CVE-2025-68499 WordPress JetTabs plugin <= 2.2.12 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetTabs allows DOM-Based XSS.This issue affects JetTabs: from n/a through 2.2.12...

CVE-2025-15203 SohuTV CacheCloud ResourceController.java index cross site scripting

A vulnerability was found in SohuTV CacheCloud up to 3.2.0. This impacts the function index of the file src/main/java/com/sohu/cache/web/controller/ResourceController.java. Performing manipulation results in cross site scripting. It is possible to initiate the attack remotely. The exploit has bee...

WordPress Plugin Organizer plugin < 10.2.4 - Subscriber+ SQLi vulnerability

Subscriber+ SQLi vulnerability discovered by Alex Tselevich nos3curity in WordPress Plugin Plugin Organizer versions 10.2.4...

CVE-2025-15173

A weakness has been identified in SohuTV CacheCloud up to 3.2.0. Affected is the function advancedAnalysis of the file src/main/java/com/sohu/cache/web/controller/InstanceController.java. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit...

CVE-2025-15171

A vulnerability was identified in SohuTV CacheCloud up to 3.2.0. This affects the function index of the file src/main/java/com/sohu/cache/web/controller/ServerController.java. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly...

CacheCloud 代码注入漏洞

CacheCloud is a Redis cloud management platform open-sourced by SohuTV. A code injection vulnerability exists in CacheCloud 3.2.0 and earlier versions, which stems from an incorrect operation of the function index in the file src/main/java/com/sohu/cache/web/controller/ResourceController.java,...

CVE-2025-68589

Missing Authorization vulnerability in WP Socio WP Telegram Widget and Join Link wptelegram-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Telegram Widget and Join Link: from n/a through = 2.2.12...

ONLYOFFICE Docs 跨站脚本漏洞

ONLYOFFICE Docs is an online office software from ONLYOFFICE, Inc. A cross-site scripting vulnerability exists in versions of ONLYOFFICE Docs prior to 9.2.1, which stems from mishandling of Color subject names and could lead to cross-site scripting attacks...

CVE-2025-68548

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WebCodingPlace Responsive Posts Carousel Pro responsive-posts-carousel-pro allows Stored XSS.This issue affects Responsive Posts Carousel Pro: from n/a through = 15.2...

CVE-2025-14000 Membership Plugin – Restrict Content <= 3.2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes

The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'registerform' and 'restrict' shortcodes in all versions up to, and including, 3.2.15 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2025-64282

CVE-2025-64282 affects the WordPress Radius Blocks plugin (Radius Blocks) up to version 2.2.1. The issue is an Insecure Direct Object References (IDOR) that enables an Authorization Bypass via a user-controlled key , due to misconfigured access control. Impact is described as bypassing access con...

CVE-2025-66118

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BoldGrid Sprout Clients sprout-clients allows Reflected XSS.This issue affects Sprout Clients: from n/a through = 3.2.1...

CVE-2025-60061 WordPress Kicker theme <= 2.2.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in axiomthemes Kicker kicker allows PHP Local File Inclusion.This issue affects Kicker: from n/a through = 2.2.0...

[SECURITY] Fedora 43 Update: python-django5-5.2.9-1.fc43

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...

PT-2025-52001

Name of the Vulnerable Software and Affected Versions The African Boss Get Cash versions through 3.2.3 Description An authorization issue exists in The African Boss Get Cash’s get-cash functionality. This allows exploitation due to incorrectly configured access control security levels...

phpMsAdmin 安全漏洞

phpMsAdmin is a Microsoft SQL Server administration tool by Craig Taub Individual Developer. A security vulnerability exists in phpMsAdmin version 2.2, which stems from an unfiltered dbname parameter in the databasemode.php file, which could lead to a reflective cross-site scripting attack...

WordPress plugin Events Manager 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...

Use of a Broken or Risky Cryptographic Algorithm

Overview Amazon.Extensions.S3.Encryption is an easy-to-use Amazon S3 encryption client that allows you to secure your sensitive data before you send it to Amazon S3. Affected versions of this package are vulnerable to Use of a Broken or Risky Cryptographic Algorithm due to missing cryptographic k...

CVE-2025-64239

Cross-Site Request Forgery CSRF vulnerability in Yoav Farhi RTL Tester rtl-tester allows Cross Site Request Forgery.This issue affects RTL Tester: from n/a through = 1.2...

PT-2025-51900

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.2 iPadOS versions prior to 26.2 Description A logging issue existed that allowed an application to potentially access user-sensitive data. The issue was resolved with improved data redaction. Recommendations Update to...