16950 matches found
PT-2025-14155 · Niteothemes · Clp – Custom Login Page
Name of the Vulnerable Software and Affected Versions: CLP – Custom Login Page by NiteoThemes versions 1.5.5 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. This means an attacker can trick a user into performing...
PT-2025-14256 · Unknown · Stylemix Pearl
Name of the Vulnerable Software and Affected Versions: Stylemix Pearl versions 1.3.9 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by tricking the user into...
PT-2025-14171 · Clearbit · Clearbit Reveal
Name of the Vulnerable Software and Affected Versions: Clearbit Reveal versions n/a through 1.0.6 Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions n/a through 1.0.6, update t...
PT-2025-14415 · Unknown · Notfound Nanosupport
Name of the Vulnerable Software and Affected Versions: NotFound NanoSupport versions 0.6.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to...
PT-2025-14409 · WordPress · Wp Bookmarks
Name of the Vulnerable Software and Affected Versions: WP Bookmarks versions 1.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to inject...
ASB-A-355411348
In multiple functions of Permissions.java, there is a possible way to override the state of the user's location permissions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...
ASB-A-378900798
In handleKeyGestureEvent of PhoneWindowManager.java, there is a possible lock screen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
ASB-A-375623125
In multiple locations, there is a possible method for a malicious app to prevent dialing emergency services under limited circumstances due to a logic error in the code. This could lead to local denial of service until the phone reboots with no additional execution privileges needed. User...
CVE-2025-29049
Cross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before fixed in 0.104.0 allows an attacker to execute arbitrary code via the MathLive function...
PUB-A-385736329
In n/a of n/a, there is a possible n/a due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
ASB-A-333344157
In multiple locations, there is a possible confused deputy due to Intent Redirect. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2025-3061
Vulnerability in Drupal Material Admin.This issue affects Material Admin:...
CVE-2025-31683 Google Tag - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-012
Cross-Site Request Forgery CSRF vulnerability in Drupal Google Tag allows Cross Site Request Forgery.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8...
CVE-2025-31674 Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3...
WordPress PowerPack Addons for Elementor plugin <= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zer0gh0st in WordPress Plugin PowerPack Addons for Elementor versions = 2.9.0...
CVE-2025-31128 gifplayer XSS vulnerability
gifplayer is a customizable jquery plugin to play and stop animated gifs. gifplayer contains a cross-site scripting XSS vulnerability. This vulnerability is fixed in 0.3.7...
GO-2025-3558 Ollama Allows Out-of-Bounds Read in github.com/ollama/ollama
Ollama Allows Out-of-Bounds Read in github.com/ollama/ollama...
GO-2025-3559 Ollama Divide By Zero vulnerability in github.com/ollama/ollama
Ollama Divide By Zero vulnerability in github.com/ollama/ollama...