CVE-2022-21392

CVE-2022-21392: Local Privilege Escalation via NMR SUID in Oracle Enterprise Manager In Oracle installations, where the “nmr” binary is present and SUID-ed as “root”, due to insecure directory permissions, the “oracle” user can elevate his/her privileges to that of the “root” user by replacing th...

alcali (>=2018.3.1, <=2019.2.1.post0), kiwitcms (7.0.0) +10 more potentially affected by CVE-2026-15830 via django (2.2.5)

django PYPI version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - alcali =2018.3.1, =0.31.14, =0.8.0, =0.3.1, =0.0.1, =0.0.1, =0.0.1, =0.0.5 Source cves: CVE-2026-15830 Source advisory: OSV:GHSA-Q238-5CXM-5C9H...

alcali (>=2018.3.1, <=2019.2.1.post0), kiwitcms (7.0.0) +10 more potentially affected by CVE-2026-15307 via django (2.2.5)

django PYPI version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - alcali =2018.3.1, =0.31.14, =0.8.0, =0.3.1, =0.0.1, =0.0.1, =0.0.1, =0.0.5 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...

alcali (>=2018.3.1, <=2019.2.1.post0), kiwitcms (7.0.0) +10 more potentially affected by CVE-2026-53878 via django (2.2.5)

django PYPI version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - alcali =2018.3.1, =0.31.14, =0.8.0, =0.3.1, =0.0.1, =0.0.1, =0.0.1, =0.0.5 Source cves: CVE-2026-53878 Source advisory: OSV:GHSA-8QCX-XF44-272X...

alcali (>=2018.3.1, <=2019.2.1.post0), kiwitcms (7.0.0) +10 more potentially affected by CVE-2026-53877 via django (2.2.5)

django PYPI version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - alcali =2018.3.1, =0.31.14, =0.8.0, =0.3.1, =0.0.1, =0.0.1, =0.0.1, =0.0.5 Source cves: CVE-2026-53877 Source advisory: OSV:GHSA-CRHF-3PFG-W68W...

alcali (>=2018.3.1, <=2019.2.1.post0), kiwitcms (7.0.0) +10 more potentially affected by CVE-2024-45231 via django (2.2.5)

django PYPI version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - alcali =2018.3.1, =0.31.14, =0.8.0, =0.3.1, =0.0.1, =0.0.1, =0.0.1, =0.0.5 Source cves: CVE-2024-45231 Source advisory: OSV:PYSEC-2026-1297...

CVE-2026-5341

The NMR Strava activities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's stravanmrconnect shortcode in all versions up to, and including, 1.0.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

EUVD-2026-28541

The NMR Strava activities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's stravanmrconnect shortcode in all versions up to, and including, 1.0.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2026-5341 NMR Strava activities <= 1.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The NMR Strava activities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's stravanmrconnect shortcode in all versions up to, and including, 1.0.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress plugin NMR Strava activities: cross-site scripting vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

CVE-2026-5341: Improper Neutralization of Input During Web Page Generation

The NMR Strava activities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's stravanmrconnect shortcode in all versions up to, and including, 1.0.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2026-38903

Name of the Vulnerable Software and Affected Versions NMR Strava activities plugin for WordPress versions prior to 1.0.15 Description Insufficient input sanitization and output escaping on user supplied attributes in the strava nmr connect shortcode allow authenticated attackers with...

WordPress NMR Strava activities plugin <= 1.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin NMR Strava activities versions = 1.0.14...

alcali (>=2018.3.1, <=2019.2.1.post0), kiwitcms (7.0.0) +10 more potentially affected by CVE-2025-64459 via django (2.2.5)

django PYPI version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - alcali =2018.3.1, =0.31.14, =0.8.0, =0.3.1, =0.0.1, =0.0.1, =0.0.1, =0.0.5 Source cves: CVE-2025-64459 Source advisory: OSV:GHSA-FRMV-PR5F-9MCR...

alcali (>=2018.3.1, <=2019.2.1.post0), kiwitcms (7.0.0) +10 more potentially affected by CVE-2025-64458 via django (2.2.5)

django PYPI version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - alcali =2018.3.1, =0.31.14, =0.8.0, =0.3.1, =0.0.1, =0.0.1, =0.0.1, =0.0.5 Source cves: CVE-2025-64458 Source advisory: OSV:GHSA-QW25-V68C-QJF3...

EUVD-2024-45438

Malicious code in bioql PyPI...

CVE-2024-51603

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mirceatm NMR Strava activities nmr-strava-activities allows DOM-Based XSS.This issue affects NMR Strava activities: from n/a through = 1.0.7...

arbor-ai (>=0.1.5, <=0.2.4), cassandra-medusa (>=0.24.0, <=0.24.1) +19 more potentially affected by CVE-2025-47273 via setuptools (76.1.0)

setuptools PYPI version 76.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - arbor-ai =0.1.5, =0.24.0, =0.1.12, =0.0.0a2, =0.0.1.post2, =3.7.0rc1, =0.21.0, =0.4.5, =0.2.2, =0.3.0, =0.3.3 and more Source cves:...

CVE-2024-51603

CVE-2024-51603 affects the WordPress plugin NMR Strava activities up to version 1.0.6. It is a DOM-based XSS caused by improper input neutralization during page generation. Exploitation details are not provided in the documents; success could lead to attacker-supplied script executing in a victim...

CVE-2024-51603 WordPress NMR Strava activities plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mirceatm NMR Strava activities nmr-strava-activities allows DOM-Based XSS.This issue affects NMR Strava activities: from n/a through = 1.0.7...