CVE-2025-69195

A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename restriction options are active. A remote attacker can exploit this by providing a specially crafted...

CVE-2025-69195

A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename restriction options are active. A remote attacker can exploit this by providing a specially crafted...

CVE-2025-69195

CVE-2025-69195 affects wget2. A stack-based buffer overflow in the filename sanitization logic (notably get_local_filename_real) can be triggered by attacker-controlled URL paths, potentially causing memory corruption on user interaction. Public advisories indicate a fix in wget2 2.2.1 (and relat...

CVE-2025-69195 Wget2: gnu wget2: memory corruption and crash via filename sanitization logic with attacker-controlled urls

A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename restriction options are active. A remote attacker can exploit this by providing a specially crafted...

EUVD-2025-206266

The Brevo for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘userconnectionid’ parameter in all versions up to, and including, 4.0.49 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-22713

The CVE-2026-22713 issue affects MediaWiki - GrowthExperiments Extension versions 1.39, 1.43, 1.44, and 1.45, where improper neutralization of input during web page generation enables Cross-Site Scripting (XSS). The vulnerability stems from how edit summaries are processed, allowing injected scri...

The vulnerability of the Red Hat Ansible Automation Platform lies in the lack of proper input sanitization when requesting an external authentication server. This allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the Red Hat Ansible Automation Platform lies in the lack of proper input sanitization when requesting an external authentication server. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information...

CVE-2025-69542

The CVE-2025-69542 entry affects D-Link DIR895LA1, specifically the DHCP daemon (DIR895LA1 v102b07). The issue is in lease renewal handling where the DHCP hostname is concatenated into a system command without sanitization, allowing arbitrary commands to run with root privileges. Public reference...

PT-2026-1722

Name of the Vulnerable Software and Affected Versions Top Position Google Finance versions up to and including 0.1.0 Description The Top Position Google Finance plugin for WordPress is susceptible to Reflected Cross-Site Scripting due to inadequate input sanitization and output escaping. This...

Improper Validation of Syntactic Correctness of Input

Amendment This was deemed not a vulnerability. Overview Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input in the region input field. An attacker can cause AWS API calls to be routed to unintended or non-existent hosts by supplying an invalid...

Improper Validation of Syntactic Correctness of Input

Amendment This was deemed not a vulnerability. Overview Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input in the region input field. An attacker can cause AWS API calls to be routed to unintended or non-existent hosts by supplying an invalid...

JavaScript SDK v2 users should add validation to the region parameter value in or migrate to v3

CVSSv3.1 Rating: 3.7 LOW Summary This notification is related to the use of specific values for the region input field when calling AWS services. An actor with access to the environment in which the SDK is used could set the region input field to an invalid value. Per the AWS shared responsibilit...

Cross-Site-Scripting---XSS

Cross Site Scripting XSS Assignment Objective Demonstrate Cro...

UBUNTU-CVE-2026-22028

Preact, a lightweight web development framework, JSON serialization protection to prevent Virtual DOM elements from being constructed from arbitrary JSON. A regression introduced in Preact 10.26.5 caused this protection to be softened. In applications where values from JSON payloads are assumed t...

CVE-2026-22028 Preact has JSON VNode Injection issue

Preact, a lightweight web development framework, JSON serialization protection to prevent Virtual DOM elements from being constructed from arbitrary JSON. A regression introduced in Preact 10.26.5 caused this protection to be softened. In applications where values from JSON payloads are assumed t...

CVE-2025-68887

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CMSJunkie - WordPress Business Directory Plugins WP-BusinessDirectory wp-businessdirectory allows Reflected XSS.This issue affects WP-BusinessDirectory: from n/a through = 4.0.1...

CVE-2025-14984

CVE-2025-14984 : Gutenverse Form for WordPress is vulnerable to Stored Cross-Site Scripting via SVG uploads in all versions up to and including 2.3.2. The issue arises because the plugin framework adds SVG to allowed MIME types without sanitizing contents, enabling authenticated attackers with Au...

Regular Expression Denial of Service (ReDoS)

Overview org.webjars.npm:diff is a javascript text differencing implementation. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the parsePatch and applyPatch functions if the user input passed without sanitisation. An attacker can cause the proce...

CVE-2025-14275 Jeg Elementor Kit <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget

The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.0.1 due to insufficient input sanitization in the countdown widget's redirect functionality. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2019-25284

V-SOL GPON/EPON OLT Platform v2.03 contains multiple reflected cross-site scripting vulnerabilities due to improper input sanitization in various script parameters. Attackers can exploit these vulnerabilities by injecting malicious HTML and script code to execute arbitrary scripts in a victim's...