CVE-2025-60932

Multiple stored cross-site scripting XSS vulnerabilities in the Current Goals function of HR Performance Solutions Performance Pro v3.19.17 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Goal Name, Goal Notes, Action Step Name, Action Step...

EUVD-2025-35169

Multiple stored cross-site scripting XSS vulnerabilities in the Future Goals function of HR Performance Solutions Performance Pro v3.19.17 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Goal Name, Goal Notes, Action Step Name, Action Step...

WordPress ShortPixel Image Optimizer plugin <= 6.3.4 - Authenticated (Contributor+) Settings Import/Export vulnerability

Authenticated Contributor+ Settings Import/Export vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin ShortPixel Image Optimizer versions = 6.3.4...

Ash Framework 安全漏洞

Ash Framework is an Ash Framework open source framework for building Elixir applications. A security vulnerability exists in Ash Framework version 3.6.3 through versions prior to 3.7.1, which stems from improper authorization and could lead to authentication bypass...

CVE-2025-58903

An Unchecked Return Value vulnerability CWE-252 in Fortinet FortiOS version 7.6.0 through 7.6.3 and before 7.4.8 API allows an authenticated user to cause a Null Pointer Dereference, crashing the http daemon via a specialy crafted request...

Fortinet FortiSIEM 跨站脚本漏洞

Fortinet FortiSIEM is a security information and event management system from Fortinet, Inc. The system includes features such as asset discovery, workflow automation, and unified management. A cross-site scripting vulnerability exists in Fortinet FortiSIEM that stems from improper input...

CVE-2025-52635

creationtimestamp| type| source ---|---|--- 2025-10-10 11:11:48+00:00| seen| Telegram/U6-OpfEB8PA8JmfNuGIjjqscc7fjmIVPnKg9RJrQefpg5Q...

EUVD-2025-32721

Improper Resource Locking vulnerability in B&R Industrial Automation Automation Runtime.This issue affects Automation Runtime: from 6.0 before 6.3, before Q4.93...

EUVD-2025-24461

Malicious code in bioql PyPI...

CVE-2025-47213

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the...

EUVD-2025-32331

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the...

EUVD-2025-32370

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the...

CVE-2025-9798

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Netcad Software Inc. Netigma allows Stored XSS. This issue affects Netigma: from 6.3.3 before 6.3.5 V8...

CVE-2025-9798 Stored XSS in Netcad Software's Netigma

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Netcad Software Inc. Netigma allows Stored XSS. This issue affects Netigma: from 6.3.3 before 6.3.5 V8...

CVE-2025-9798 Stored XSS in Netcad Software's Netigma

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Netcad Software Inc. Netigma allows Stored XSS. This issue affects Netigma: from 6.3.3 before 6.3.5 V8...

CVE-2025-57947

CVE-2025-57947 is a DOM-based XSS in the Photo Gallery by Ays – Responsive Image Gallery WordPress plugin. The initial description notes improper input neutralization during web page generation. Connected docs corroborate target: Photo Gallery by Ays; affected versions listed as

PT-2025-38951

Name of the Vulnerable Software and Affected Versions Awesome Support versions through 6.3.4 Description The software contains a flaw due to deserialization of untrusted data, which allows for object injection. Recommendations Update Awesome Support to a version later than 6.3.4...

PT-2025-38797

Name of the Vulnerable Software and Affected Versions Ays Pro Photo Gallery by Ays versions through 6.3.6 Description The software contains a flaw related to improper input handling during web page creation, leading to a DOM-Based Cross-site Scripting issue. This allows for the injection of...

CVE-2025-8487

The Kubio AI Page Builder plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the kubio-image-hub-install-plugin AJAX action in all versions up to, and including, 2.6.3. This makes it possible for authenticated attackers, with Subscriber-lev...

CVE-2025-36248

IBM Copy Services Manager 6.3.13 is vulnerable to cross-site scripting (CWE-79). The issue allows an unauthenticated user to embed arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. Affected product/version: IBM Copy Services Manager 6.3.13...