PT-2025-50953

Name of the Vulnerable Software and Affected Versions jshERP versions 3.5 and earlier Description The software is susceptible to a stored cross-site scripting XSS issue. Attackers can exploit this by uploading PDF files containing malicious XSS payloads. These files are then accessible through...

Form.io 信息泄露漏洞

Form.io is a combined forms and API platform for serverless applications from US-based Form.io. An information disclosure vulnerability exists in Form.io versions prior to 3.5.6 and 4.0.0-rc.1 through 4.4.2, which stems from a flaw in path handling that could lead an attacker to access a protecte...

CVE-2025-31634 WordPress Insurance theme <= 3.5 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in designthemes Insurance insurance allows Object Injection.This issue affects Insurance: from n/a through = 3.5...

CVE-2025-31634

CVE-2025-31634 describes a PHP Object Injection flaw in the WordPress theme “Insurance” (versions ≤ 3.5) due to deserializing untrusted data. Public sources (Patchstack/Red Hat/ENISA) confirm this is currently unpatched, affecting the Insurance theme up to 3.5; remediation is to upgrade to a vers...

PT-2025-43195

Name of the Vulnerable Software and Affected Versions CrocoBlock JetSearch versions through 3.5.10 Description A flaw exists in CrocoBlock JetSearch that allows for Blind SQL Injection due to improper neutralization of special elements used in SQL commands. This issue could potentially allow an...

PT-2025-43150

Name of the Vulnerable Software and Affected Versions designthemes Solar Energy versions through 3.5 Description The software contains a flaw due to deserialization of untrusted data, which can lead to object injection. Recommendations Versions prior to 3.5 should be updated...

WordPress plugin Solar Energy 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

CVE-2025-62361

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.0, an Open Redirect vulnerability was identified in the control.php endpoint of the WeGIA application, specifically in the nextPage parameter metodo=listarTodos...

EUVD-2025-24138

Malicious code in bioql PyPI...

EUVD-2025-30456

Malicious code in bioql PyPI...

EUVD-2021-33175

Malicious code in bioql PyPI...

EUVD-2025-28766

Malicious code in bioql PyPI...

CVE-2025-9230

Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a...

PT-2025-39699

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.5.0 Description WeGIA, a Web manager for charitable institutions, contains a SQL Injection flaw. The issue affects the control.php endpoint, specifically through the id produto parameter. Exploitation can occur via...

PT-2025-39704

Name of the Vulnerable Software and Affected Versions Team Members plugin for WordPress versions up to and including 5.3.5 Description The Team Members plugin for WordPress is susceptible to Stored Cross-Site Scripting through the first and last name fields. Insufficient input sanitization and...

CVE-2025-59586

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PenciDesign Penci Portfolio penci-portfolio allows DOM-Based XSS.This issue affects Penci Portfolio: from n/a through = 3.5...

CVE-2025-9943

An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider SP is configured to use an SQL database as storage service. An unauthenticated attacker can exploit this issue via blind SQL injection, allowing f...

DEBIAN-CVE-2025-9943

An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider SP is configured to use an SQL database as storage service. An unauthenticated attacker can exploit this issue via blind SQL injection, allowing f...

PT-2025-37087

Name of the Vulnerable Software and Affected Versions: Papermerge DMS versions through 3.5.3 Description: A security flaw exists in Papermerge DMS related to the Authorization Token Handler component. Manipulation of this component can lead to improper authorization. This issue can be exploited...

WordPress WP-Members Membership Plugin plugin <= 3.5.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Profile Names vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution via Profile Names vulnerability discovered by Kishan Vyas in WordPress Plugin WP-Members versions = 3.5.4.2...