1101 matches found
CVE-2025-43861
ManageWiki is a MediaWiki extension allowing users to manage wikis. Prior to commit 2f177dc, ManageWiki is vulnerable to reflected or stored XSS in the review dialog. A logged-in attacker must change a form field to include a malicious payload. If that same user then opens the "Review Changes"...
📄 Online Exam Mastering System 1.0 Cross Site Scripting
Online Exam Mastering System version 1.0 suffers from a cross site scripting vulnerability. Exploit Title: code-projects Online Exam Mastering System 1.0 - Reflected Cross-Site Scripting XSS Google Dork: inurl:/exam/feedback.php Date: 2025-04-19 Exploit Author: Pruthu Raut Vendor Homepage:...
CVE-2025-32612
Cross-Site Request Forgery CSRF vulnerability in rafasashi User Session Synchronizer user-session-synchronizer allows Stored XSS.This issue affects User Session Synchronizer: from n/a through = 1.4.0...
Citrix Virtual Apps and Desktops 2407 : Sophos Endpoint Agent gets loaded into ICA user session
Published app sessions are getting loaded with Sophos Endpoint Agent. This is seen under Workspace app Connection Center. Sophos Endpoint agent is getting loaded into all the Citrix ICA sessions. Citrix Workspace app Connection Center shows the "Sophos Endpoint Agent - Notification Icon". Sophos...
CVE-2025-32612
Cross-Site Request Forgery CSRF vulnerability in rafasashi User Session Synchronizer user-session-synchronizer allows Stored XSS.This issue affects User Session Synchronizer: from n/a through = 1.4.0...
CVE-2025-32612 WordPress User Session Synchronizer plugin <= 1.4.0 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery CSRF vulnerability in rafasashi User Session Synchronizer user-session-synchronizer allows Stored XSS.This issue affects User Session Synchronizer: from n/a through = 1.4.0...
CVE-2025-32612 WordPress User Session Synchronizer plugin <= 1.4.0 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery CSRF vulnerability in rafasashi User Session Synchronizer user-session-synchronizer allows Stored XSS.This issue affects User Session Synchronizer: from n/a through = 1.4.0...
CVE-2025-32612
CVE-2025-32612 concerns the WordPress plugin User Session Synchronizer. Connected documentation confirms a CSRF to Stored XSS scenario affecting User Session Synchronizer versions up to 1.4.0, with the CVE rated as HIGH (CVSS 3.1: 7.1 base score: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The Wordfenc...
WordPress User Session Synchronizer plugin <= 1.4.0 - CSRF to Stored XSS vulnerability
CSRF to Stored XSS vulnerability discovered by Abdi Pranata in WordPress Plugin User Session Synchronizer versions = 1.4.0...
WordPress plugin User Session Synchronizer 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...
PT-2025-15801
Name of the Vulnerable Software and Affected Versions: rafasashi User Session Synchronizer versions 1.4.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a w...
CVE-2025-32612: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in rafasashi User Session Synchronizer user-session-synchronizer allows Stored XSS.This issue affects User Session Synchronizer: from n/a through = 1.4.0...
CrushFTP AWS4-HMAC Authentication Bypass
This module leverages an authentication bypass in CrushFTP 11 use auxiliary/gather/crushftpauthbypasscve20252825 msf auxiliarycrushftpauthbypasscve20252825 show actions ...actions... msf auxiliarycrushftpauthbypasscve20252825 set ACTION msf auxiliarycrushftpauthbypasscve20252825 show options...
[SECURITY] [DLA 4113-1] php-horde-imp security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4113-1 [email protected] https://www.debian.org/lts/security/ Sylvain Beucler April 03, 2025 https://wiki.debian.org/LTS -...
Debian dla-4113 : php-horde-imp - security update
The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4113 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4113-1 [email protected] https://www.debian.org/lts/security/...
CVE-2024-8314
An Incorrect Implementation of Authentication Algorithm and Exposure of Data Element to Wrong Ses-sion vulnerability in the session handling used in B&R APROL 4.4-00P5 may allow an authenticated network attacker to take over a currently active user session without login credentials...
CVE-2024-10208
An Improper Neutralization of Input During Web Page Generation vulnerability in the APROL Web Portal used in B&R APROL 4.4-00P5 may allow an authenticated network-based attacker to insert malicious code which is then executed in the context of the user’s browser session...
CVE-2024-8314
CVE-2024-8314 affects B&R APROL
CVE-2025-30342
An XSS issue was discovered in OpenSlides before 4.2.5. When submitting descriptions such as Moderator Notes or Agenda Topics, an editor is shown that allows one to format the submitted text. This allows insertion of various HTML elements. When trying to insert a SCRIPT element, it is properly...