CVE-2025-10187

The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to SQL Injection via the 'field' parameter in all versions up to, and including, 3.17.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

CVE-2025-10187 GSpeech TTS – WordPress Text To Speech Plugin <= 3.17.13 - Authenticated (Admin+) SQL injection

The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to SQL Injection via the 'field' parameter in all versions up to, and including, 3.17.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

CVE-2025-10187 GSpeech TTS – WordPress Text To Speech Plugin <= 3.17.13 - Authenticated (Admin+) SQL injection

The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to SQL Injection via the 'field' parameter in all versions up to, and including, 3.17.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

PT-2025-42693

Name of the Vulnerable Software and Affected Versions GSpeech TTS – WordPress Text To Speech Plugin versions through 3.17.13 Description The GSpeech TTS – WordPress Text To Speech Plugin is susceptible to SQL Injection due to inadequate input sanitization and query preparation. This allows...

CVE-2025-10187: Improper Neutralization of Special Elements used in an SQL Command

The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to SQL Injection via the 'field' parameter in all versions up to, and including, 3.17.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

EUVD-2006-0696

Malware in sbrugna...

EUVD-2006-0697

Malware in sbrugna...

EUVD-2006-0698

Malware in sbrugna...

Malicious code in com.microsoft.mrtk.tts.windows (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-47623 Malicious code in com.microsoft.mrtk.tts.windows (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2025-58664: Missing Authorization

Missing Authorization vulnerability in Azizul Hasan Text To Speech TTS Accessibility text-to-audio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Text To Speech TTS Accessibility: from n/a through = 1.9.30...

Malicious code in kokoro-tts (npm)

The package kokoro-tts was found to contain malicious code...

MAL-2025-24744 Malicious code in kokoro-tts (npm)

The package kokoro-tts was found to contain malicious code...

CVE-2019-25158

A vulnerability has been found in pedroetb tts-api up to 2.1.4 and classified as critical. This vulnerability affects the function onSpeechDone of the file app.js. The manipulation leads to os command injection. Upgrading to version 2.2.0 is able to address this issue. The patch is identified as...

soprano-tts (0.0.2) potentially affected by CVE-2025-3163 via lmdeploy (0.18.0)

lmdeploy PYPI version 0.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on lmdeploy and may be impacted: - soprano-tts 0.0.2 Source cves: CVE-2025-3163 Source advisory: SNYK:PYTHON-LMDEPLOY-10343889...

soprano-tts (0.0.2) potentially affected by CVE-2025-3162 via lmdeploy (0.18.0)

lmdeploy PYPI version 0.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on lmdeploy and may be impacted: - soprano-tts 0.0.2 Source cves: CVE-2025-3162 Source advisory: SNYK:PYTHON-LMDEPLOY-9723887...

CVE-2024-12779

A Server-Side Request Forgery SSRF vulnerability exists in infiniflow/ragflow version 0.12.0. The vulnerability is present in the "POST /v1/llm/addllm" and "POST /v1/conversation/tts" endpoints. Attackers can specify an arbitrary URL as the "apibase" when adding an "OPENAITTS" model, and...

PT-2025-12148

Name of the Vulnerable Software and Affected Versions infiniflow/ragflow version 0.12.0 Description A Server-Side Request Forgery SSRF issue exists, allowing attackers to specify an arbitrary URL as the api base when adding an OPENAITTS model. This can lead to unauthorized access to internal web...

CVE-2024-12779: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF vulnerability exists in infiniflow/ragflow version 0.12.0. The vulnerability is present in the POST /v1/llm/addllm and POST /v1/conversation/tts endpoints. Attackers can specify an arbitrary URL as the apibase when adding an OPENAITTS model, and subsequently...

PT-2025-11986

Name of the Vulnerable Software and Affected Versions Applio versions 3.2.8-bugfix and prior Description The issue concerns arbitrary file removal in the core.py component. The output tts path variable in tts.py accepts arbitrary user input, which is then passed to the run tts script function in...