8449 matches found
CVE-2024-33646
Cross-Site Request Forgery CSRF vulnerability in Toast Plugins Sticky Anything allows Cross-Site Scripting XSS.This issue affects Sticky Anything: from n/a through 2.1.5...
CVE-2024-24842
Deserialization of Untrusted Data vulnerability in Echo Plugins Knowledge Base for Documentation, FAQs with AI Assistance.This issue affects Knowledge Base for Documentation, FAQs with AI Assistance: from n/a through 11.30.2...
CVE-2024-44018
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in istmoplugins Instant Chat Floating Button for WordPress Websites instant-chat-wp allows PHP Local File Inclusion.This issue affects Instant Chat Floating Button for WordPress Websites: from n/a through =...
PT-2025-2952 · Discourse · Discourse
Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest version of Discourse core Description: Discourse is an open source platform for community discussion. In affected versions with some combinations of plugins, and with CSP disabled, activity streams in th...
Amazon Linux 2 : gstreamer1-plugins-base, --advisory ALAS2-2025-2747 (ALAS-2025-2747)
The version of gstreamer1-plugins-base installed on the remote host is prior to 1.18.4-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2747 advisory. GStreamer is a library for constructing graphs of media-handling components. A stack-buffer overflow has...
Discourse 跨站脚本漏洞
Discourse is an open source community discussion platform from Discourse Open Source. The platform includes community, email, and chat room features. Discourse suffers from a cross-site scripting vulnerability that stems from the fact that the activity stream in a user's profile page may be...
MAL-2025-1213 Malicious code in cxf-plugins (npm)
The package communicates with a domain associated with malicious activity...
Malicious code in cxf-plugins (npm)
The package communicates with a domain associated with malicious activity...
MAL-2025-817 Malicious code in command-plugins (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in command-plugins (npm)
--- -= Per source details. Do not edit below this line.=-...
WordPress Live2DWebCanvas plugin <= 1.9.11 - Authenticated (Subscriber+) Arbitrary File Deletion vulnerability
Authenticated Subscriber+ Arbitrary File Deletion vulnerability discovered by Lucio Sá in WordPress Plugin Live2DWebCanvas versions = 1.9.11...
gstreamer1-plugins-base and gstreamer1-plugins-good security update
gstreamer1-plugins-base 1.10.4-2.0.1 - Fixed CVE-2024-47607,CVE-2024-47538 and CVE-2024-47615 Orabug: 37407070 gstreamer1-plugins-good 1.10.4-2.0.1 - Fixes CVE-2024-47537, CVE-2024-47540, CVE-2024-47613 and - CVE-2024-47607 Orabug: 37407070...
PT-2025-4083 · Code Projects · Code-Projects Simple Plugins Car Rental Management
Name of the Vulnerable Software and Affected Versions: code-projects Simple Plugins Car Rental Management version 1.0 Description: A critical issue has been found in the file "/admin/approve.php", where the manipulation of the id argument leads to SQL injection. The attack can be launched remotel...
GHSA-29QP-CRVH-W22M vulnerabilities
Vulnerabilities for packages: spire-server, crossplane-provider-aws-memorydb, crossplane-provider-aws-dynamodb, crossplane-provider-aws-s3, crossplane-provider-aws-elasticache, crossplane-provider-azure, crossplane-provider-azure-sql, sftpgo, crossplane-provider-family-aws,...
CVE-2024-45338 affecting package cni-plugins for versions less than 1.4.0-2
CVE-2024-45338 affecting package cni-plugins for versions less than 1.4.0-2. A patched version of the package is available...
Security update for podman
This update for podman fixes the following issues: CVE-2024-9676: github.com/containers/storage: Fixed symlink traversal vulnerability in the containers/storage library can cause Denial of Service DoS bsc1231698 Load iptables and ip6tables kernel module bsc1214612 Required for rootless mode as a...
CVE-2024-13448 ThemeREX Addons <= 2.32.3 - Unauthenticated Arbitrary File Upload in trx_addons_uploads_save_data
The ThemeREX Addons plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'trxaddonsuploadssavedata' function in all versions up to, and including, 2.32.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the...
CVE-2025-24708
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CRM Perks WP Dynamics CRM for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms cf7-dynamics-crm allows Reflected XSS.This issue affects WP Dynamics CRM for Contact Form 7, WPForms,...
WordPress Plethora Plugins Tabs + Accordions plugin <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via anchor vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via anchor vulnerability discovered by Nishiv in WordPress Plugin Plethora Plugins Tabs + Accordions versions = 1.1.8...