11281 matches found
CVE-2025-9095 ExpressGateway express-gateway REST Endpoint users.js cross site scripting
A flaw has been found in ExpressGateway express-gateway up to 1.16.10. This issue affects some unknown processing in the library lib/rest/routes/users.js of the component REST Endpoint. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been...
CVE-2025-9095 ExpressGateway express-gateway REST Endpoint users.js cross site scripting
A flaw has been found in ExpressGateway express-gateway up to 1.16.10. This issue affects some unknown processing in the library lib/rest/routes/users.js of the component REST Endpoint. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been...
CVE-2025-9095
Summary: CVE-2025-9095 affects ExpressGateway up to 1.16.10. The issue resides in the REST Endpoint component, specifically the library file lib/rest/routes/users.js, where user-controlled input can cause cross-site scripting. The vulnerability can be triggered remotely and has publicly disclosed...
CVE-2025-7641
The Assistant for NextGEN Gallery plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation in the /wp-json/nextgenassistant/v1.0.0/control REST endpoint in all versions up to, and including, 1.0.9. This makes it possible for unauthenticated...
CVE-2025-52716
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Acato WP REST Cache wp-rest-cache allows PHP Local File Inclusion.This issue affects WP REST Cache: from n/a through = 2025.1.0...
CVE-2025-7441 StoryChief <= 1.0.42 - Unauthenticated Arbitrary File Upload
The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42. This vulnerability occurs through the /wp-json/storychief/webhook REST-API endpoint that does not have sufficient filetype validation. This makes it possible for unauthenticat...
CVE-2025-7641
The Assistant for NextGEN Gallery plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation in the /wp-json/nextgenassistant/v1.0.0/control REST endpoint in all versions up to, and including, 1.0.9. This makes it possible for unauthenticated...
CVE-2025-7641 Assistant for NextGEN Gallery <= 1.0.9 - Unauthenticated Arbitrary Directory Deletion
The Assistant for NextGEN Gallery plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation in the /wp-json/nextgenassistant/v1.0.0/control REST endpoint in all versions up to, and including, 1.0.9. This makes it possible for unauthenticated...
CVE-2025-7641
The CVE-2025-7641 entry concerns the WordPress plugin
PT-2025-33459 · Unknown +1 · Nextgen Gallery +1
Name of the Vulnerable Software and Affected Versions: Assistant for NextGEN Gallery plugin for WordPress versions up to and including 1.0.9 Description: The Assistant for NextGEN Gallery plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation i...
Malicious code in neuromorphic-rest-webdriver-manager-scripts (npm)
The package neuromorphic-rest-webdriver-manager-scripts was found to contain malicious code...
Malicious code in global-rest-gacrux-test (npm)
The package global-rest-gacrux-test was found to contain malicious code...
Malicious code in rest-cosmos-convict-jupiter (npm)
The package rest-cosmos-convict-jupiter was found to contain malicious code...
Malicious code in db2-on-cloud-rest (npm)
The package db2-on-cloud-rest was found to contain malicious code...
MAL-2025-21216 Malicious code in gauss-react-rest (npm)
The package gauss-react-rest was found to contain malicious code...
MAL-2025-32153 Malicious code in rest-cosmos-convict-jupiter (npm)
The package rest-cosmos-convict-jupiter was found to contain malicious code...
MAL-2025-28128 Malicious code in octans-taurus-rest-archaeometry (npm)
The package octans-taurus-rest-archaeometry was found to contain malicious code...
MAL-2025-16788 Malicious code in changelog-rest-spectron-telesto (npm)
The package changelog-rest-spectron-telesto was found to contain malicious code...