CVE-2025-21867

In the Linux kernel, the following vulnerability has been resolved: bpf, testrun: Fix use-after-free issue in ethskbpkttype KMSAN reported a use-after-free issue in ethskbpkttype1. The cause of the issue was that ethskbpkttype accessed skb's data that didn't contain an Ethernet header. This occur...

ChuanhuChatGPT Cross-Site Scripting Vulnerability

ChuanhuChatGPT is an application that provides a lightweight and easy-to-use web GUI and many additional features for a wide range of LLMs such as ChatGPT. ChuanhuChatGPT suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping o...

PT-2025-13153

Name of the Vulnerable Software and Affected Versions SecuPress Free versions 2.2.5.3 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. Specifically, it is a DOM-Based XSS vulnerability. This means that...

phpIPAM circuits options page cross-site scripting vulnerability

phpIPAM is phpIPAM open source set of open source PHP and MySQL based IP address management application IPAM. A cross-site scripting vulnerability exists in phpIPAM version 1.5.2, which stems from the lack of effective filtering and escaping of user-supplied data on the circuits options page, whi...

Network Time Synchronization Protocol DoS

The vulnerability of the ntpd implementation of the Network Time Synchronization Protocol is related to insufficient validation of the data entered by users during the processing of NTP packets. Exploiting this vulnerability can allow a malicious actor to cause service failures...

CVE-2025-20230

Summary of CVE-2025-20230 : In Splunk Enterprise, affected versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and in Splunk Cloud Platform’s Splunk Secure Gateway app below 3.8.38 and 3.7.23, a low-privileged user without admin/power roles could edit and delete other users’ data in App KVStore collec...

PT-2025-12892

Name of the Vulnerable Software and Affected Versions GetSocial versions through 2.0.1 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means an attacker can inject malicious scrip...

PT-2025-12894

Name of the Vulnerable Software and Affected Versions wpsiteeditor Site Editor Google Map versions 1.0.1 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an...

PT-2025-12897

Name of the Vulnerable Software and Affected Versions Pixobe Cartography versions 1.0.1 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an attacker can inje...

PT-2025-12919

Name of the Vulnerable Software and Affected Versions WP Contact Form III versions 1.6.2d and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an attacker can...

PT-2025-12917

Name of the Vulnerable Software and Affected Versions NotFound Cookies Pro versions n/a through 1.0 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Reflected XSS. This means that an attacker can...

PT-2025-12916

Name of the Vulnerable Software and Affected Versions UTM tags tracking for Contact Form 7 versions n/a through 2.1 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an...

PT-2025-12912

Name of the Vulnerable Software and Affected Versions Yendif Player Another Events Calendar versions 1.7.0 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means an...

PT-2025-12922

Name of the Vulnerable Software and Affected Versions In Stock Mailer for WooCommerce versions 2.1.1 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an...

PT-2025-12949

Name of the Vulnerable Software and Affected Versions Key4ce osTicket Bridge versions 1.4.0 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an attacker can...

Hackers Are Using Microsoft’s .NET MAUI to Spread Android Malware

McAfee Labs reveals new Android malware exploiting .NET MAUI to steal user data. Learn about advanced evasion techniques and how to stay protected...

CVE-2023-28207

The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. A plug-in may be able to inherit app permissions and access user data...

CVE-2024-7044

A Stored Cross-Site Scripting XSS vulnerability exists in the chat file upload functionality of open-webui/open-webui version 0.3.8. An attacker can inject malicious content into a file, which, when accessed by a victim through a URL or shared chat, executes JavaScript in the victim's browser. Th...

CVE-2024-12871

An XSS vulnerability in infiniflow/ragflow version 0.12.0 allows an attacker to upload a malicious PDF file to the knowledge base. When the file is viewed within Ragflow, the payload is executed in the context of the user's browser. This can lead to session hijacking, data exfiltration, or...

CVE-2024-8029

An XSS vulnerability was discovered in the upload files process of imartinez/privategpt v0.5.0. Attackers can upload malicious SVG files, which execute JavaScript when victims click on the file link. This can lead to user data theft, session hijacking, malware distribution, and phishing attacks...