Medical Informatics Engineering Enterprise Health multiple vulnerabilities

RISK EVALUATION Medical Informatics Engineering Enterprise Health is an OEHR Occupational Electronic Health Record platform. Enterprise Health contains multiple vulnerabilities that could allow an attacker to inject executable content, obtain session tokens, and upload arbitrary files. 2...

CVE-2025-57292

Todoist v8484 contains a stored cross-site scripting XSS vulnerability in the avatar upload functionality. The application fails to properly validate the MIME type and sanitize image metadata...

CVE-2025-10544

CVE-2025-10544 concerns AvePoint products (DocAve <= 6.13.2, Perimeter <= 1.12.3, Compliance Guardian

CVE-2025-10858

An issue was discovered in GitLab CE/EE affecting all versions before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that allows unauthenticated users to cause a Denial of Service DoS condition while uploading specifically crafted large JSON files...

CVE-2025-10858 Allocation of Resources Without Limits or Throttling in GitLab

An issue was discovered in GitLab CE/EE affecting all versions before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that allows unauthenticated users to cause a Denial of Service DoS condition while uploading specifically crafted large JSON files...

CVE-2025-10858

Removed by vendor...

CVE-2025-10858

GitLab CE/EE vulnerable to unauthenticated DoS when uploading specially crafted large JSON files. Affected branches: all versions before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1. Impact is Denial of Service (availability impact). CVSS 3.1 base score 7.5 (HIGH) with network attack vector...

PT-2025-39512

Name of the Vulnerable Software and Affected Versions WP-DownloadManager plugin for WordPress versions prior to 1.68.12 Description The WP-DownloadManager plugin for WordPress is susceptible to unrestricted file uploads because of a lack of file type validation within the download-add.php file...

WordPress plugin WP-DownloadManager has code-related vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to set up personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A code issue...

WordPress plugin WooCommerce Designer Pro has code-related vulnerabilities.

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to set up personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A code issue...

Avepoint’s various products have code-related issues and vulnerabilities.

AvePoint DocAve and others are products of AvePoint, Inc.AvePoint DocAve is a document management platform.AvePoint Perimeter is a document sharing platform.AvePoint Compliance Guardian is a data governance platform. A code issue vulnerability exists in various Avepoint products that stems from n...

PT-2025-39622

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions prior to 18.2.7 GitLab CE/EE versions 18.3 through 18.3.2 GitLab CE/EE versions 18.4 through 18.4.0 Description An issue exists that allows unauthenticated users to cause a Denial of Service DoS condition by uploading...

PT-2025-39630

Name of the Vulnerable Software and Affected Versions DocAve versions prior to 6.13.2 Perimeter versions prior to 1.12.3 Compliance Guardian versions prior to 4.7.1 Description The software contains an unrestricted file upload issue that affects administrator users. The issue allows the upload of...

CVE-2025-59525 Horilla has Improper Input Sanitization Leading to XSS and Admin Account Takeover

Horilla is a free and open source Human Resource Management System HRMS. Prior to version 1.4.0, improper sanitization across the application allows XSS via uploaded SVG and via allowed , which can be chained to execute JavaScript whenever users view impacted content e.g., announcements. This can...

PT-2025-39320

Name of the Vulnerable Software and Affected Versions Horilla versions prior to 1.4.0 Description Horilla, a Human Resource Management System HRMS, has an issue where the file upload process lacks server-side validation. Client-side validation can be bypassed, allowing an attacker to upload an...

Improper Handling of Unicode Encoding

Overview DotNetNuke.Core is a references provider to the DotNetNuke.dll to develop extensions for the DNN Platform. Affected versions of this package are vulnerable to Improper Handling of Unicode Encoding in the CKEditor file upload endpoint. An attacker can probing internal network endpoints by...

WSO2 carbon-apimgt affected by an authenticated stored cross-site scripting (XSS) vulnerability

An authenticated stored Cross-Site Scripting XSS vulnerability exists in WSO2 API Manager components carbon-apimgt due to insufficient validation of user-supplied input during API document upload in the Publisher portal. A user with publisher privileges can upload a crafted API document whose...

GHSA-CMJC-QP7J-XGWR WSO2 carbon-apimgt affected by an authenticated stored cross-site scripting (XSS) vulnerability

An authenticated stored Cross-Site Scripting XSS vulnerability exists in WSO2 API Manager components carbon-apimgt due to insufficient validation of user-supplied input during API document upload in the Publisher portal. A user with publisher privileges can upload a crafted API document whose...

WordPress plugin product options and price calculation formulas for WooCommerce – Uni CPO (Premium) code issues and vulnerabilities

WordPress and the WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. WordPress plugin...

WSO2 Identity Server security vulnerabilities

WSO2 Identity Server IS is an identity server from the US-based WSO2, Inc. A security vulnerability exists in WSO2 Identity Server IS that originates from a failure to properly validate user input during API document uploads, which could lead to a stored cross-site scripting attack...