USN-7695-1: Sidekiq vulnerabilities

Anas Roubi discovered that Sidekiq did not correctly sanitize certain inputs. An attacker could possibly use this issue to execute a cross-site scripting XSS attack. This issue only affected Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. CVE-2021-30151 It was discovered that Sidekiq did not correctly...

CVE-2025-8621

The Mosaic Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘c’ parameter in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access an...

PT-2025-33115 · Unknown · 1000 Projects Sales Management System

Name of the Vulnerable Software and Affected Versions: 1000 Projects Sales Management System version 1.0 Description: A vulnerability exists in an unknown functionality of the file /superstore/custcmp.php. Manipulation of the Username argument leads to a SQL injection. The attack can be launched...

PT-2025-33129 · Unknown · Projectworlds Online Notes Sharing Platform

Name of the Vulnerable Software and Affected Versions: projectworlds Online Notes Sharing Platform version 1.0 Description: A vulnerability has been found in the file /login.php of the software. Manipulation of the User argument leads to a SQL injection. The attack can be initiated remotely. The...

PT-2025-33361 · Undefined · Undefined

- CVE-2025-8875 is an insecure deserialization vulnerability that could lead to command execution - CVE-2028-8876 is a command injection vulnerability via improper sanitization of user input...

PT-2025-33359 · Sourcecodester · Sourcecodester Cashier Queuing System

Name of the Vulnerable Software and Affected Versions: SourceCodester Cashier Queuing System version 1.0 Description: A SQL injection issue exists in SourceCodester Cashier Queuing System 1.0 due to the manipulation of the Username argument in the /Actions.php file. This allows for remote...

WordPress plugin Pinterest Automatic Pin SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Pinterest...

PT-2025-33309 · Itsourcecode · Itsourcecode Online Tour/Travel Management System

Name of the Vulnerable Software and Affected Versions: itsourcecode Online Tour and Travel Management System version 1.0 Description: A SQL injection issue exists in itsourcecode Online Tour and Travel Management System version 1.0. The vulnerability is located in the /admin/operations/packages.p...

WordPress plugin Modernize 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-33304 · Itsourcecode · Itsourcecode Online Tour/Travel Management System

Name of the Vulnerable Software and Affected Versions: itsourcecode Online Tour and Travel Management System version 1.0 Description: A vulnerability exists in itsourcecode Online Tour and Travel Management System that affects unknown processing within the /admin/operations/tax.php file...

PT-2025-33141 · Sourcecodester · Covid19 Testing Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester COVID 19 Testing Management System version 1.0 Description: A SQL injection issue exists in the /check availability.php file due to the manipulation of the employeeid argument. This allows for remote attacks. The exploit has be...

CVE-2011-10019 Spreecommerce < 0.60.2 Search Parameter RCE

Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via the searchsend parameter, which is dynamically invoked using Ruby’s send method. This allows attackers to execute...

SQL Injection

bacula-web/bacula-web is vulnerable to SQL Injection. The vulnerability is due to improper input sanitization in HTTP GET requests, which allows an attacker to execute arbitrary code remotely...

PT-2025-33060 · Unknown · Hortusfox-Web

Name of the Vulnerable Software and Affected Versions: hortusfox-web version 4.4 Description: A cross-site scripting XSS vulnerability exists in the /tasks endpoint. Attackers can execute arbitrary JavaScript in the context of a user's browser by injecting a crafted payload into the title...

PT-2025-33073 · Sourcecodester · Covid19 Testing Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester COVID 19 Testing Management System version 1.0 Description: A SQL injection issue exists in the SourceCodester COVID 19 Testing Management System. The Username parameter in the /login.php API endpoint is susceptible to...

PT-2025-33051 · Unknown · Hortusfox-Web

Name of the Vulnerable Software and Affected Versions: hortusfox-web version 4.4 Description: A cross-site scripting XSS issue exists in the /controller/admin.php API endpoint of hortusfox-web version 4.4. Attackers can execute arbitrary JavaScript in a user's browser by injecting a crafted paylo...

CVE-2025-8688

The Inline Stock Quotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's stock shortcode in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-8690

The Simple Responsive Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inje...

CVE-2025-8688 Inline Stock Quotes <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via stock Shortcode

The Inline Stock Quotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's stock shortcode in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2025-32621 · WordPress · Inline Stock Quotes

Name of the Vulnerable Software and Affected Versions: Inline Stock Quotes plugin for WordPress versions up to and including 0.2 Description: The Inline Stock Quotes plugin for WordPress is susceptible to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on...