GO-2025-3905 Mattermost Does Not Sanitize the Team Invite ID in github.com/mattermost/mattermost-server

Mattermost Does Not Sanitize the Team Invite ID in github.com/mattermost/mattermost-server...

GO-2025-3907 Mattermost Fails to Sanitize Path Traversal Sequences in github.com/mattermost/mattermost-server

Mattermost Fails to Sanitize Path Traversal Sequences in github.com/mattermost/mattermost-server...

CVE-2025-8150 Events Addon for Elementor <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typewriter and Countdown Widgets

The Events Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typewriter and Countdown widgets in all versions up to, and including, 2.2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

Cross-Site Scripting (Reflected XSS)

Liferay Portal is vulnerable to Reflected Cross-Site Scripting XSS. The vulnerability is due to improper input sanitization in entrycoverimagecaption.jsp within the Blogs module, which allows a remote unauthenticated attacker to inject malicious JavaScript and execute it in a victim’s browser...

PT-2025-35297

Name of the Vulnerable Software and Affected Versions Harness Open Source versions prior to 3.3.0 Description Harness Open Source’s git Large File Storage LFS server Gitness exposes APIs for retrieving and uploading files via git LFS. The implementation of the upload git LFS file API is susceptib...

PT-2025-35299

Name of the Vulnerable Software and Affected Versions: code-projects Simple Grading System version 1.0 Description: A weakness exists in the Admin Panel component of code-projects Simple Grading System. The manipulation of the ID argument in the /edit student.php file causes SQL injection. This...

CVE-2025-51967

A Reflected Cross-site Scripting XSS vulnerability exists in the themeSet.php file of ProjectsAndPrograms School Management System 1.0. The application fails to sanitize user-supplied input in the theme POST parameter, allowing an attacker to inject and execute arbitrary JavaScript in a victim's...

CVE-2025-48324

CVE-2025-48324 affects the WordPress plugin “tli.tl auto Twitter poster.” The vulnerability is stored Cross-Site Scripting (XSS) caused by improper input neutralization during web page generation, enabling an attacker to inject malicious scripts. Affected software versions: all before and includi...

CVE-2025-8603 Unlimited Elements For Elementor <= 1.5.148 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.5.148 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-8603

CVE-2025-8603 affects the WordPress plugin “Unlimited Elements For Elementor” (Auth Contributor+). Root cause: insufficient input sanitization and output escaping in multiple widgets, enabling stored XSS. Impact: authenticated attackers can inject scripts that run when other users visit the injec...

CVE-2025-9346 Booking Calendar <= 10.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 10.14.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and...

CVE-2025-8897

CVE-2025-8897 documents a Reflected Cross-Site Scripting vulnerability in Beaver Builder – WordPress Page Builder (Lite) versions up to 2.9.2.1. The issue arises from insufficient input sanitization and output escaping in the fl_builder parameter, enabling an unauthenticated attacker to inject sc...

CVE-2025-51967

A Reflected Cross-site Scripting XSS vulnerability exists in the themeSet.php file of ProjectsAndPrograms School Management System 1.0. The application fails to sanitize user-supplied input in the theme POST parameter, allowing an attacker to inject and execute arbitrary JavaScript in a victim's...

CVE-2025-51968

The CVE-2025-51968 entry concerns PuneethReddyHC Online Shopping System Advanced 1.0, where the SQL Injection vulnerability arises in the action.php file due to unsanitized input in the proId POST parameter. The impact described is that attackers can inject arbitrary SQL expressions. No exploitat...

CVE-2025-34162

CVE-2025-34162 : An unauthenticated SQL injection exists in the GetLyfsByParams endpoint of the Bian Que Feijiu Intelligent Emergency and Quality Control System, exposed via /AppService/BQMedical/WebServiceForFirstaidApp.asmx. The backend fails to sanitize the strOpid input, allowing arbitrary SQ...

CVE-2025-50978

In Gitblit v1.7.1, a reflected cross-site scripting XSS vulnerability exists in the way repository path names are handled. By injecting a specially crafted path payload an attacker can cause arbitrary JavaScript to execute when a victim views the manipulated URL. This flaw stems from insufficient...

PT-2025-34825 · Unknown · Mibuthu Link View

Name of the Vulnerable Software and Affected Versions: mibuthu Link View versions through 0.8.0 Description: The software contains an Improper Neutralization of Input During Web Page Generation issue, which allows for Stored Cross-site Scripting XSS. Recommendations: Update mibuthu Link View to a...

CVE-2025-50978

In Gitblit v1.7.1, a reflected cross-site scripting XSS vulnerability exists in the way repository path names are handled. By injecting a specially crafted path payload an attacker can cause arbitrary JavaScript to execute when a victim views the manipulated URL. This flaw stems from insufficient...

Linux Distros Unpatched Vulnerability : CVE-2022-1157

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing sanitization of logged exception messages in all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 of GitLab CE/EE causes potenti...

Linux Distros Unpatched Vulnerability : CVE-2019-20041

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wpksesbadprotocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization, as...