PT-2025-23539

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description A reflected cross-site scripting XSS issue exists due to insufficient output encoding in error messages generated by the JDBC user store connection validation request. This allows a malicious...

Srimax Output Messenger Installed (Linux)

Binary data srimaxoutputmessengerlinuxinstalled.nbin...

CVE-2025-5235

The OpenSheetMusicDisplay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

The vulnerability of the preview function of the DevTools set of web development tools for Mozilla Firefox and the Thunderbird email client allows a hacker to bypass the Content Security Policy (CSP) protection mechanism.

The vulnerability of the pre-viewing function of the DevTools set of web development tools for Mozilla Firefox and the Thunderbird email client is related to a lack of mechanisms for encoding or blocking output data when processing headers. Exploiting this vulnerability could allow an attacker to...

CVE-2025-4670

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's eddreceipt shortcode in all versions up to, and including, 3.3.8.1 due to insufficient input sanitization and output escaping on user...

CVE-2025-5285

The Product Subtitle for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘htmlTag’ parameter in all versions up to, and including, 1.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-4595 FastSpring <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The FastSpring plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fastspring/block-fastspringblocks-complete-product-catalog' block in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping on the 'color' attribute. Thi...

CVE-2025-4595

CVE-2025-4595 (FastSpring WordPress plugin) is a Stored XSS in the color attribute of the fastspring/block-fastspringblocks-complete-product-catalog block affecting all versions up to 3.0.1. Exploitation requires authenticated access at contributor level or higher; an attacker can inject scripts ...

CVE-2025-5292

CVE-2025-5292 is confirmed in the WordPress plugin Element Pack Addons for Elementor (Element Pack Addons) up to version 5.11.2. The issue is a DOM-based stored Cross-Site Scripting vulnerability due to insufficient input sanitization and output escaping in the marker_content parameter, exploitab...

CVE-2025-4590 Daisycon prijsvergelijkers <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Daisycon prijsvergelijkers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'daisyconuitvaart' shortcode in all versions up to, and including, 4.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

MGASA-2025-0171 Updated redis packages fix security vulnerability

Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client. CVE-2025-21605...

Updated redis packages fix security vulnerability

Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client. CVE-2025-21605...

PT-2025-23373 · WordPress · Fastspring Plugin

Name of the Vulnerable Software and Affected Versions: FastSpring plugin for WordPress versions up to, and including, 3.0.1 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on the color attribute in the...

PT-2025-23378 · Elementor · Element Pack Elementor Addons

Name of the Vulnerable Software and Affected Versions: The Element Pack Addons for Elementor versions up to, and including, 5.11.2 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, specifically via the marker content...

PT-2025-38448

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The extent writepage function in the Linux kernel incorrectly handles error conditions by setting the PageError flag whenever an error occurs and then checking for this flag to determine...

PT-2025-23372 · WordPress · Daisycon Prijsvergelijkers Plugin

Name of the Vulnerable Software and Affected Versions: Daisycon prijsvergelijkers plugin for WordPress versions up to, and including, 4.8.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'daisycon uitvaart' shortcode due to insufficient input sanitization and...

WordPress plugin FastSpring 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripti...

PYSEC-2025-55

vLLM is an inference and serving engine for large language models LLMs. Version 0.8.0 up to but excluding 0.9.0 have a Denial of Service ReDoS that causes the vLLM server to crash if an invalid regex was provided while using structured output. This vulnerability is similar to...

CLSA-2025-1748626881 golang: Fix of 2 CVEs

CVE-2024-24789: fix zip parsing to reject EOCDR records with truncated comments - CVE-2024-9355: fix HMAC to pass initialized length to EVPDigestSignFinal, ensuring correct output handling...

CVE-2025-4943

The CVE-2025-4943 entry concerns the LA-Studio Element Kit for Elementor WordPress plugin. It describes a Stored Cross-Site Scripting (XSS) vulnerability via the data-lakit-element-link parameter present in all versions up to and including 1.5.2, caused by insufficient input sanitization and outp...