EUVD-2025-24927

Malicious code in bioql PyPI...

EUVD-2025-30727

Malicious code in bioql PyPI...

EUVD-2025-28513

Malicious code in bioql PyPI...

EUVD-2025-26045

Malicious code in bioql PyPI...

EUVD-2024-42401

Malicious code in bioql PyPI...

EUVD-2025-20705

Malicious code in bioql PyPI...

EUVD-2023-52493

Malicious code in bioql PyPI...

EUVD-2025-30507

Malicious code in bioql PyPI...

EUVD-2025-28512

Malicious code in bioql PyPI...

EUVD-2025-30550

Malicious code in bioql PyPI...

EUVD-2025-27403

Malicious code in bioql PyPI...

EUVD-2025-30537

Malicious code in bioql PyPI...

EUVD-2025-3697

Malicious code in bioql PyPI...

CVE-2025-9129 Flexi <= 4.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via flexi-form-tag Shortcode

The Flexi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin for WordPress's flexi-form-tag shortcode in all versions up to, and including, 4.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-9884 Mobile Site Redirect <= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Mobile Site Redirect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious w...

CVE-2025-9332 Interactive Medical Drawing of Human Body <= 2.6 - Authenticated (Admin+) Stored Cross-Site Scripting

The Interactive Human Anatomy with Clickable Body Parts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

PT-2025-40605

Name of the Vulnerable Software and Affected Versions KUNO CMS versions prior to 1.3.14 Description KUNO CMS, a full-stack blog application, has flaws in its file upload functionality. The upload process only validates file types based on Content-Type headers and does not analyze file content or...

CVE-2025-40989

CVE-2025-40989 describes a stored cross-site scripting vulnerability in Ekushey CRM v5.0 (Creativeitem) caused by insufficient validation of user input in the POST endpoint dealing with the applicant’s message, specifically the API path that includes the message parameter. The affected component ...

CVE-2025-9512

The Schema & Structured Data for WP & AMP WordPress plugin before 1.50 does not properly handles HTML tag attribute modifications, making it possible for unauthenticated attackers to conduct Stored XSS attacks via post comments...

CVE-2025-10196

The Survey Anyplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'surveyanyplaceembed' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...