EUVD-2026-53318

Mautic's getLeadIdsByFieldValueAction LeadBundle/Controller/AjaxController.php reads a field parameter from the request, sanitizes it only with InputHelper::clean which HTML-entity-encodes quotes and angle brackets but does not restrict other characters, and passes it into...

EUVD-2022-50621

Malicious code in bioql PyPI...

EUVD-2022-50623

Malicious code in bioql PyPI...

EUVD-2022-50622

Malicious code in bioql PyPI...

EUVD-2022-50619

Malicious code in bioql PyPI...

EUVD-2022-50618

Malicious code in bioql PyPI...

EUVD-2022-50617

Malicious code in bioql PyPI...

EUVD-2022-50616

Malicious code in bioql PyPI...

EUVD-2022-52121

Malicious code in bioql PyPI...

CVE-2025-5240: Improper Neutralization of Input During Web Page Generation

The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 2.7.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2022-47865

Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeOrder.php...

CVE-2022-47864

Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeCategories.php...

CVE-2022-47862

Lead Management System v1.0 is vulnerable to SQL Injection via the customerid parameter in ajaxrepresent.php...

CVE-2022-47860

Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeProduct.php...

CVE-2022-47861

Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeLead.php...

CVE-2022-47859

Lead Management System v1.0 is vulnerable to SQL Injection via the userid parameter in changePassword.php...

CVE-2022-47866

Lead management system v1.0 is vulnerable to SQL Injection via the id parameter in removeBrand.php...

PT-2025-12862

Name of the Vulnerable Software and Affected Versions CRM and Lead Management by vcita plugin for WordPress versions up to 2.7.4 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the vCitaMeetingScheduler and vCitaSchedulingCalend...

CVE-2024-13702: Improper Neutralization of Input During Web Page Generation

The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vCitaMeetingScheduler' and 'vCitaSchedulingCalendar' shortcodes in all versions up to, and including, 2.7.4 due to insufficient input sanitization and output escaping on user...

WordPress plugin CRM and Lead Management by vcita has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPre...