...

CVE-2025-30664 Zoom Workplace Apps - Cross-site Scripting

Cross-site scripting in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via local access...

Zoom Workplace 注入漏洞

Zoom Workplace is a desktop application from Zoom USA. Zoom Workplace suffers from an injection vulnerability that stems from improper neutralization of a special element, which could affect application integrity...