16949 matches found
MAL-2025-3897 Malicious code in internallib_v370 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c10422740b7cbb39e0369e25a7deefc65842295a36c5fb7c6d10182737b2df8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Insecure temporary file creation, race with write access and permission
None...
Information Disclosure
oxid-esales/oxideshop-ce is vulnerable to information disclosure. The vulnerability is due to improper error handling and also Smarty syntax errors in CMS pages that may allow an attacker to access user information...
PT-2025-21725 · Unknown · Mapsvg Lite
Name of the Vulnerable Software and Affected Versions: MapSVG Lite versions n/a through 8.6.4 Description: The issue is related to an Improper Control of Generation of Code, also known as 'Code Injection', which affects MapSVG Lite. This allows for Code Injection. Recommendations: For versions n/...
PT-2025-21592 · Ibm · Ibm Content Navigator
Name of the Vulnerable Software and Affected Versions: IBM Content Navigator versions 3.0.11 through 3.1.0 Description: The issue allows a remote attacker to inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting sit...
PT-2025-21729 · Ultraaddons · Ultraaddons Elementor Lite
Name of the Vulnerable Software and Affected Versions: UltraAddons Elementor Lite versions prior to 2.0.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...
PT-2025-21724 · WordPress · Rs Wp Book Showcase
Name of the Vulnerable Software and Affected Versions: RS WP Book Showcase versions through 6.7.41 Description: The issue is related to an Improper Control of Generation of Code, also known as 'Code Injection', which affects RS WP Book Showcase, allowing code injection. Recommendations: For...
PT-2025-21721 · Unknown · Validatecertify
Name of the Vulnerable Software and Affected Versions: ValidateCertify versions 1.6.2 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by tricking the user into...
PT-2025-21675 · Themeton · Themeton Spare
Name of the Vulnerable Software and Affected Versions: themeton Spare versions n/a through 1.7 Description: A Cross-Site Request Forgery CSRF issue affects themeton Spare, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For themeton Spare versions n/a through...
PT-2025-21668 · Wishlist · Wishlist
Name of the Vulnerable Software and Affected Versions: Wishlist versions 2.1.0 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows the exploitation of incorrectly configured access control security levels. Recommendations: For versions 2.1.0 and...
PT-2025-21671 · Themeton · Themeton Seven Stars
Name of the Vulnerable Software and Affected Versions: themeton Seven Stars versions 1.4.4 and earlier Description: A Cross-Site Request Forgery CSRF issue allows unauthorized actions to be performed on behalf of a user. This issue may be exploited to perform actions without the user's knowledge ...
PT-2025-21749 · Unknown · Phpgurukul Online Course Registration System
Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Course Registration version 3.1 Description: A critical issue has been found in the software, affecting an unknown functionality of the file /news.php. The manipulation of the newstitle argument leads to SQL injection. This...
PT-2025-21730 · Elementor · Qi Addons For Elementor
Name of the Vulnerable Software and Affected Versions: X Addons for Elementor versions 1.0.0 through 1.0.14 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker ca...
PT-2025-21719 · Unknown · Broadstreet
Name of the Vulnerable Software and Affected Versions: Broadstreet versions through 1.51.8 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations: For versions throug...
CVE-2025-22848
Improper conditions check for some Edge Orchestrator software for IntelR Tiber™ Edge Platform may allow an authenticated user to potentially enable denial of service via adjacent access...
CVE-2024-6335
creationtimestamp| type| source ---|---|--- 2025-05-15 20:37:15+00:00| seen| https://bsky.app/profile/potato.software/post/3lpaekssgag2f...
CVE-2024-12743 MailPoet < 5.5.2 - Admin+ Stored XSS
The MailPoet WordPress plugin before 5.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
GO-2025-3672 goshs route not protected, allows command execution in github.com/patrickhener/goshs
goshs route not protected, allows command execution in github.com/patrickhener/goshs...
GO-2025-3687 Babylon Integer Overflow in Distribution Module CumulativeRewardRatio Calculation Leading to Chain Halt in github.com/babylonlabs-io/babylon
Babylon Integer Overflow in Distribution Module CumulativeRewardRatio Calculation Leading to Chain Halt in github.com/babylonlabs-io/babylon...