CVE-2025-3840 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

An improper neutralization of input vulnerability was identified in the End of Life EOL OVA based connect installer component which is deployed for installation purposes in a customer network. This EOL component was deprecated in September 2023 with end of support extended till January 2024. An...

CVE-2025-3840 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

An improper neutralization of input vulnerability was identified in the End of Life EOL OVA based connect installer component which is deployed for installation purposes in a customer network. This EOL component was deprecated in September 2023 with end of support extended till January 2024. An...

SQL Injection

crud-query-parser is vulnerable to SQL Injection. The vulnerability is due to improper neutralization of the order/sort parameter. Specifically, it occurs because there is no property filter setup when using the TypeORM adapter with ordering enabled, allowing an attacker to inject malicious SQL...

CVE-2025-32636

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in matthewrubin Local Magic local-magic allows SQL Injection.This issue affects Local Magic: from n/a through = 2.9.0...

CVE-2025-27284

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in divspark Flagged Content flagged-content allows Reflected XSS.This issue affects Flagged Content: from n/a through = 1.0.2...

CVE-2025-24621 WordPress Arconix Shortcodes plugin <= 2.1.15 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Reflected XSS.This issue affects Arconix Shortcodes: from n/a through = 2.1.15...

SUSE CVE-2025-23392

A Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in spacewalk-java allows execution of arbitrary Javascript code on target systems.This issue affects Container suse/manager/5.0/x8664/server:5.0.4.7.19.1: from ? before 5.0.24-150600.3.25.1; Container...

PT-2025-17147 · Unknown · Contestswp

Name of the Vulnerable Software and Affected Versions: Run Contests, Raffles, and Giveaways with ContestsWP versions n/a through 2.0.6 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Reflected...

CVE-2025-22373

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in SicommNet BASEC on SaaS allows Reflected XSS, XSS Through HTTP Query Strings, Rendering of Arbitrary HTML and alternation of CSS Styles This issue affects BASEC: from 14 Dec 2021...

CVE-2025-26982

CVE-2025-26982 corresponds to a DOM-based XSS in the DSGVO Youtube WordPress plugin (DSGVO Youtube) prior to or up to version 1.5.1. The issue arises from improper input neutralization during web page generation, enabling DOM-based Cross-Site Scripting. The vulnerability affects DSGVO Youtube 1.5...

CVE-2025-26745

CVE-2025-26745 : In RS Elements Elementor Addon for WordPress, an Stored XSS exists due to improper neutralization during web page generation. Affected: RS Elements Elementor Addon from n/a through 1.1.5. Root cause and impact are stated; exploitation status is not detailed in the provided docume...

CVE-2025-32650

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ability, Inc Accessibility Suite online-accessibility allows SQL Injection.This issue affects Accessibility Suite: from n/a through = 4.18...

CVE-2025-31028

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Huseyin Berberoglu WP Hide Categories wp-hide-categories allows Reflected XSS.This issue affects WP Hide Categories: from n/a through = 1.0...

CVE-2025-32517

CVE-2025-32517 is a Reflected Cross-Site Scripting (XSS) in the SCAND MultiMailer WordPress plugin. Affected versions are up to 1.0.3 (per initial details). CVSS v3.1 metrics show a base score of 7.1 (HIGH), with AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The Connected documents indicate the vulnerabil...

CVE-2025-32687

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Magnigenie Review Stars Count For WooCommerce review-stars-count-for-woocommerce allows SQL Injection.This issue affects Review Stars Count For WooCommerce: from n/a through = 2.0...

CVE-2025-32128

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in aaronfrey Nearby Locations nearby-locations allows SQL Injection.This issue affects Nearby Locations: from n/a through = 1.1.1...

CVE-2025-32230

CVE-2025-32230 is a Tutor LMS HTML Injection (Basic XSS) vulnerability. The Wordfence vulnerability entry confirms it affects Tutor LMS versions up to 3.4.0 and notes the issue stems from improper neutralization of script-related HTML tags, enabling potential HTML injection. The vulnerability is ...

CVE-2024-38865 Livestatus command injection in RestAPI

Improper neutralization of livestatus command delimiters in a specific endpoint within RestAPI of Checkmk prior to 2.2.0p39, 2.3.0p25, and 2.1.0p51 EOL allows arbitrary livestatus command execution. Exploitation requires the attacker to have a contact group assigned to their user account and for ...

CVE-2024-38865

CVE-2024-38865 affects Checkmk RestAPI: an improper neutralization of livestatus command delimiters in a specific endpoint allows arbitrary livestatus command execution. Affected versions are prior to 2.2.0p39, 2.3.0p25, and 2.1.0p51 (EOL). Exploitation requires the attacker to belong to a contac...

CVE-2025-31394

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kailey trepmal More Mime Type Filters more-mime-type-filters allows Stored XSS.This issue affects More Mime Type Filters: from n/a through = 0.3...