CVE-2025-54475: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in the JS Jobs plugin versions 1.3.2-1.4.4 for Joomla allows low-privilege users to execute arbitrary SQL commands...

PT-2025-33482 · Joomla +1 · Joomla! +1

Name of the Vulnerable Software and Affected Versions: JS Jobs plugin versions 1.3.2 through 1.4.4 Description: A SQL injection vulnerability in the JS Jobs plugin for Joomla allows low-privilege users to execute arbitrary SQL commands. Recommendations: Update the JS Jobs plugin to a version late...

PT-2025-33127

Name of the Vulnerable Software and Affected Versions: WP Shopify WordPress plugin versions prior to 1.5.4 Description: The WP Shopify WordPress plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting issue. This could be...

CVE-2025-52361

The AK-Nord USB-Server-LXL firmware (versions up to v0.0.16 Build 2023-03-13 ) contains a local privilege escalation vulnerability due to insecure permissions on the /etc/init.d/lighttpd script. A locally authenticated user with low privileges (such as the "admin" user) can modify this script bec...

CVE-2025-7022

The My Reservation System WordPress plugin through 2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2025-7022

The My Reservation System WordPress plugin through 2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2025-7022 My Reservation System <= 2.3 - Reflected XSS

The My Reservation System WordPress plugin through 2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2025-7022

The My Reservation System WordPress plugin (versions through 2.3 ) is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly sanitize and escape user-supplied data before it is output back to the page. An attacker could exploit this by injecting a car...

CVE-2025-6174

The Qwizcards | online quizzes and flashcards WordPress plugin through 3.9.4 does not sanitise and escape the "stylesheet" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or any other user...

CVE-2025-6174 WordPress Qwizcards <= 3.9.4 - Reflected XSS

The Qwizcards | online quizzes and flashcards WordPress plugin through 3.9.4 does not sanitise and escape the "stylesheet" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or any other user...

CVE-2025-6174

The Qwizcards WordPress plugin (versions prior to 3.95 ) is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly sanitize and escape the ‘_stylesheet’ (or "theme_stylesheet" ) parameter before it is output back onto the page. An attacker can exploit...

CVE-2025-49484

A SQL injection vulnerability in the JS Jobs plugin versions 1.0.0-1.4.1 for Joomla allows low-privilege users to execute arbitrary SQL commands via the 'cvid' parameter in the employee application feature...

CVE-2025-49484

A SQL injection vulnerability in the JS Jobs plugin versions 1.0.0-1.4.1 for Joomla allows low-privilege users to execute arbitrary SQL commands via the 'cvid' parameter in the employee application feature...

CVE-2025-49484 Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.1 for Joomla

A SQL injection vulnerability in the JS Jobs plugin versions 1.0.0-1.4.1 for Joomla allows low-privilege users to execute arbitrary SQL commands via the 'cvid' parameter in the employee application feature...

PT-2025-30021 · Joomla · Js Jobs Plugin

Name of the Vulnerable Software and Affected Versions: JS Jobs plugin for Joomla versions 1.0.0 through 1.4.1 Description: A SQL injection vulnerability in the JS Jobs plugin for Joomla allows low-privilege users to execute arbitrary SQL commands via the cvid parameter in the employee application...

CVE-2025-49484: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in the JS Jobs plugin versions 1.0.0-1.4.1 for Joomla allows low-privilege users to execute arbitrary SQL commands via the 'cvid' parameter in the employee application feature...

CVE-2025-6234

The Hostel WordPress plugin before 1.1.5.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2025-6236

The Hostel WordPress plugin before 1.1.5.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2025-6234 Hostel < 1.1.5.8 - Reflected XSS

The Hostel WordPress plugin before 1.1.5.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2025-6234 Hostel < 1.1.5.8 - Reflected XSS

The Hostel WordPress plugin before 1.1.5.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...