CVE-2025-26660

SAP Fiori applications using the posting library fail to properly configure security settings during the setup process, leaving them at default or inadequately defined. This vulnerability allows an attacker with low privileges to bypass access controls within the application, enabling them to...

CVE-2024-12380

GitLab EE/CE vulnerable in affected releases (11.5–17.7.7; 17.8–17.8.5; 17.9–17.9.2) due to certain user inputs in repository mirroring settings that could expose sensitive authentication information. Impact: potential disclosure of credentials with network access; no user interaction required. E...

CVE-2024-12380 Generation of Error Message Containing Sensitive Information in GitLab

An issue was discovered in GitLab EE/CE affecting all versions starting from 11.5 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2. Certain user inputs in repository mirroring settings could potentially expose sensitive authentication...

GitLab EE/CE 安全漏洞

GitLab Enterprise Edition EE and GitLab Community Edition CE are both products of GitLab, Inc. GitLab Enterprise Edition is a content management system. GitLab Enterprise Edition is a content management system. A security vulnerability exists in GitLab EE/CE versions prior to 11.5 through 17.7.7,...

WordPress plugin Limit Bio 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

CVE-2025-24387

A vulnerability in OTRS Application Server allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS sessions. A request to an OTRS endpoint from a possible malicious web site, would send the authentication cookie, performing an unwanted read operation. This issue...

GO-2025-3503 HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NOPROXY environment variable is set to ".example.com", a request to "::1%25.example.com:80 will incorrectly match and not be proxied...

CVE-2025-2078

The BlogBuzzTime for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissio...

CVE-2025-2205 GDPR Cookie Compliance <= 4.15.6 - Authenticated (Admin+) Stored Cross-Site Scripting

The GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice – CCPA, DSGVO, RGPD plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.15.6 due to insufficient input sanitization and output escaping. This makes it...

GHSA-HCGH-R5GQ-6QC2 Microweber vulnerable to XSS attack due to insure `group` component in its Settings handler

A vulnerability was found in Microweber 2.0.19. It has been rated as problematic. This issue affects some unknown processing of the file userfiles/modules/settings/group/websitegroup/index.php of the component Settings Handler. The manipulation of the argument group leads to cross site scripting...

Microweber vulnerable to XSS attack due to insure `group` component in its Settings handler

A vulnerability was found in Microweber 2.0.19. It has been rated as problematic. This issue affects some unknown processing of the file userfiles/modules/settings/group/websitegroup/index.php of the component Settings Handler. The manipulation of the argument group leads to cross site scripting...

Apache Tomcat Remote Code Execution Vulnerability

Apache Tomcat is an open source lightweight Java Web server and Servlet container , designed to run Java Servlet and JSP core tools designed to support dynamic content processing and hosting of static resources , is the cornerstone of small and medium-sized Java Web application development and...

PT-2025-10993 · WordPress · Blogbuzztime

Name of the Vulnerable Software and Affected Versions: BlogBuzzTime for WP plugin for WordPress versions up to, and including, 1.1 Description: The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows...

Cross-site Scripting (XSS)

Overview microweber/microweber is a new generation CMS with drag and drop. Affected versions of this package are vulnerable to Cross-site Scripting XSS through the manipulation of the group argument in the Settings Handler due to improper sanitization before being rendered on the page. Details...

CVE-2025-2214 Microweber Settings index.php cross site scripting

A vulnerability was found in Microweber 2.0.19. It has been rated as problematic. This issue affects some unknown processing of the file userfiles/modules/settings/group/websitegroup/index.php of the component Settings Handler. The manipulation of the argument group leads to cross site scripting...

CVE-2025-2214

CVE-2025-2214 affects Microweber 2.0.19. The vulnerability is an XSS in the Settings Handler, triggered by manipulating the group argument in the file path userfiles/modules/settings/group/website_group/index.php. It can be exploited remotely and the public PoC has been disclosed. No fixed versio...

CVE-2025-1434

CVE-2025-1434 describes an XSS vulnerability in the Spreadsheet view of Areal Topkapi Vision Webserv2. The weakness allows a remote, unauthenticated attacker to read a limited amount of values or perform a denial-of-service (DoS) on the affected spreadsheet. Disclosure of secrets or other system ...

CVE-2025-0629

The Coronavirus COVID-19 Notice Message WordPress plugin through 1.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

CVE-2024-13580

The XV Random Quotes WordPress plugin through 1.40 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack...

CVE-2024-13615

CVE-2024-13615 affects the WordPress plugin “Social Snap” (Social Share Buttons / Social Sharing Icons / Click to Tweet) up to version 1.3.6. Public description: stored cross-site scripting (XSS) could be triggered by high-privilege admins via unsanitised/unescaped settings, even when unfiltered_...