MAL-2025-46949 Malicious code in monolith-twirp-features-featuresync (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f53c57dca1a60f5e0bcea26028d79bc5d8f4427b2dfb2dc1c29c9babe625a2bb The OpenSSF Package Analysis project identified 'monolith-twirp-features-featuresync' @ 1.0.0 rubygems as malicious. It is considered malicious...

IBM Concert Software 加密问题漏洞

IBM Concert Software is an application lifecycle risk identification software from International Business Machines IBM. An encryption issue vulnerability exists in IBM Concert Software versions 1.0.0 through 1.1.0, which stems from a weak encryption algorithm that could lead to the decryption of...

IBM Concert Software 跨站脚本漏洞

IBM Concert Software is an application lifecycle risk identification software from International Business Machines IBM. A cross-site scripting vulnerability exists in IBM Concert Software versions 1.0.0 through 1.1.0 that stems from a cross-site scripting attack that could lead to credential...

IBM Concert Software 跨站脚本漏洞

IBM Concert Software is an application lifecycle risk identification software from International Business Machines IBM. A cross-site scripting vulnerability exists in IBM Concert Software versions 1.0.0 through 1.1.0 that stems from a cross-site scripting attack that could lead to credential...

CVE-2025-48307

Cross-Site Request Forgery CSRF vulnerability in kasonzhao SEO For Images seo-for-images allows Stored XSS.This issue affects SEO For Images: from n/a through = 1.0.0...

CVE-2025-48319

CVE-2025-48319 corresponds to a stored XSS in the WordPress plugin “Mesa Mesa Reservation Widget” (versions up to 1.0.0). The root cause is improper input neutralization during web page generation, enabling attacker-supplied payloads to persist in the widget. Reported as affecting Mesa Mesa Reser...

CVE-2025-48307 WordPress SEO For Images plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in kasonzhao SEO For Images seo-for-images allows Stored XSS.This issue affects SEO For Images: from n/a through = 1.0.0...

Malicious code in pp-react-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 71193da54e6cdc258489d02db5987830a3bc147cbf9b43236f5757cab04f9c73 The OpenSSF Package Analysis project identified 'pp-react-grid' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2025-42129 Malicious code in pp-react-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 71193da54e6cdc258489d02db5987830a3bc147cbf9b43236f5757cab04f9c73 The OpenSSF Package Analysis project identified 'pp-react-grid' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

WordPress plugin Mesa Mesa Reservation Widget 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress plugin SEO For Images 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

PT-2025-35007

Name of the Vulnerable Software and Affected Versions: Mesa Mesa Reservation Widget versions through 1.0.0 Description: The Mesa Mesa Reservation Widget contains a Stored Cross-site Scripting XSS issue due to improper neutralization of input during web page generation. Recommendations: Update Mes...

CVE-2025-57802

Airlink’s Daemon vulnerability (CVE-2025-57802) affects version 1.0.0, where an attacker with access to the affected container can create symbolic links inside the mounted /app/data directory. Because the container bind-mounts an arbitrary host path, these symlinks can point to sensitive host loc...

CVE-2025-5060

The Bravis User plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.1. This is due to the plugin not properly logging a user in with the data that was previously verified through the facebookajaxlogincallback. This makes it possible for...

CVE-2025-54301

A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered. File names are not properly escaped...

CVE-2025-54300

CVE-2025-54300 affects the Quantum Manager component for Joomla, versions 1.0.0–3.2.0. The root cause is an unsanitized SVG upload mechanism that allows stored XSS. The CVSS 4.0 vector indicates Network access, high impact on confidentiality and availability, and user interaction not required but...

CVE-2025-54301 Extension - norrnext.com - Stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla

A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered. File names are not properly escaped...

CVE-2025-54301

CVE-2025-54301 affects the Quantum Manager component for Joomla (versions 1.0.0–3.2.0). The vulnerability is a stored XSS caused by file names not being properly escaped, as described in multiple sources. No exploitation details are provided in the documents, and a concrete patched version is not...

WordPress SEO For Images plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability

Cross Site Request Forgery CSRF to Stored XSS vulnerability discovered by Nguyen Xuan Chien Patchstack Alliance in WordPress Plugin SEO For Images versions = 1.0.0...

PT-2025-34689 · Docker +1 · Docker +1

Name of the Vulnerable Software and Affected Versions: Airlink versions prior to 1.0.1 Description: Airlink's Daemon interfaces with Docker and the Panel to provide secure access for controlling instances via the Panel. An attacker with access to the affected container can create symbolic links...