EUVD-2025-34814

bagisto has a Cross Site Scripting XSS vulnerability in TinyMCE Image Upload SVG...

CVE-2025-62414 bagisto - Cross Site Scripting (XSS) in Create New Customer

Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the “Create New Customer” feature in the admin panel is vulnerable to Cross-Site Scripting XSS. An attacker with access to the admin create-customer form can inject malicious JavaScript payloads into certain input fields...

Oct8ne Chatbot 跨站脚本漏洞

Oct8ne Chatbot is a chatbot from Oct8ne. A cross-site scripting vulnerability exists in Oct8ne Chatbot version v2.3, which stems from stored cross-site scripting and could lead to an attacker executing JavaScript code in the victim's browser...

Oracle E-Business Suite Information (CVE-2025-61884)

The version of Oracle E-Business Suite installed on the remote host is affected by an information disclosure vulnerability as referenced in the CVE-2025-61884 Security Alert Advisory. - Vulnerability in the Oracle Configurator product of Oracle E-Business Suite component: Runtime UI. Supported...

CVE-2025-11380

The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'everestprocessstatus' AJAX action in all versions up to, and including, 2.3.5. This makes it possible for...

CVE-2025-61882

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite component: BI Publisher Integration. Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

EUVD-2011-0431

Malware in sbrugna...

CVE-2025-61777 FlagForge Allows Unauthenticated Badge Template API Access

Flag Forge is a Capture The Flag CTF platform. Starting in version 2.0.0 and prior to version 2.3.2, the /api/admin/badge-templates GET and /api/admin/badge-templates/create POST endpoints previously allowed access without authentication or authorization. This could have enabled unauthorized user...

VulnCheck KEV: CVE-2025-61882

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite component: BI Publisher Integration. Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

EUVD-2025-31126

Malicious code in bioql PyPI...

EUVD-2025-31401

Malicious code in bioql PyPI...

EUVD-2025-26219

Malicious code in bioql PyPI...

EUVD-2025-29651

Malicious code in bioql PyPI...

PT-2025-40061

Name of the Vulnerable Software and Affected Versions ZoloBlocks plugin for WordPress versions prior to 2.3.10 Description The software is susceptible to Stored Cross-Site Scripting XSS through multiple Gutenberg blocks. This is a result of inadequate input sanitization and output escaping of...

CVE-2025-60102

CVE-2025-60102 : Stored Cross-Site Scripting in WPFront User Role Editor for WordPress. Affected software: WPFront User Role Editor, version range up to and including 4.2.3. Root cause and impact: improper neutralization of input during web page generation leading to stored XSS. Public details in...

CVE-2025-58678

Missing Authorization vulnerability in PickPlugins Accordion accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion: from n/a through = 2.3.15...

CVE-2025-58222

Missing Authorization vulnerability in Maidul Team Manager wp-team-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team Manager: from n/a through = 2.5.1...

CVE-2025-58678 WordPress Accordion Plugin <= 2.3.15 - Broken Access Control Vulnerability

Missing Authorization vulnerability in PickPlugins Accordion accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion: from n/a through = 2.3.15...

PT-2025-38815

Name of the Vulnerable Software and Affected Versions WP CodeUs WP Proposals versions prior to 2.3 Description The software contains a flaw due to improper neutralization of input during web page generation, leading to a Cross-site Scripting issue. This allows for Stored XSS attacks...

PT-2025-38784

Name of the Vulnerable Software and Affected Versions Aurélien LWS LWS Affiliation versions through 2.3.6 Description A Cross-Site Request Forgery CSRF issue exists in Aurélien LWS LWS Affiliation. This allows for the execution of unwanted actions on behalf of an authenticated user. The issue...