EUVD-2023-52604

Malicious code in bioql PyPI...

EUVD-2025-4665

Malicious code in bioql PyPI...

EUVD-2023-54756

Malicious code in bioql PyPI...

EUVD-2023-52559

Malicious code in bioql PyPI...

EUVD-2025-6618

Malicious code in bioql PyPI...

EUVD-2025-25809

Malicious code in bioql PyPI...

EUVD-2025-2890

Malicious code in bioql PyPI...

EUVD-2025-12391

Malicious code in bioql PyPI...

EUVD-2025-18055

Malicious code in bioql PyPI...

EUVD-2025-17955

Malicious code in bioql PyPI...

EUVD-2025-17991

Malicious code in bioql PyPI...

EUVD-2024-35919

Malicious code in bioql PyPI...

CVE-2025-9946

The LockerPress – WordPress Security Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the dataAddonlayouts and dataAddonlayoutsexcept parameters in the /apprain/developer/addons/update/dialogs process. An attacker can execute arbitrary scripts in the context of a user's browser by submitting...

CVE-2025-57765

WeGIA is a Web manager for charitable institutions. Prior to 3.4.7, a Reflected Cross-Site Scripting XSS vulnerability was identified in the precadastroadotante.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msge parameter. This...

Cross-Site Scripting (XSS)

org.apache.zeppelin, zeppelin-web is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to an incomplete blacklist of user input, which allows an attacker to inject malicious scripts and execute them in a victim’s browser...

CVE-2025-53929 WeGIA vulnerable to Stored Cross-Site Scripting (XSS) via endpoint `adicionar_cor.php` parameter `cor`

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting XSS vulnerability was identified in the adicionarcor.php endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers to inject...

PT-2025-28750 · Adobe · Coldfusion

Name of the Vulnerable Software and Affected Versions: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier Description: The issue is a stored Cross-Site Scripting XSS vulnerability that could be exploited by a high-privileged attacker to inject malicious scripts into vulnerable form fields...

PT-2025-28747 · Adobe · Coldfusion

Name of the Vulnerable Software and Affected Versions: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier Description: The issue is a stored Cross-Site Scripting XSS vulnerability that could be exploited by a high-privileged attacker to inject malicious scripts into vulnerable form fields...

PT-2025-25765 · Dify · Dify

Name of the Vulnerable Software and Affected Versions: Dify version 1.2.0 Description: Dify is an open-source LLM app development platform. In this platform, there is insufficient filtering of user input by web applications, which allows attackers to inject malicious script code into web pages...