Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Improper Input Validation in Spring [CVE-2025-22235]

Summary IBM Watson Speech Services Cartridge is vulnerable to an Improper Input Validation in Spring , caused by Spring Boot EndpointRequest.to creating the wrong matcher if the actuator endpoint is not exposed CVE-2025-22235 . Spring is used as part of our Java Microservices. This vulnerabilitiy...

CVE-2025-48349

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in origincode Video Gallery – Vimeo and YouTube Gallery smart-grid-gallery allows Stored XSS.This issue affects Video Gallery – Vimeo and YouTube Gallery: from n/a through = 1.1.7...

CVE-2025-48322

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Finn Dohrn Statify Widget statify-widget allows Stored XSS.This issue affects Statify Widget: from n/a through = 1.4.6...

CVE-2025-48319

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in gslauraspeck Mesa Mesa Reservation Widget mesa-mesa-reservation-widget allows Stored XSS.This issue affects Mesa Mesa Reservation Widget: from n/a through = 1.0.0...

CVE-2025-48349 WordPress Video Gallery – Vimeo and YouTube Gallery plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in origincode Video Gallery – Vimeo and YouTube Gallery allows Stored XSS. This issue affects Video Gallery – Vimeo and YouTube Gallery: from n/a through 1.1.7...

CVE-2025-48315

CVE-2025-48315 is a stored XSS vulnerability in the WordPress HTML plugin (versions

CVE-2025-48314

CVE-2025-48314 describes a Stored XSS in the WordPress plugin Add Code To Head . Affected versions are listed as from unspecified version through 1.17. The vulnerability arises from improper input neutralization during web page generation, enabling attacker-supplied data to execute scripts in a v...

CVE-2025-39496

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WBW WooBeWoo Product Filter Pro allows SQL Injection.This issue affects WooBeWoo Product Filter Pro: from n/a before 2.9.6...

WordPress plugin Yandex Site search pinger 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress plugin Responsive Mobile-Friendly Tooltip 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPre...

PT-2025-35044

Name of the Vulnerable Software and Affected Versions: XmasB Quotes versions through 1.6.1 Description: The software contains a reflected cross-site scripting XSS issue due to improper neutralization of input during web page generation. Recommendations: Update to a version later than 1.6.1...

PT-2025-35072

Name of the Vulnerable Software and Affected Versions: uxper Golo versions through 1.7.1 Description: The software contains a Reflected Cross-Site Scripting XSS issue due to improper neutralization of input during web page generation. Recommendations: Update uxper Golo to a version later than 1.7...

WordPress plugin Listeo-Core SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...

PT-2025-35046

Name of the Vulnerable Software and Affected Versions: NextGEN Gallery Search versions through 2.12 Description: The software contains a Reflected Cross-site Scripting XSS issue due to improper neutralization of input during web page generation. Recommendations: Update NextGEN Gallery Search to a...

PT-2025-35040

Name of the Vulnerable Software and Affected Versions: favethemes Houzez versions through 4.1.1 Description: The software contains a reflected cross-site scripting XSS issue due to improper neutralization of input during web page generation. Recommendations: Update to a version later than 4.1.1...

WordPress plugin Custom Comment 跨站脚本漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin e-Boekhouden.nl 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-35151

Name of the Vulnerable Software and Affected Versions: UISP Application affected versions not specified Description: An improper input validation issue exists in the UISP Application. This could allow a malicious actor with high privileges and local access to execute commands through command...

WordPress plugin bxSlider integration for WordPress 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

PT-2025-35021

Name of the Vulnerable Software and Affected Versions: sitesearch-yandex Yandex Site search pinger versions through 1.5 Description: The software contains an Improper Neutralization of Input During Web Page Generation issue, which allows for Stored Cross-Site Scripting XSS. Recommendations: Updat...