Improper Removal of Sensitive Information Before Storage or Transfer

Overview Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer via the URIjoin, URImerge, and URI+ methods, which may expose stored credentials from userinfo, after the host is replaced. An attacker can cause a URL to a malicious...

CVE-2025-25115

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Zeshan Abdullah Like dislike plus counter like-dislike-plus-counter allows Stored XSS.This issue affects Like dislike plus counter: from n/a through = 1.0...

CVE-2025-25108

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in shalomworld SW Plus shalom-world-media-gallery allows Reflected XSS.This issue affects SW Plus: from n/a through = 2.1...

Vulnerability fixed in Zohocorp ManageEngine ADSelfService Plus

Zohocorp has fixed a vulnerability in ManageEngine ADSelfService Plus Specifically for versions 6510 and earlier. The vulnerability is in the way sessions are managed in ManageEngine ADSelfService Plus. This issue allows valid account holders to abuse the system, which can lead to possible accoun...

CVE-2025-25115 WordPress Like dislike plus counter plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Zeshan Abdullah Like dislike plus counter like-dislike-plus-counter allows Stored XSS.This issue affects Like dislike plus counter: from n/a through = 1.0...

CVE-2025-25108

CVE-2025-25108 describes a reflected XSS vulnerability in the WordPress SW Plus plugin (versions up to 2.1). The issue arises from improper input neutralization during web page generation, enabling an attacker-controlled input to be reflected in the page. Affected product: WordPress SW Plus plugin

CVE-2025-25115

CVE-2025-25115 concerns the WordPress plugin Like dislike plus counter (also listed as Like Dislike Buttons) with a Cross-Site Scripting (XSS) vulnerability that allows stored XSS. The vulnerability affects version

CVE-2025-1723

Zohocorp ManageEngine ADSelfService Plus versions 6510 and below are vulnerable to account takeover due to the session mishandling. Valid account holders in the setup only have the potential to exploit this bug...

CVE-2025-1723 Account takeover

Zohocorp ManageEngine ADSelfService Plus versions 6510 and below are vulnerable to account takeover due to the session mishandling. Valid account holders in the setup only have the potential to exploit this bug...

ZOHO ManageEngine ADSelfService Plus 授权问题漏洞

ZOHO ManageEngine ADSelfService Plus is ZOHO's integrated self-service password management and single sign-on solution for Active Directory and cloud applications. A security vulnerability exists in ZOHO ManageEngine ADSelfService Plus 6510 and prior versions that stems from improper session...

CVE-2025-1723: Improper Authentication

Zohocorp ManageEngine ADSelfService Plus versions 6510 and below are vulnerable to account takeover due to the session mishandling. Valid account holders in the setup only have the potential to exploit this bug...

PT-2025-9435

Name of the Vulnerable Software and Affected Versions shalomworld SW Plus versions n/a through 2.1 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. Recommendations For versions n/a through...

PT-2025-9440

Name of the Vulnerable Software and Affected Versions Like dislike plus counter versions 1.0 and earlier Description The issue is related to improper neutralization of input during web page generation, which leads to a Cross-site Scripting XSS vulnerability. Specifically, it is a Stored XSS...

CVE-2025-25115: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Zeshan Abdullah Like dislike plus counter like-dislike-plus-counter allows Stored XSS.This issue affects Like dislike plus counter: from n/a through = 1.0...

CVE-2025-25108: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in shalomworld SW Plus shalom-world-media-gallery allows Reflected XSS.This issue affects SW Plus: from n/a through = 2.1...

WordPress plugin SW Plus 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

USN-7310-1 linux-oem-6.11 vulnerabilities

Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service system crash or possibly execute arbitrary code...

WordPress Ultra Addons Lite for Elementor plugin <= 1.1.8 - Authenticated (Contributor+) Restricted Post Disclosure vulnerability

Authenticated Contributor+ Restricted Post Disclosure vulnerability discovered by Francesco Carlucci in WordPress Plugin Ultra Addons Lite for Elementor versions = 1.1.8...

PT-2025-8919

Name of the Vulnerable Software and Affected Versions The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid versions prior to 1.16.9 Description The issue allows authenticated attackers with Administrator-level access and above to make web requests to arbitrary locations...

CVE-2024-13907: Server-Side Request Forgery (SSRF)

The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.16.8 via the 'download' function. This makes it possible for authenticated attackers, with Administrator-level...