CVE-2025-6997

CVE-2025-6997 : ThemeREX Addons for WordPress is vulnerable to a stored cross-site scripting (XSS) via SVG uploads in versions

CVE-2025-7658 Temporarily Hidden Content <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Temporarily Hidden Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'temphc-start' shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

Path Traversal

Measured is vulnerable to Path Traversal. The vulnerability is due to insufficient input validation when initializing the class, which allows an attacker to manipulate inputs and instruct the library to read arbitrary files...

CVE-2025-7431 Knowledge Base <= 2.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Slug

The Knowledge Base plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin slug setting in all versions up to, and including, 2.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

PT-2025-30049 · Riot-Os · Riot-Os

Name of the Vulnerable Software and Affected Versions: RIOT-OS versions prior to 2025.04 Description: RIOT-OS, an operating system that supports Internet of Things devices, has an ineffective size check implemented with assert that can lead to a buffer overflow. Assertions are typically compiled...

CVE-2025-20337

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to...

CVE-2025-20283 Cisco Identity Services Engine Authenticated Remote Code Execution Vulnerability

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system as root. This vulnerability is due to insufficient validation of user-supplied input. An attacker with valid credentials coul...

CVE-2025-20283

The vulnerability (CVE-2025-20283) affects Cisco Identity Services Engine (ISE) and ISE-PIC via a specific API, caused by insufficient validation of user-supplied input. An attacker with valid high-priv credentials could submit crafted API requests to execute commands as root on the underlying OS...

The vulnerability of the Thunderbird email client, related to insufficient validation of input data, allows attackers to gain access to potentially confidential information.

The vulnerability of the Thunderbird email client is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to gain access to potentially confidential information...

PT-2025-29854 · Cisco · Cisco Ise +1

Name of the Vulnerable Software and Affected Versions: Cisco ISE affected versions not specified Cisco ISE-PIC affected versions not specified Description: A vulnerability exists in a specific API of Cisco ISE and Cisco ISE-PIC that could allow an authenticated, remote attacker to execute arbitra...

CVE-2025-4369

The Companion Auto Update plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘updatedelaydays’ parameter in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

The vulnerability of the COMP_DUMMY() function in the sound module/soc/mediatek/mt8195/mt8195-mt6359.c kernel of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the COMPDUMMY function in the sound/soc/mediatek/mt8195/mt8195-mt6359.c file of the Linux operating system’s kernel is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2025-5530

The WPC Smart Compare for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shortcodebtn' shortcode in all versions up to, and including, 6.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

The vulnerability of the Jenkins automation server’s Git Parameter plugin lies in insufficient validation of input data, allowing attackers to gain read and modify access to these data.

The vulnerability of the Jenkins automation server’s Git Parameter plugin is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to gain read and modify access to data...

Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability

Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway VPN virtual server, ICA Proxy, CVPN, RDP Proxy OR AAA virtual server...

CVE-2025-6976

CVE-2025-6976 affects the WordPress plugin Events Manager (versions up to 7.0.3, with citations indicating a fix in 7.0.4+). The issue is Stored Cross-Site Scripting via shortcode attributes caused by insufficient input sanitization and output escaping, enabling authenticated attackers with contr...

CVE-2025-7059

CVE-2025-7059 : The Simple Featured Image WordPress plugin (versions

WordPress plugin Events Manager 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-6244

The Essential Addons for Elementor – Popular Elementor Templates and Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the via Calendar And Business Reviews Widgets attributes in all versions up to, and including, 6.1.19 due to insufficient input sanitization and outpu...

WordPress GC Social Wall Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress GC Social Wall, which stems from insufficient input cleanup and output escaping, and can be exploited by an attacke...