CVE-2025-32128

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in aaronfrey Nearby Locations nearby-locations allows SQL Injection.This issue affects Nearby Locations: from n/a through = 1.1.1...

CVE-2025-32230

CVE-2025-32230 is a Tutor LMS HTML Injection (Basic XSS) vulnerability. The Wordfence vulnerability entry confirms it affects Tutor LMS versions up to 3.4.0 and notes the issue stems from improper neutralization of script-related HTML tags, enabling potential HTML injection. The vulnerability is ...

CVE-2024-38865 Livestatus command injection in RestAPI

Improper neutralization of livestatus command delimiters in a specific endpoint within RestAPI of Checkmk prior to 2.2.0p39, 2.3.0p25, and 2.1.0p51 EOL allows arbitrary livestatus command execution. Exploitation requires the attacker to have a contact group assigned to their user account and for ...

CVE-2024-38865

CVE-2024-38865 affects Checkmk RestAPI: an improper neutralization of livestatus command delimiters in a specific endpoint allows arbitrary livestatus command execution. Affected versions are prior to 2.2.0p39, 2.3.0p25, and 2.1.0p51 (EOL). Exploitation requires the attacker to belong to a contac...

CVE-2025-31394

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kailey trepmal More Mime Type Filters more-mime-type-filters allows Stored XSS.This issue affects More Mime Type Filters: from n/a through = 0.3...

CVE-2025-31020 WordPress Simple Spoiler plugin <= 1.4 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Webliberty Simple Spoiler simple-spoiler allows Stored XSS.This issue affects Simple Spoiler: from n/a through = 1.4...

Security update for azure-cli-core

This update for azure-cli-core fixes the following issues: CVE-2025-24049: Fixed improper neutralization of special elements used in a command allows an unauthorized attacker to elevate privileges locally bsc1239460 Patch Instructions: To install this SUSE update use the SUSE recommended...

CVE-2025-32020

CVE-2025-32020 affects the crud-query-parser library. The vulnerability arises from improper neutralization of the order/sort parameter in the TypeORM adapter when ordering is enabled and a property filter is not configured, enabling SQL injection. Impacted environments are those using the TypeOR...

K000150744: PostgreSQL vulnerability CVE-2025-1094

Security Advisory Description Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral, PQescapeIdentifier, PQescapeString, and PQescapeStringConn allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requir...

CVE-2025-31898

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in dustinscarberry MediaView mediaview allows Reflected XSS.This issue affects MediaView: from n/a through = 1.1.2...

CVE-2025-32169

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Suresh Prasad Showeblogin Social showeblogin-facebook-page-like-box allows DOM-Based XSS.This issue affects Showeblogin Social: from n/a through = 7.0...

CVE-2025-32127

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in onOffice GmbH onOffice for WP-Websites onoffice-for-wp-websites allows SQL Injection.This issue affects onOffice for WP-Websites: from n/a through = 5.7...

CVE-2025-32191

CVE-2025-32191 affects News Element Elementor Blog Magazine (WordPress plugin), with versions up to 1.0.7. The connected document confirms a Stored Cross-Site Scripting (authenticated: Contributor+ required) vulnerability in how input is handled and surfaced in web page content. The core issue is...

CVE-2025-32189 WordPress BWD Elementor Addons plugin <= 4.4.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Best WP Developer BWD Elementor Addons bwd-elementor-addons allows DOM-Based XSS.This issue affects BWD Elementor Addons: from n/a through = 4.4.2...

CVE-2025-32170

CVE-2025-32170 concerns the Motors – Car Dealership & Classified Listings WordPress plugin. The Connected Wordfence entry identifies an Authenticated Local File Inclusion (LFI) vulnerability affecting Motors versions up to 1.4.71, with patching applied in 1.4.71. The CVE description in the Initia...

CVE-2025-32126

The CVE CVE-2025-32126 affects the WordPress plugin Pay with Contact Form 7 by cmsMinds. It is an SQL Injection vulnerability caused by improper neutralization of input in SQL commands, affecting versions from n/a up to 1.0.4. The CVSS indicates high impact on confidentiality (C) but no impact on...

CVE-2025-31619

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in marcoingraiti Actionwear products sync actionwear-products-sync allows SQL Injection.This issue affects Actionwear products sync: from n/a through = 2.3.3...

CVE-2025-31552

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in davidfcarr RSVPMarker rsvpmaker allows SQL Injection.This issue affects RSVPMarker : from n/a through = 11.6.7...

CVE-2025-31534

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in shopperdotcom Shopper shopper allows SQL Injection.This issue affects Shopper: from n/a through = 3.2.5...

CVE-2025-31085

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Michel - xiligroup dev xili-language xili-language allows Reflected XSS.This issue affects xili-language: from n/a through = 2.21.2...