MAL-2025-32070 Malicious code in remix-oxygen (npm)

The package remix-oxygen was found to contain malicious code...

MAL-2025-37449 Malicious code in typopro-web-TypoPRO-Oxygen (npm)

The package typopro-web-TypoPRO-Oxygen was found to contain malicious code...

MAL-2025-22085 Malicious code in h2-test-remix-oxygen (npm)

The package h2-test-remix-oxygen was found to contain malicious code...

The vulnerability of components such as EAI and UI (Oxygen XML WebHelp) in the Oracle Siebel CRM system for managing customer relationships allows attackers to gain unauthorized access to protected information or cause service failures.

The vulnerability of the EAI and UI Oxygen XML WebHelp components of the Oracle Siebel CRM system relates to improper cleaning or release of resources. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information or cause service failures...

CVE-2024-6688

The Oxygen Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the oxysavecssfromadmin AJAX action in all versions up to, and including, 4.8.3. This makes it possible for authenticated attackers, with Subscriber-level access and...

CVE-2023-6938

The Oxygen Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a custom field in all versions up to, and including, 4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above...

CVE-2023-26559

A directory traversal vulnerability in Oxygen XML Web Author before 25.0.0.3 build 2023021715 and Oxygen Content Fusion before 5.0.3 build 2023022015 allows an attacker to read files from a WEB-INF directory via a crafted HTTP request. XML Web Author 24.1.0.3 build 2023021714 and 23.1.1.4 build...

CVE-2022-46841

Cross-Site Request Forgery CSRF vulnerability in Soflyy Oxygen Builder plugin = 4.4 versions...

CVE-2021-46827

An issue was discovered in Oxygen XML WebHelp before 22.1 build 2021082006 and 23.x before 23.1 build 2021090310. An XSS vulnerability in search terms proposals in online documentation generated using Oxygen XML WebHelp allows attackers to execute JavaScript by convincing a user to type specific...

CVE-2025-32631

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in oxygensuite Oxygen MyData for WooCommerce oxygen-mydata allows Path Traversal.This issue affects Oxygen MyData for WooCommerce: from n/a through = 1.0.64...

CVE-2025-32631

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in oxygensuite Oxygen MyData for WooCommerce oxygen-mydata allows Path Traversal.This issue affects Oxygen MyData for WooCommerce: from n/a through = 1.0.64...

CVE-2025-32631 WordPress Oxygen MyData for WooCommerce plugin <= 1.0.64 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in oxygensuite Oxygen MyData for WooCommerce oxygen-mydata allows Path Traversal.This issue affects Oxygen MyData for WooCommerce: from n/a through = 1.0.64...

CVE-2025-32631

CVE-2025-32631 affects Oxygen MyData for WooCommerce (WordPress plugin) up to version 1.0.63; root cause is improper limitation of a pathname to a restricted directory (path traversal). Impact per CVSS: network access, no confidentiality/integrity impact, but availability impact HIGH. The Wordfen...

CVE-2025-32631 WordPress Oxygen MyData for WooCommerce plugin <= 1.0.64 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in oxygensuite Oxygen MyData for WooCommerce oxygen-mydata allows Path Traversal.This issue affects Oxygen MyData for WooCommerce: from n/a through = 1.0.64...

WordPress plugin Oxygen MyData for WooCommerce 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

PT-2025-16089 · Unknown · Oxygensuite Oxygen Mydata For Woocommerce

Name of the Vulnerable Software and Affected Versions: Oxygensuite Oxygen MyData for WooCommerce versions 1.0.0 through 1.0.63 Description: The issue is related to an improper limitation of a pathname to a restricted directory, also known as 'Path Traversal'. This allows unauthorized access to...

CVE-2024-25662

Oxygen XML Web Author v26.0.0 and older and Oxygen Content Fusion v6.1 and older are vulnerable to Cross-Site Scripting XSS for malicious URLs...

CVE-2024-31380

Improper Control of Generation of Code 'Code Injection' vulnerability in Soflyy Oxygen Builder allows Code Injection. Vendor is ignoring report, refuses to patch the issue.This issue affects Oxygen Builder: from n/a through 4.9...

CVE-2024-4662

The Oxygen Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.8.2 via post metadata. This is due to the plugin storing custom data in post metadata without an underscore prefix. This makes it possible for lower privileged users, such as...

CVE-2024-6688

The Oxygen Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the oxysavecssfromadmin AJAX action in all versions up to, and including, 4.8.3. This makes it possible for authenticated attackers, with Subscriber-level access and...