CVE-2025-31819 WordPress Nova Blocks by Pixelgrade plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in pixelgrade Nova Blocks nova-blocks.This issue affects Nova Blocks: from n/a through = 2.1.8...

CVE-2025-31819

CVE-2025-31819 is a Cross-Site Scripting (XSS) vulnerability in Nova Blocks by Pixelgrade. The issue affects Nova Blocks versions up to 2.1.8 (and possibly earlier n/a ranges per entry). Root cause is improper neutralization of user-controlled input during web page generation, enabling injection ...

CVE-2025-31819 WordPress Nova Blocks by Pixelgrade plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in pixelgrade Nova Blocks nova-blocks.This issue affects Nova Blocks: from n/a through = 2.1.8...

WordPress Nova Blocks by Pixelgrade plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin Nova Blocks versions = 2.1.8...

PT-2025-14439 · Pixelgrade · Nova Blocks

Name of the Vulnerable Software and Affected Versions: Nova Blocks by Pixelgrade versions 2.1.8 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for potentially malicious scripts to be...

WordPress plugin Nova Blocks by Pixelgrade 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress...

Malicious code in @sas-dvr/nova-crossorigin-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f1c862311f1c77bb8bff4654f153e9035315f16804a207d72efd9f06d5d35aaf The OpenSSF Package Analysis project identified '@sas-dvr/nova-crossorigin-auth' @ 132.0.0 npm as malicious. It is considered malicious because:...

Malicious code in @sas-dvr/nova-graph (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2ee49dd296a0db13b0118e5424d00aac99ea70cc3664bba504af096916e31998 The OpenSSF Package Analysis project identified '@sas-dvr/nova-graph' @ 132.0.0 npm as malicious. It is considered malicious because: - The...

Linux Distros Unpatched Vulnerability : CVE-2013-0326

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenStack nova base images permissions are world readable CVE-2013-0326 Note that Nessus relies on the presence of the package as reported by the vendor...

Linux Distros Unpatched Vulnerability : CVE-2021-3654

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL. CVE-2021-36...

Linux Distros Unpatched Vulnerability : CVE-2022-37394

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in OpenStack Nova before 23.2.2, 24.x before 24.1.2, and 25.x before 25.0.2. By creating a neutron port with the direct vnictype, creati...

CVE-2024-57977

In the Linux kernel, the following vulnerability has been resolved: memcg: fix soft lockup in the OOM process A soft lockup issue was found in the product with about 56,000 tasks were in the OOM cgroup, it was traversing them when the soft lockup was triggered. watchdog: BUG: soft lockup - CPU2...

CVE-2025-24612

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ihor Kit Shipping for Nova Poshta nova-poshta-ttn allows SQL Injection.This issue affects Shipping for Nova Poshta: from n/a through = 1.19.6...

CVE-2025-24612

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ihor Kit Shipping for Nova Poshta nova-poshta-ttn allows SQL Injection.This issue affects Shipping for Nova Poshta: from n/a through = 1.19.6...

CVE-2025-24612 WordPress Shipping for Nova Poshta plugin <= 1.19.6 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ihor Kit Shipping for Nova Poshta nova-poshta-ttn allows SQL Injection.This issue affects Shipping for Nova Poshta: from n/a through = 1.19.6...

CVE-2025-24612 WordPress Shipping for Nova Poshta plugin <= 1.19.6 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ihor Kit Shipping for Nova Poshta nova-poshta-ttn allows SQL Injection.This issue affects Shipping for Nova Poshta: from n/a through = 1.19.6...

CVE-2025-24612

CVE-2025-24612: Affected product is WordPress Shipping for Nova Poshta plugin (versions n/a through 1.19.6). The root cause is improper neutralization of special elements used in SQL commands, enabling SQL injection. Exploitation details are not described in the provided sources, but the CVSS met...

WordPress plugin Shipping for Nova Poshta SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...

PT-2025-5447 · Unknown · Morkva Shipping For Nova Poshta

Name of the Vulnerable Software and Affected Versions: MORKVA Shipping for Nova Poshta versions n/a through 1.19.6 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection,...

“Can you try a game I made?” Fake game sites lead to information stealers

The background and the IOCs for this blog were gathered by an Expert helper on our forums and Malwarebytes researchers. Our thanks go out to them. A new, malicious campaign is making the rounds online and it starts simple: Unwitting targets receive a direct message DM on a Discord server asking...