CVE-2025-2076

CVE-2025-2076 : The WordPress plugin binlayerpress

CVE-2025-2205 GDPR Cookie Compliance <= 4.15.6 - Authenticated (Admin+) Stored Cross-Site Scripting

The GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice – CCPA, DSGVO, RGPD plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.15.6 due to insufficient input sanitization and output escaping. This makes it...

CVE-2025-2205

The CVE-2025-2205 issue affects the GDPR Cookie Compliance WordPress plugin. Affected versions up to 4.15.6/4.15.6 (reported by NVD) and up to 4.15.7 (per Red Hat) do not sufficiently sanitize/escape certain admin settings, enabling Stored Cross-Site Scripting by authenticated users with admin-le...

PT-2025-10992 · WordPress · Simple Amazon Affiliate

Name of the Vulnerable Software and Affected Versions: The Simple Amazon Affiliate plugin for WordPress versions up to, and including, 1.0.9 Description: The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping via the msg parameter. This...

PT-2025-10991 · WordPress · Binlayerpress

Name of the Vulnerable Software and Affected Versions: binlayerpress plugin for WordPress versions up to, and including, 1.1 Description: The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows authenticated...

4 author cheer up donate <= 1.3 - Reflected Cross-Site Scripting

Description The 4 author cheer up donate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...

PT-2025-10993 · WordPress · Blogbuzztime

Name of the Vulnerable Software and Affected Versions: BlogBuzzTime for WP plugin for WordPress versions up to, and including, 1.1 Description: The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows...

PT-2025-10999 · WordPress · The Finale Lite – Sales Countdown Timer & Discount

Name of the Vulnerable Software and Affected Versions: The Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugin for WordPress versions up to, and including, 2.19.0 Description: The issue is related to Stored DOM-Based Cross-Site Scripting via the countdown timer due to insufficie...

Pimcore Vulnerable to SQL Injection in getRelationFilterCondition

Summary Authenticated users can craft a filter string used to cause a SQL injection. Details Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer. This code does not look to sanitize inputs:...

CVE-2025-27493

A vulnerability has been identified in SiPass integrated AC5102 ACC-G2 All versions V6.4.9, SiPass integrated ACC-AP All versions V6.4.9. Affected devices improperly sanitize user input for specific commands on the telnet command line interface. This could allow an authenticated local administrat...

CVE-2025-27393

A vulnerability has been identified in SCALANCE LPE9403 6GK5998-3GS00-2AC2 All versions V4.0. Affected devices do not properly sanitize user input when creating new users. This could allow an authenticated highly-privileged remote attacker to execute arbitrary code on the device...

CVE-2025-27392

A vulnerability has been identified in SCALANCE LPE9403 6GK5998-3GS00-2AC2 All versions V4.0. Affected devices do not properly sanitize user input when creating new VXLAN configurations. This could allow an authenticated highly-privileged remote attacker to execute arbitrary code on the device...

CVE-2025-27394

A vulnerability has been identified in SCALANCE LPE9403 6GK5998-3GS00-2AC2 All versions V4.0. Affected devices do not properly sanitize user input when creating new SNMP users. This could allow an authenticated highly-privileged remote attacker to execute arbitrary code on the device...

CVE-2025-27494

A vulnerability has been identified in SiPass integrated AC5102 ACC-G2 All versions V6.4.9, SiPass integrated ACC-AP All versions V6.4.9. Affected devices improperly sanitize input for the pubkey endpoint of the REST API. This could allow an authenticated remote administrator to escalate privileg...

CVE-2025-27494

A vulnerability has been identified in SiPass integrated AC5102 ACC-G2 All versions V6.4.9, SiPass integrated ACC-AP All versions V6.4.9. Affected devices improperly sanitize input for the pubkey endpoint of the REST API. This could allow an authenticated remote administrator to escalate privileg...

CVE-2025-27394

Siemens SCALANCE LPE9403 (6GK5998-3GS00-2AC2), affected in all versions before V4.0, exposes an OS command injection due to improper sanitization of input when creating new SNMP users. The vulnerability allows an authenticated, highly-privileged remote attacker to execute arbitrary code on the de...

CVE-2025-27394

A vulnerability has been identified in SCALANCE LPE9403 6GK5998-3GS00-2AC2 All versions V4.0. Affected devices do not properly sanitize user input when creating new SNMP users. This could allow an authenticated highly-privileged remote attacker to execute arbitrary code on the device...

CVE-2025-27393

A vulnerability has been identified in SCALANCE LPE9403 6GK5998-3GS00-2AC2 All versions V4.0. Affected devices do not properly sanitize user input when creating new users. This could allow an authenticated highly-privileged remote attacker to execute arbitrary code on the device...

CVE-2025-27393

Siemens SCALANCE LPE9403 (model 6GK5998-3GS00-2AC2) is affected (all versions

CVE-2025-27392

A vulnerability has been identified in SCALANCE LPE9403 6GK5998-3GS00-2AC2 All versions V4.0. Affected devices do not properly sanitize user input when creating new VXLAN configurations. This could allow an authenticated highly-privileged remote attacker to execute arbitrary code on the device...