EUVD-2023-25612

Malicious code in bioql PyPI...

EUVD-2025-25783

Malicious code in bioql PyPI...

EUVD-2025-25057

Malicious code in bioql PyPI...

EUVD-2025-30787

Malicious code in bioql PyPI...

EUVD-2025-30306

Malicious code in bioql PyPI...

EUVD-2023-42381

Malicious code in bioql PyPI...

EUVD-2025-25063

Malicious code in bioql PyPI...

EUVD-2022-5108

Malicious code in bioql PyPI...

EUVD-2025-25138

Malicious code in bioql PyPI...

EUVD-2022-2202

Malicious code in bioql PyPI...

CVE-2025-43812

Cross-site scripting XSS vulnerability in web content template in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated users to inject arbitrary web script or HTML via a crafted...

CVE-2025-57876

CVE-2025-57876 is a stored XSS vulnerability in Esri Portal for ArcGIS 11.4 and earlier. An authenticated attacker with high privileges can inject a file containing an XSS script; when loaded, it could execute arbitrary JavaScript in the victim’s browser and potentially disclose a privileged toke...

CVE-2025-10136

The TweetThis Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tweetthis' shortcode in all versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-20364

A vulnerability in the Device Analytics action frame processing of Cisco Wireless Access Point AP Software could allow an unauthenticated, adjacent attacker to inject wireless 802.11 action frames with arbitrary information. This vulnerability is due to insufficient verification checks of incomin...

CVE-2025-9353

The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 7.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access an...

CVE-2025-5962

A flaw was found in the Lightspeed history service. Insufficient access controls allow a local, unprivileged user to access and manipulate the chat history of another user on the same system. By abusing inter-process communication calls to the history service, an attacker can view, delete, or...

CVE-2025-9883

The Browser Sniff plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web script...

CVE-2025-9992

The CVE-2025-9992 entry concerns Ghost Kit – Page Builder Blocks, Motion Effects & Extensions for WordPress. It is vulnerable to Stored Cross-Site Scripting via the custom JS field in all versions up to and including 3.4.3, due to insufficient input sanitization and output escaping. Exploitation ...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via a "Rich Text" field in an object. An attacker can execute arbitrary web scripts or inject HTML by submitting a crafted payload. Details Cross-site scripting or XSS is a code vulnerability that occurs when an...

CVE-2025-8686

The WP Easy FAQs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's WPEASYFAQ shortcode in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...