CVE-2025-46238

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rbaer List Last Changes list-last-changes allows Stored XSS.This issue affects List Last Changes: from n/a through = 1.2.1...

CVE-2025-46227

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brecht Custom Related Posts custom-related-posts allows Stored XSS.This issue affects Custom Related Posts: from n/a through = 1.7.4...

CVE-2025-46252 WordPress Message Filter for Contact Form 7 plugin <= 1.6.3.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Kofi Mokome Message Filter for Contact Form 7 allows SQL Injection. This issue affects Message Filter for Contact Form 7: from n/a through 1.6.3.2...

CVE-2025-46228

CVE-2025-46228: WordPress Event post plugin vulnerability allowing DOM-based XSS due to improper input neutralization during web page generation. Affected versions are n/a through 5.9.11 (Event post). Reports from NVD/CVE records and Patchstack describe XSS in the Event post plugin; patch/status ...

CVE-2025-46227

CVE-2025-46227 is a Cross-Site Scripting (XSS) vulnerability in the Brecht Custom Related Posts WordPress plugin. The issue is an improper neutralization of input during web page generation, enabling stored XSS. Affected versions are up to and including 1.7.4 (n/a through 1.7.4). The vulnerabilit...

CVE-2025-46225

CVE-2025-46225 : WordPress plugin Post in page for Elementor suffers a DOM-based XSS due to improper input neutralization in its web page generation. Affected: Elementor’s Post in page for Elementor, versions from n/a through 1.0.1. Impact described in sources as cross-site scripting; exploitatio...

WordPress plugin VForm 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripti...

WordPress plugin Message Filter for Contact Form SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerability exist...

WordPress plugin GutenKit 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

WordPress plugin Textmetrics 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin Event post 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability exis...

PT-2025-17502 · Unknown · Link Library

Name of the Vulnerable Software and Affected Versions: Link Library versions n/a through 7.8 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

PT-2025-17532 · Pluggabl Llc · Booster Plus For Woocommerce

Name of the Vulnerable Software and Affected Versions: Booster Plus for WooCommerce versions through 7.2.4 Description: The issue affects the Booster Plus for WooCommerce plugin, allowing for Reflected XSS due to improper neutralization of input during web page generation. This can lead to...

CVE-2025-3841 wix-incubator jam Jinja2 Template jam.py special elements used in a template engine

A vulnerability, which was classified as problematic, was found in wix-incubator jam up to e87a6fd85cf8fb5ff37b62b2d68f917219d07ae9. This affects an unknown part of the file jam.py of the component Jinja2 Template Handler. The manipulation of the argument config'template' leads to improper...

CVE-2025-3840 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

An improper neutralization of input vulnerability was identified in the End of Life EOL OVA based connect installer component which is deployed for installation purposes in a customer network. This EOL component was deprecated in September 2023 with end of support extended till January 2024. An...

CVE-2025-3840 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

An improper neutralization of input vulnerability was identified in the End of Life EOL OVA based connect installer component which is deployed for installation purposes in a customer network. This EOL component was deprecated in September 2023 with end of support extended till January 2024. An...

Wyse Management Suite Cross-Site Scripting Vulnerability

The Wyse Management Suite is a cloud and local management platform from Dell, USA. A cross-site scripting vulnerability exists in Wyse Management Suite that stems from improper input neutralization and can be exploited by an attacker to cause script injection...

CVE-2025-2950 IBM i improper HTTP header neutralization

IBM i 7.3, 7.4, 7.5, and 7.5 is vulnerable to a host header injection attack caused by improper neutralization of HTTP header content by IBM Navigator for i. An authenticated user can manipulate the host header in HTTP requests to change domain/IP address which may lead to unexpected behavior...

SQL Injection

crud-query-parser is vulnerable to SQL Injection. The vulnerability is due to improper neutralization of the order/sort parameter. Specifically, it occurs because there is no property filter setup when using the TypeORM adapter with ordering enabled, allowing an attacker to inject malicious SQL...

IBM i 安全漏洞

IBM i is a suite of operating systems from International Business Machines IBM running in IBM Power Systems and IBM PureSystems. IBM i suffers from a Content Neutralization Malpractice vulnerability that originates from a HTTP header Content Neutralization Malpractice, which can be exploited by a...