CVE-2024-13286 SVG Embed - Moderately critical - Cross site scripting - SA-CONTRIB-2024-050

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal SVG Embed allows Cross-Site Scripting XSS.This issue affects SVG Embed: from 0.0.0 before 2.1.2...

CVE-2024-13273 Open Social - Moderately critical - Cross Site Scripting, Denial of Service - SA-CONTRIB-2024-037

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Open Social allows Cross-Site Scripting XSS.This issue affects Open Social: from 0.0.0 before 12.3.8, from 12.4.0 before 12.4.5, from 13.0.0 before 13.0.0-alpha11...

CVE-2024-13247

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Coffee allows Cross-Site Scripting XSS.This issue affects Coffee: from 0.0.0 before 1.4.0...

CVE-2024-13238

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Typogrify allows Cross-Site Scripting XSS.This issue affects Typogrify: from 0.0.0 before 1.3.0...

Security Bulletin: Vulnerability in IBM WebSphere Application Server Liberty affect BM Spectrum Control

Summary IBM WebSphere Application Server Liberty is vulnerable to a denial of service due to Google Protocol Buffers. This vulnerability affect IBM Spectrum Control. Vulnerability Details CVEID:CVE-2024-7254 DESCRIPTION: Any project that parses untrusted Protocol Buffers data containing an...

Drupal 安全漏洞

Drupal is an open source content management system developed in the PHP language by the Drupal community. A security vulnerability exists in Drupal Facets prior to version 2.0.9, which stems from improper input neutralization during page generation, resulting in a cross-site scripting vulnerabili...

WordPress plugin Cf7Save Extension 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

WordPress plugin NC Wishlist for Woocommerce SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

Drupal 安全漏洞

Drupal is an open source content management system developed in the PHP language by the Drupal community. A security vulnerability exists in Drupal Open Social prior to version 12.3.8, versions 12.4.0 through 12.4.5, and versions 13.0.0 through 13.0.0-alpha11, which stems from improper input...

Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2025-795)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-795 advisory. Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service ReDoS due to improper input sanitization. An attacker can increase the CPU usage and crash the...

PT-2025-4719 · Unknown · Cbb Team Content Blocks Builder

Name of the Vulnerable Software and Affected Versions: CBB Team Content Blocks Builder versions n/a through 2.7.6 Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can...

WordPress plugin Opentracker Analytics 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Drupal 安全漏洞

Drupal is an open source content management system developed in the Drupal community using the PHP language. A security vulnerability exists in Drupal Coffee prior to version 1.4.0, which stems from improper input neutralization during page generation, resulting in a cross-site scripting...

WordPress plugin Conversational Forms for ChatBot 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress plugin Genesis Style Shortcodes 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

PT-2025-4459 · Tobias Spiess · Ts Comfort Db

Name of the Vulnerable Software and Affected Versions: Tobias Spiess TS Comfort DB versions prior to 2.0.8 Description: The issue is related to improper neutralization of input during web page generation, which allows reflected Cross-site Scripting XSS. This enables attackers to inject malicious...

Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.16.5 Bug Fix Update

Updated images that fix several bugs are now available for Red Hat OpenShift Data Foundation 4.16.5 on Red Hat Enterprise Linux 9 from Red Hat Container Registry. Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Data Foundation...

Missing Authentication for Critical Function

Overview django-mdeditor is an A simple Django app to edit markdown text. Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An attacker can upload malicious files and achieve arbitrary code execution since this endpoint...

CVE-2024-47934 TXOne Networks Portable Inspector Management Program Improper Input Validation Vulnerability

Improper Input Validation vulnerability in Management Program in TXOne Networks Portable Inspector and Portable Inspector Pro Edition allows remote attacker to crash management service. The Denial of Service situation can be resolved by restarting the management service. This issue affects Portab...

Server-side Template Injection (SSTI)

opencart/opencart is vulnerable to Server-Side Template Injection SSTI. The vulnerability is due to improper validation and sanitization of user inputs within the Theme Editor Function, allows attackers to inject malicious template code that can be executed on the server...