PT-2025-5234 · Unknown · Basteln3Rk Save & Import Image From Url

Name of the Vulnerable Software and Affected Versions: basteln3rk Save & Import Image from URL versions n/a through 0.7 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting'. This allows for Reflected XSS in the Save...

CVE-2024-12696

The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's videowhisperpictureuploadguest shortcode in all versions up to, and including, 1.5.22 due to insufficient input sanitization and output escaping on user...

CVE-2025-23642

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in pflonk Sidebar-Content from Shortcode sidebar-content-from-shortcode allows DOM-Based XSS.This issue affects Sidebar-Content from Shortcode: from n/a through = 2.0...

PT-2025-4692 · WordPress · Jay Carter Wp Bulletin Board

Name of the Vulnerable Software and Affected Versions: Jay Carter WP Bulletin Board versions 1.1.4 and earlier Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows reflected XSS. This enables an attack...

CVE-2024-48893

FortiSOAR is affected by CVE-2024-48893 due to improper neutralization of input during web page generation (CWE-79), enabling stored XSS via creation of a malicious playbook. Affected versions are FortiSOAR 7.3.0–7.3.3 and 7.2.1–7.2.2. The issue arises from insufficient input validation in the we...

CVE-2025-22145

Carbon is an international PHP extension for DateTime. Application passing unsanitized user input to Carbon::setLocale are at risk of arbitrary file include, if the application allows users to upload files with .php extension in an folder that allows include or require to read it, then they are a...

CVE-2024-56025

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in adworkmedia AdWork Media EZ Content Locker adwork-media-ez-content-locker allows Reflected XSS.This issue affects AdWork Media EZ Content Locker: from n/a through = 3.0...

ASUS AiCloud 安全漏洞

ASUS AiCloud is a router control program from Asus China. A security vulnerability exists in ASUS AiCloud that stems from the presence of incorrect input insertion, which could lead to arbitrary command execution...

CVE-2024-37044

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute code. We have already fixed the vulnerability in the followin...

CVE-2024-37050 QTS, QuTS hero

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute code. We have already fixed the vulnerability in the followin...

CVE-2024-52803 LLama Factory Remote OS Command Injection Vulnerability

LLama Factory enables fine-tuning of large language models. A critical remote OS command injection vulnerability has been identified in the LLama Factory training process. This vulnerability arises from improper handling of user input, allowing malicious actors to execute arbitrary OS commands on...

Reflected Cross-Site Scripting (Reflected XSS)

OctoPrint is vulnerable to Reflected Cross-Site Scripting Reflected XSS. The vulnerability is due to unescaped user inputs in OctoPrint’s login dialog and standalone application key confirmation dialog, allows attackers to inject malicious scripts that get reflected back to the user's browser...

The vulnerability of the config_input function in the af_acrossover.c component of the FFmpeg multimedia library, related to improper memory release before deleting the last reference, allows a hacker to trigger a service failure.

The vulnerability of the configinput function in the afacrossover.c component of the FFmpeg multimedia library is related to improper memory release before deleting the last reference. Exploiting this vulnerability may allow a remote attacker to cause a service failure...

CVE-2024-4692

Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Access Control Security Levels. Multiple missing permission checks - Service Virtualization config has been discovered in in OpenText...

CVE-2024-4211

CVE-2024-4211 affects OpenText Application Automation Tools (v24.1.0 and below). Root cause: improper validation of input quantity coupled with multiple missing permission checks in ALM job configuration. Impact: users with Overall/Read permission could enumerate ALM server names, usernames and c...

Arbitrary Argument Injection

ggit is vulnerable to Arbitrary Argument Injection. The vulnerability is due to the failure to sanitize user input and improper handling of command-line flags and doesn't validate the URL scheme or properly pass arguments to the git binary using the necessary -- POSIX characters, allowing attacke...

Siemens SINEC Security Monitor 安全漏洞

SINEC Security Monitor is a modular network security software for passive, non-intrusive, continuous network security monitoring during production processes at customer sites. Siemens SINEC Security Monitor suffers from a command injection vulnerability that originates from a failure to properly...

CVE-2024-44001

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in WP Royal Royal Elementor Addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through 1.3.982...

CVE-2021-22503

Possible Improper Neutralization of Input During Web Page Generation Vulnerability in eDirectory has been discovered in OpenText™ eDirectory 9.2.3.0000...

CVE-2021-22503 Improper Neutralization of Input During Web Page Generation Vulnerability

Possible Improper Neutralization of Input During Web Page Generation Vulnerability in eDirectory has been discovered in OpenText™ eDirectory 9.2.3.0000...