CVE-2024-13122 AFI < 1.100.0 - Admin+ Stored XSS

The AFI WordPress plugin before 1.100.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13123 AFI < 1.100.0 - Admin+ Stored XSS

The AFI WordPress plugin before 1.100.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13122

The AFI WordPress plugin (versions prior to 1.100.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is that the plugin fails to properly sanitise and escape certain settings, allowing high-privilege users, such as administrators, to execute XSS attacks. This vulnerability pe...

CVE-2024-13123

The AFI WordPress plugin versions prior to 1.100.0 are vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise and escape certain plugin settings, which allows high-privilege users, such as administrators, to execute malicious scripts. This vul...

CVE-2024-10679 Quiz and Survey Master (QSM) < 9.2.1 - Author+ Stored XSS

The Quiz and Survey Master QSM WordPress plugin before 9.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-10560

The Form Maker by 10Web WordPress plugin, versions prior to 1.15.30 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to properly sanitise and escape specific plugin settings. This flaw allows high-privilege users, such as administrators, to perform XSS attacks ev...

CVE-2024-10472

The Stylish Price List WordPress plugin versions prior to 7.1.12 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape certain plugin settings. This flaw allows high-privilege users, such as those with contributor roles, to execute XSS ...

CVE-2024-10105

The Job Postings WordPress plugin versions prior to 2.7.11 is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise and escape certain settings within the plugin. This flaw allows high-privilege users, such as those with contributor status, t...

CVE-2024-13123: Improper Neutralization of Input During Web Page Generation

The AFI WordPress plugin before 1.100.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-10679: Improper Neutralization of Input During Web Page Generation

The Quiz and Survey Master QSM WordPress plugin before 9.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Exploit for Deserialization of Untrusted Data in Apache Tomcat

Tomcat CVE-2025-24813 playground ===============================...

Exploit for CVE-2025-29927

Introduction By manipulating the x-middleware-subrequest req...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2025-30154link is external reviewdog action-setup GitHub Action Embedded Malicious Code Vulnerability These types of vulnerabilities are frequent attack vectors for...

CVE-2025-1203

The Slider, Gallery, and Carousel by MetaSlider WordPress plugin before 3.95.0 does not sanitise and escape some of its settings, which could allow high privilege users such as editor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example ...

VulnCheck KEV: CVE-2025-30154

reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use reviewdog/action-setup@v...

Linux kernel ACPI Device Buffer Overflow

The vulnerability of the acpidevicesetupfiles function in the drivers/acpi/devicesysfs.c file of the Linux kernel relates to access to resources through incompatible types. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of...

Exploit for CVE-2025-29927

Next.js POC for CVE-2025-29927 - Authorization Bypass in Ne...

Exploit for Improper Access Control in Zabbix

CVE-2022-23134 Writeup and POC This is a...

PT-2025-16732

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference issue has been resolved in the Linux kernel. The issue occurred due to incorrect error handling flow when pci setup device fails, leading to a kernel oops duri...

GHSA-RM69-WVPV-R2W7 Kedro allows Remote Code Execution by Pulling Micro Packages

In kedro-org/kedro version 0.19.8, the pullpackage API function allows users to download and extract micro packages from the Internet. However, the function projectwheelmetadata within the code path can execute the setup.py file inside the tar file, leading to remote code execution RCE by running...