546 matches found
CVE-2025-13847
The PhotoFade plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'time' parameter in all versions up to, and including, 0.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...
CVE-2025-13847 PhotoFade <= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
The PhotoFade plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'time' parameter in all versions up to, and including, 0.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...
CVE-2025-13847
CVE-2025-13847 — PhotoFade (WordPress) Vulnerability type: Stored XSS in the PhotoFade WordPress plugin via the time parameter. Affected versions: all versions up to and including 0.2.1. Root cause: Insufficient input sanitization and output escaping in the time parameter. Impact: Authenticated a...
CVE-2025-13847 PhotoFade <= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
The PhotoFade plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'time' parameter in all versions up to, and including, 0.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...
CVE-2025-13847: Improper Neutralization of Input During Web Page Generation
The PhotoFade plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'time' parameter in all versions up to, and including, 0.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...
PT-2026-1608
Name of the Vulnerable Software and Affected Versions PhotoFade plugin for WordPress versions up to and including 0.2.1 Description The PhotoFade plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to inadequate input sanitization and output escaping related to the tim...
CVE-2026-0640
CVE-2026-0640 affects Tenda AC23 firmware 16.03.07.52. The vulnerability resides in the sscanf usage of /goform/PowerSaveSet where tampering with the Time argument can cause a buffer overflow. Exploitation can be remote, and public PoC/exploit information exists. Affected component: the PowerSave...
PT-2026-1431
Name of the Vulnerable Software and Affected Versions Tenda AC23 version 16.03.07.52 Description A flaw exists in Tenda AC23 version 16.03.07.52 related to a buffer overflow. The issue is located in the /goform/PowerSaveSet file and specifically affects the sscanf function. Manipulation of the Ti...
Tenda AC23 安全漏洞
Tenda AC23 is a dual-band gigabit wireless router from Tenda China. A security vulnerability exists in Tenda AC23 version 16.03.07.52, which originates from an incorrect manipulation of the parameter Time in the file /goform/PowerSaveSet, which may result in a buffer overflow...
CVE-2025-55901
TOTOLINK A3300R V17.0.0cu.596B20250515 is vulnerable to command injection in the function NTPSyncWithHost via the hosttime parameter...
CVE-2025-55901
TOTOLINK A3300R V17.0.0cu.596B20250515 is vulnerable to command injection in the function NTPSyncWithHost via the hosttime parameter...
CVE-2025-55901
TOTOLINK A3300R V17.0.0cu.596B20250515 is vulnerable to command injection in the function NTPSyncWithHost via the hosttime parameter...
EUVD-2025-203393
TOTOLINK A3300R V17.0.0cu.596B20250515 is vulnerable to command injection in the function NTPSyncWithHost via the hosttime parameter...
CVE-2025-55901
TOTOLINK A3300R V17.0.0cu.596B20250515 is vulnerable to command injection in the function NTPSyncWithHost via the hosttime parameter...
TOTOLINK A3300R 安全漏洞
TOTOLINK A3300R is a wireless router from China Gion Electronics TOTOLINK. A security vulnerability exists in TOTOLINK A3300R V17.0.0cu.596B20250515, which originates from a command injection in the hosttime parameter of the NTPSyncWithHost function...
CVE-2025-55901
TOTOLINK A3300R V17.0.0cu.596B20250515 is vulnerable to command injection in the function NTPSyncWithHost via the hosttime parameter...
PT-2025-51256
Name of the Vulnerable Software and Affected Versions TOTOLINK A3300R version V17.0.0cu.596 B20250515 Description The TOTOLINK A3300R router firmware contains a command injection flaw in the NTPSyncWithHost function. The issue is triggered through the host time parameter. This allows for potentia...
CVE-2025-67648 Shopware's inproper input validation can lead to Reflected XSS through Storefront Login Page
Shopware is an open commerce platform. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 have a Reflected XSS vulnerability in AuthController.php. A request parameter from the login page URL is directly rendered within the Twig template of the Storefront login page without further...