CVE-2025-10875

Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Code Injection.This issue affects Mulesoft Anypoint Code Builder: before 1.11.6...

Improper Input Validation

@digitalocean/do-markdownit is vulnerable to Improper Input Validation. The vulnerability is due to the callout and fenceenvironment plugins using .includes substring matching when allowedClasses or allowedEnvironments are strings instead of arrays, which allows an attacker to bypass intended...

Improper Input Validation

Overview dataproduct-mcp is an A Model Context Protocol MCP server for discovering data products, requesting access, and executing queries on the data platform to access business data. Affected versions of this package are vulnerable to Improper Input Validation due to the detector being disabled...

EUVD-2025-37328

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in colabrio Ohio Extra ohio-extra allows DOM-Based XSS.This issue affects Ohio Extra: from n/a through = 3.6.0...

CVE-2025-64367

The CVE-2025-64367 entries concern a Stored XSS in the WordPress Groundhogg plugin

CVE-2025-64362 WordPress K Elements plugin < 5.5.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in SeventhQueen K Elements k-elements allows DOM-Based XSS.This issue affects K Elements: from n/a through 5.5.0...

Improper Input Validation

flowise is vulnerable to improper input validation. The vulnerability is due to missing validation of chatflowId and chatId parameters, which allows an attacker to access arbitrary files through improper handling of file upload operations...

PT-2025-44616

Name of the Vulnerable Software and Affected Versions colabrio Ohio Extra versions through 3.6.0 Description The software contains a flaw related to improper input handling during web page generation, specifically a DOM-Based Cross-Site Scripting issue. This allows for the potential execution of...

Nagios XI 安全漏洞

Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems, and more. A security vulnerability exists in Nagios XI versions prior to 2024R1.1 that stems from the page-missing.p...

Devolutions Server Improper Input Validation Vulnerability

Devolutions Server is a security solution for managing privileged accounts and sessions, designed to help organizations centrally store and manage sensitive information such as passwords and credentials. Devolutions Server suffers from an improper input validation vulnerability that stems from...

PT-2025-44612

Name of the Vulnerable Software and Affected Versions Consulting Elementor Widgets versions through 1.4.2 Description The software contains a flaw due to improper neutralization of input during web page generation, leading to a Cross-site Scripting XSS condition. This specific instance is a...

PT-2025-44618

Name of the Vulnerable Software and Affected Versions Groundhogg versions through 4.2.6 Description The software contains a flaw due to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that malicious scripts can be stored on...

Improper Input Validation

Dragonfly is vulnerable to Improper Input Validation. The vulnerability is due to insufficient validation in the gRPC and HTTP APIs, which allows an attacker to send crafted requests that create or read arbitrary files on a peer’s system, leading to data theft and potential remote code execution...

Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables

Improper Validation of Consistency within Input vulnerability in Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables. This issue affects Reverse Proxy Header: from 0.0.0 before 1.1.2...

EUVD-2025-36880

Drupal JSON Field is vulnerable to XSS...

CVE-2025-10931

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Umami Analytics allows Cross-Site Scripting XSS.This issue affects Umami Analytics: from 0.0.0 before 1.0.1...

Drupal CivicTheme Design System 安全漏洞

Drupal CivicTheme Design System is a theme design plugin for the Drupal community. A security vulnerability exists in Drupal CivicTheme Design System versions prior to 1.12.0, which stems from improper input neutralization during page generation and could lead to a cross-site scripting attack...

CVE-2025-36081

IBM Concert Software 1.0.0 through 2.0.0 could allow a user to modify system logs due to improper neutralization of log input...

EUVD-2025-36628

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sizam Rehub rehub-theme allows Stored XSS.This issue affects Rehub: from n/a through 19.9.9.1...

CVE-2025-64202 WordPress Sahifa theme < 5.8.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in TieLabs Sahifa sahifa allows DOM-Based XSS.This issue affects Sahifa: from n/a through 5.8.6...