12292 matches found
CVE-2025-52036
A stored cross-site scripting (XSS) vulnerability exists in NotesCMS due to the improper handling of service description titles on the /index.php?route=categories page. An attacker can manipulate these titles to execute malicious scripts, and the attack can be launched remotely . The issue was pr...
CVE-2025-52036
A vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.php?route=categories. The manipulation of the title of the service descriptions leads to a stored XSS vulnerability. The issue was confirmed to be present in the source code as o...
WordPress Golo Theme <= 1.7.1 is vulnerable to Cross Site Scripting (XSS)
Software Golo Type Theme Vulnerable versions = 1.7.1 Fixed in 1.7.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-54724 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 9a5f34e954ab Credits Bonds Required privilege Unauthenticated...
CVE-2025-52037
A vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.php?route=sites. The manipulation of the title of the service descriptions leads to a stored XSS vulnerability. The issue was confirmed to be present in the source code as of...
CVE-2025-52036
A vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.php?route=categories. The manipulation of the title of the service descriptions leads to a stored XSS vulnerability. The issue was confirmed to be present in the source code as o...
WordPress e-Boekhouden.nl Plugin <= 1.9.3 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by Skalucy in WordPress Plugin e-Boekhouden.nl versions = 1.9.3...
WordPress Redirection for Contact Form 7 plugin <= 3.2.4 - Unauthenticated PHP Object Injection via PHAR Deserialization vulnerability
Unauthenticated PHP Object Injection via PHAR Deserialization vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Redirection for Contact Form 7 versions = 3.2.4...
ffmpeg:ffmpeg_AV_CODEC_ID_UTVIDEO_DEC_fuzzer: Use-of-uninitialized-value in add_median_pred_c
Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5635866203848704 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDUTVIDEODECfuzzer Job Type: libfuzzermsanffmpeg Platform Id: linux Crash Type:...
ffmpeg:ffmpeg_AV_CODEC_ID_HEVC_fuzzer: Index-out-of-bounds in hevc_decode_init
Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=4956250308935680 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDHEVCfuzzer Job Type: libfuzzerubsanffmpeg Platform Id: linux Crash Type:...
PT-2025-33822 · Undefined · Undefined
🟠 Astro, Server-Side Request Forgery SSRF, CVE-2024-56870 Medium https://t.co/rxOf3RNWtb...
WordPress FunnelKit Automations plugin <= 3.6.3 - Privilege Escalation vulnerability
Privilege Escalation vulnerability discovered by wesley wcraft in WordPress Plugin FunnelKit Automations versions = 3.6.3...
Linux Distros Unpatched Vulnerability : CVE-2025-4050
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out of bounds memory access in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gestures...
Linux Distros Unpatched Vulnerability : CVE-2025-2137
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out of bounds read in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page...
WordPress User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin <= 3.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Alex in WordPress Plugin Profile Builder versions = 3.14.3...
WordPress WP Shopify plugin < 1.5.4 - Reflected XSS vulnerability
Reflected XSS vulnerability discovered by Bob Matyas in WordPress Plugin External Store for Shopify versions 1.5.4...
Malicious code in nova-interstellarmedium-perturbation-palynology (npm)
The package nova-interstellarmedium-perturbation-palynology was found to contain malicious code...
Malicious code in medium-post (npm)
The package medium-post was found to contain malicious code...
Malicious code in medium-author (npm)
The package medium-author was found to contain malicious code...
