17029 matches found
PT-2025-26377 · Unknown · Nitin Yawalkar Rdfa Breadcrumb
Name of the Vulnerable Software and Affected Versions: Nitin Yawalkar RDFa Breadcrumb versions 2.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables attackers to injec...
CVE-2025-45331
brplot v420.69.1 contains a Null Pointer Dereference NPD vulnerability in the brdagenshandleonce function of its data processing module, leading to unpredictable program behavior, causing segmentation faults, and program crashes...
PT-2025-26406 · Boldgrid · Post/Page Builder By Boldgrid
Name of the Vulnerable Software and Affected Versions: Post and Page Builder by BoldGrid – Visual Drag and Drop Editor versions 1.27.8 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user...
PT-2025-26427 · Unknown · Rameez Iqbal Real Estate Manager
Name of the Vulnerable Software and Affected Versions: Rameez Iqbal Real Estate Manager versions n/a through 7.3 Description: A Cross-Site Request Forgery CSRF issue allows Privilege Escalation. This is a type of attack where an attacker tricks a user into performing unintended actions on a web...
PT-2025-26394 · Unknown · Jordy Meow Code Engine
Name of the Vulnerable Software and Affected Versions: Jordy Meow Code Engine versions 0.3.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...
PT-2025-26348 · WordPress +1 · Wp User Profile Avatar +1
Name of the Vulnerable Software and Affected Versions: WP User Profile Avatar versions 1.0.0 through 1.0.6 Description: The issue is related to a Missing Authorization vulnerability in WP Event Manager WP User Profile Avatar, which allows exploiting incorrectly configured access control security...
PT-2025-26352 · Unknown · Powerpress Podcasting
Name of the Vulnerable Software and Affected Versions: PowerPress Podcasting versions through 11.12.11 Description: The issue is a Server-Side Request Forgery SSRF vulnerability that allows Server Side Request Forgery. Recommendations: For versions through 11.12.11, update to a version later than...
PT-2025-26370 · Unknown · Csv Importer Improved
Name of the Vulnerable Software and Affected Versions: CSV Importer Improved versions 0.6.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...
PT-2025-26363 · Rafflepress · Giveaways/Contests By Rafflepress
Name of the Vulnerable Software and Affected Versions: Giveaways and Contests by RafflePress versions 1.12.17 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by Access Control Lists ACLs. This...
PT-2025-26389 · Unknown · Mailing Group Listserv
Name of the Vulnerable Software and Affected Versions: Yamna Khawaja Mailing Group Listserv versions 3.0.5 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the Mailing Group Listserv, allowing unauthorized actions to be performed on behalf of the user. Recommendations: For...
PT-2025-26397 · Stellarwp · Stellarwp Wpcomplete
Name of the Vulnerable Software and Affected Versions: StellarWP WPComplete versions n/a through 2.9.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...
PT-2025-26353 · Unknown · Ali Irani Auto Upload Images
Name of the Vulnerable Software and Affected Versions: Ali Irani Auto Upload Images versions 3.3.2 and earlier Description: The issue is a Server-Side Request Forgery SSRF vulnerability that allows Server Side Request Forgery. This means an attacker can potentially force the server to make reques...
PT-2025-26359 · WordPress · Wp-Recall
Name of the Vulnerable Software and Affected Versions: WP-Recall versions prior to 16.26.14 Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For versions prior to 16.26.14, update to...
PT-2025-26343 · Jobwp · Jobwp
Name of the Vulnerable Software and Affected Versions: JobWP versions n/a through 2.4.0 Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions n/a through 2.4.0, update to a versio...
PT-2025-26412 · Unknown · Logo Manager For Samandehi
Name of the Vulnerable Software and Affected Versions: Logo Manager For Samandehi versions 0.5 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. Recommendations: For Logo Manager For Samandehi versions 0.5 and earlier, update to a versio...
PT-2025-26329 · Ibm · Ibm Spectrum Protect Server
Name of the Vulnerable Software and Affected Versions: IBM Spectrum Protect Server versions 8.1 through 8.1.26 Description: The issue is related to improper session authentication, which can allow an attacker to bypass authentication. This can result in access to unauthorized resources...
CVE-2025-6283 xataio Xata Agent route.ts GET path traversal
A vulnerability was found in xataio Xata Agent up to 0.3.0. It has been classified as problematic. This affects the function GET of the file apps/dbagent/src/app/api/evals/route.ts. The manipulation of the argument passed leads to path traversal. Upgrading to version 0.3.1 is able to address this...
Cross-site Scripting (XSS)
starcitizentools/citizen-skin is vulnerable to cross-site scripting XSS. The vulnerability is due to inadequate output encoding due to date messages returned by Language::userDate being directly inserted into raw HTML, allowing users with editinterface rights to inject arbitrary HTML...
HTML Injection
starcitizentools/citizen-skin is vulnerable to HTML injection. The vulnerability is due to unsanitized user-controlled input being directly inserted into raw HTML without proper validation or escaping, allowing an attacker to inject arbitrary HTML into the DOM and potentially perform Cross-Site...
