CVE-2025-52789

CVE-2025-52789 concerns the Lewe ChordPress WordPress plugin (versions <= 3.9.7). The vulnerability is described as a CSRF that enables Stored XSS, with CVSS v3.1 base score 7.1 (High). Public sources in the connected docs indicate an available patch: upgrading to Lewe ChordPress 4.0.1 or late...

PT-2025-26310 · Unknown · Code-Projects School Fees Payment System

Name of the Vulnerable Software and Affected Versions: code-projects School Fees Payment System version 1.0 Description: A problematic issue was found in the system, leading to cross-site request forgery. The manipulation can be initiated remotely. Recommendations: For code-projects School Fees...

PT-2025-26330 · Brplot · Brplot

Name of the Vulnerable Software and Affected Versions: brplot version 420.69.1 Description: The issue is related to a Null Pointer Dereference NPD in the br dagens handle once function of the data processing module, leading to unpredictable program behavior, causing segmentation faults, and progr...

CVE-2025-49266

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Rustaurius Ultimate Reviews ultimate-reviews allows Reflected XSS.This issue affects Ultimate Reviews: from n/a through = 3.2.14...

[SECURITY] Fedora 42 Update: python-django5-5.2.2-1.fc42

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...

CVE-2025-49856

Cross-Site Request Forgery CSRF vulnerability in CyberChimps Responsive Plus responsive-add-ons allows Cross Site Request Forgery.This issue affects Responsive Plus: from n/a through = 3.2.2...

Miliaris Amigdala 跨站脚本漏洞

Miliaris Amigdala is an application from the Italian company Miliaris. A cross-site scripting vulnerability exists in Miliaris Amigdala version v2.2.6, which stems from cross-site scripting in the Email Manager function that could lead to the execution of arbitrary HTML...

CVE-2025-48917 EU Cookie Compliance (GDPR Compliance) - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-072

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal EU Cookie Compliance GDPR Compliance allows Cross-Site Scripting XSS.This issue affects EU Cookie Compliance GDPR Compliance: from 0.0.0 before 1.26.0...

CVE-2025-31039

Improper Restriction of XML External Entity Reference vulnerability in pixelgrade Category Icon category-icon allows XML Entity Linking.This issue affects Category Icon: from n/a through = 1.0.3...

Drupal Admin Audit Trail Allocation of Resources Without Limits or Throttling vulnerability

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Admin Audit Trail allows Excessive Allocation. This issue affects Admin Audit Trail: from 0.0.0 before 1.0.5...

CVE-2025-49148 ClipShare Server Allows Local Privilege Escalation via DLL Hijacking

ClipShare is a lightweight and cross-platform tool for clipboard sharing. Prior to 3.8.5, ClipShare Server for Windows uses the default Windows DLL search order and loads system libraries like CRYPTBASE.dll and WindowsCodecs.dll from its own directory before the system path. A local, non-privileg...

GHSA-JM79-7XHW-6F6F GWC Home Page communicate version and revision information

Summary The GeoWebCache home page includes version and revision information about the software in use. This information is sensitive from a security point of view because it allows software used by the server to be easily identified. Details...

BIT-MARIADB-MIN-2021-46658

savewindowfunctionvalues in MariaDB before 10.6.3 allows an application crash because of incorrect handling of withwindowfunc=true for a subquery...

PT-2025-24925

Name of the Vulnerable Software and Affected Versions Jetimob Plataforma Imobiliaria version 20240627-0 Description The issue concerns a Cross Site Scripting XSS problem. In the "Oportunidades" section of the application, when creating or editing an "Atividade", the form field "Descrico" allows...

PT-2025-24930

Name of the Vulnerable Software and Affected Versions Jetimob Plataforma Imobiliaria version 20240627-0 Description The issue concerns Cross Site Scripting XSS in the "Pessoas" persons section, specifically via the field "Profisso" professor. Recommendations For Jetimob Plataforma Imobiliaria...

PT-2025-24653 · Unknown · Loftocean Tinysalt

Name of the Vulnerable Software and Affected Versions: LoftOcean TinySalt versions prior to 3.10.0 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows PHP Local File...

PT-2025-24932 · Unknown · Code-Projects School Fees Payment System

Name of the Vulnerable Software and Affected Versions: code-projects School Fees Payment System version 1.0 Description: A critical issue affects the processing of the file "/datatable.php". The manipulation of the sSortDir 0 argument leads to SQL injection. The attack may be initiated remotely...

CVE-2025-48141

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Alex Zaytseff Multi CryptoCurrency Payments multi-crypto-currency-payment allows SQL Injection.This issue affects Multi CryptoCurrency Payments: from n/a through = 2.0.7...

CVE-2025-48122

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows SQL Injection.This issue affects...

CVE-2025-48141

CVE-2025-48141 concerns a SQL Injection in the WordPress plugin Multi CryptoCurrency Payments (vulnerable from unknown n/a up to 2.0.3). The issue is described as an improper neutralization of special elements used in an SQL command, enabling unauthenticated network-based access with potential im...