CVE-2025-25103 WordPress Indeed API Plugin <= 0.5 - CSRF to Settings Change vulnerability

Cross-Site Request Forgery CSRF vulnerability in bnielsen Indeed API indeed-api allows Cross Site Request Forgery.This issue affects Indeed API: from n/a through = 0.5...

WordPress plugin Indeed API 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

WordPress Indeed API Plugin <= 0.5 - CSRF to Settings Change vulnerability

CSRF to Settings Change vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Indeed API versions = 0.5...

WordPress plugin Single-user-chat 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2025-22324

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Andon Ivanov OZ Canonical oz-canonical allows Reflected XSS.This issue affects OZ Canonical: from n/a through = 0.5...

CVE-2025-22324

CVE-2025-22324 | Affects OZ Canonical (Andon Ivanov). Root cause: improper input neutralization during web page generation, enabling a reflected XSS. Affected versions: OZ Canonical from n/a through 0.5. CVSS v3.1 base score 7.1 (HIGH). Exploitation status in connected docs: CVE entry shows explo...

PT-2025-4439 · Unknown · Oz Canonical

Name of the Vulnerable Software and Affected Versions: OZ Canonical versions 0.5 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows Reflected Cross-site Scripting XSS. This means an attacker can inject malicious scripts into ...

CVE-2024-47821

pyLoad is a free and open-source Download Manager. The folder /.pyload/scripts has scripts which are run when certain actions are completed, for e.g. a download is finished. By downloading a executable file to a folder in /scripts and performing the respective action, remote code execution can be...

PT-2024-33391 · Unknown · James Park Analyse Uploads

Name of the Vulnerable Software and Affected Versions: James Park Analyse Uploads versions 0.5 and earlier Description: A Relative Path Traversal issue affects James Park Analyse Uploads, allowing unauthorized access to files. The issue is related to the Analyse Uploads component. Recommendations...

WordPress plugin Analyse Uploads 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-45303 Discourse Calendar plugin event names susceptible to XSS

Discourse Calendar plugin adds the ability to create a dynamic calendar in the first post of a topic to Discourse. Rendering event names can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Content Security Policy. The issue ...

CVE-2024-45303

CVE-2024-45303 concerns the Discourse Calendar plugin, which allows dynamic calendars in topic first posts. The root issue is that rendering of event names can be exploited for cross-site scripting (XSS) when a site has modified or disabled Discourse’s default Content Security Policy. The vulnera...

CVE-2024-45303 Discourse Calendar plugin event names susceptible to XSS

Discourse Calendar plugin adds the ability to create a dynamic calendar in the first post of a topic to Discourse. Rendering event names can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Content Security Policy. The issue ...

GHSA-XM4R-5RJ9-2PG3 gratient 0.5 contains credential harvesting code

gratient is a user-facing library for generating color gradients of text. Version 0.5 contained obfuscated, malicious code targeting Windows platforms, harvesting information and credentials from the user's system and sending them to a remote server. Services may include Mullvad VPN and Telegram...

PT-2024-29714 · Cervantes · Cervantes

Name of the Vulnerable Software and Affected Versions: Cervantes versions through 0.5-alpha Description: The issue allows for insecure file uploads. Recommendations: For versions through 0.5-alpha, consider restricting file upload functionality until a secure version is available. As a temporary...

CVE-2024-36124 iq80 Snappy has an out-of-bounds read when uncompressing data, leading to JVM crash

iq80 Snappy is a compression/decompression library. When uncompressing certain data, Snappy tries to read outside the bounds of the given byte arrays. Because Snappy uses the JDK class sun.misc.Unsafe to speed up memory access, no additional bounds checks are performed and this has similar securi...

CVE-2024-36124 iq80 Snappy has an out-of-bounds read when uncompressing data, leading to JVM crash

iq80 Snappy is a compression/decompression library. When uncompressing certain data, Snappy tries to read outside the bounds of the given byte arrays. Because Snappy uses the JDK class sun.misc.Unsafe to speed up memory access, no additional bounds checks are performed and this has similar securi...

`serde` deserialization for `FamStructWrapper` lacks bound checks that could potentially lead to out-of-bounds memory access

Impact An issue was discovered in the FamStructWrapper::deserialize implementation provided by the crate for vmmsysutil::fam::FamStructWrapper, which can lead to out of bounds memory accesses. The deserialization does not check that the length stored in the header matches the flexible array lengt...

DashMachine Security Breach

DashMachine is a web application bookmarking dashboard by Ross Mountjoy Individual Developer. A security vulnerability exists in DashMachine version 0.5-4, which stems from the parameter file in the file /settings/deletefile that causes path traversal...

DashMachine Code Injection Vulnerability

DashMachine is a web application bookmarking dashboard by Ross Mountjoy Individual Developer. A code injection vulnerability exists in DashMachine version 0.5-4, where the parameter valuetemplate in the source file /settings/saveconfig can lead to code injection...