CVE-2025-8064 Bible SuperSearch <= 6.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via selector_height Parameter

The Bible SuperSearch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘selectorheight’ parameter in all versions up to, and including, 6.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2025-34254 · Unknown · Akaunting 3.1.18

Name of the Vulnerable Software and Affected Versions: Akaunting version 3.1.18 Description: A cross-site scripting XSS issue exists in the /common/reports component of the software. Attackers can execute arbitrary web scripts or HTML by injecting a crafted payload into the name parameter...

PT-2025-34232 · Sourcecodester · Online Bank Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Bank Management System version 1.0 Description: A weakness has been identified that allows for SQL injection. The issue impacts an unknown function within the /bank/show.php file. Manipulation of the ID argument can lead...

PT-2025-34291 · Unknown · Hrmaster Module

Name of the Vulnerable Software and Affected Versions: HRmaster module version 235 Description: An HTML injection flaw exists in the registration interface of the HRmaster module. An attacker can inject HTML tags into the keresztnév firstname field. This injected HTML is included in emails,...

GHSA-MV33-9F6J-PFMC Directus allows unauthenticated file upload and file modification due to lacking input sanitization

Summary A vulnerability exists in the file update mechanism which allows an unauthenticated actor to modify existing files with arbitrary contents without changes being applied to the files' database-resident metadata and / or upload new files, with arbitrary content and extensions, which won't...

CVE-2025-55746 Directus allows unauthenticated file upload and file modification due to lacking input sanitization

Directus is a real-time API and App dashboard for managing SQL database content. From 10.8.0 to before 11.9.3, a vulnerability exists in the file update mechanism which allows an unauthenticated actor to modify existing files with arbitrary contents without changes being applied to the files'...

CVE-2025-55746 Directus allows unauthenticated file upload and file modification due to lacking input sanitization

Directus is a real-time API and App dashboard for managing SQL database content. From 10.8.0 to before 11.9.3, a vulnerability exists in the file update mechanism which allows an unauthenticated actor to modify existing files with arbitrary contents without changes being applied to the files'...

CVE-2025-55291

Shaarli is a minimalist bookmark manager and link sharing service. Prior to 0.15.0, the input string in the cloud tag page is not properly sanitized. This allows the tag to be prematurely closed, leading to a reflected Cross-Site Scripting XSS vulnerability. This vulnerability is fixed in 0.15.0...

CVE-2025-48159

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LambertGroup Youtube Vimeo Video Player and Slider WP Plugin video-player-youtube-vimeo allows Reflected XSS.This issue affects Youtube Vimeo Video Player and Slider WP Plugin: from n/a through = 3...

PT-2025-33904 · Unknown +1 · Woocommerce +1

Name of the Vulnerable Software and Affected Versions: WPC Smart Quick View for WooCommerce plugin versions up to and including 4.2.1 Description: The WPC Smart Quick View for WooCommerce plugin for WordPress is susceptible to Stored Cross-Site Scripting through the woosq btn shortcode...

Linux Distros Unpatched Vulnerability : CVE-2020-10693

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if...

CVE-2025-54881 Mermaid improperly sanitizes of sequence diagram labels leading to XSS

Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. In the default configuration of mermaid 10.9.0-rc.1 to 11.9.0, user supplied input for sequence diagram labels is passed to innerHTML duri...

Cross-site Scripting (XSS)

Overview moonshine/moonshine is a Laravel administration panel Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Name parameter when creating a new Admin, due to improper sanitization of user input. Details Cross-site scripting or XSS is a code vulnerability tha...

CVE-2025-9140

Lingdang CRM up to version 8.6.4.7 is affected by an SQL injection in /crm/crmapi/erp/tabdetail_moduleSave.php via the getvaluestring parameter. Remote exploitation is possible and PoCs/exploits exist publicly (including time-based blind and boolean-based payloads). Vendor advisory indicates the ...

CVE-2025-8567

The Nexter Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 4.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

CVE-2025-8567

CVE-2025-8567: Nexter Blocks (WordPress)

CVE-2025-8622 Flexible Maps <= 1.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flexible Maps Shortcode

The Flexible Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Flexible Maps shortcode in all versions up to, and including, 1.18.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2025-33739 · Moonshine · Moonshine

Name of the Vulnerable Software and Affected Versions: MoonShine version 3.12.3 Description: A stored cross-site scripting XSS vulnerability exists in the Create Admin function. Attackers can execute arbitrary web scripts or HTML by injecting a crafted payload into the Name parameter...

PT-2025-33732 · Unknown · Lingdang Crm

Name of the Vulnerable Software and Affected Versions: Lingdang CRM versions up to 8.6.4.7 Description: A SQL injection issue exists in Lingdang CRM due to the manipulation of the getvaluestring argument in the /crm/crmapi/erp/tabdetail moduleSave.php file. This allows for remote attacks. The...

UBUNTU-CVE-2025-55291

Shaarli is a minimalist bookmark manager and link sharing service. Prior to 0.15.0, the input string in the cloud tag page is not properly sanitized. This allows the tag to be prematurely closed, leading to a reflected Cross-Site Scripting XSS vulnerability. This vulnerability is fixed in 0.15.0...