642 matches found
Drupal Real-time SEO for Drupal 跨站脚本漏洞
Drupal Real-time SEO for Drupal is a keyword plugin for the Drupal community. A cross-site scripting vulnerability exists in Drupal Real-time SEO for Drupal versions prior to 2.2.0, which stems from improper input neutralization during page generation and could lead to a cross-site scripting atta...
Arbitrary File Upload
Overview Affected versions of this package are vulnerable to Arbitrary File Upload via the fileUploadHandler process. An attacker can write arbitrary files to the filesystem by supplying crafted values to the fc.Name parameter, which is not properly sanitized, allowing directory traversal. This c...
CVE-2025-3702
Missing Authorization vulnerability in Melapress Melapress File Monitor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Melapress File Monitor: from n/a before 2.2.0...
Improper Handling of Exceptional Conditions
Overview Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions via the BeginBlocker process in the x/distribution module. An attacker can cause the blockchain to halt by sending transactions with fees denominated in a currency other than the expected nati...
CVE-2025-53300
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in douglaskarr Podcast Feed Player Widget and Shortcode podcast-feed-player-widget allows Stored XSS.This issue affects Podcast Feed Player Widget and Shortcode: from n/a through = 2.2.0...
CVE-2025-53300 WordPress Podcast Feed Player Widget and Shortcode plugin <= 2.2.0 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in douglaskarr Podcast Feed Player Widget and Shortcode podcast-feed-player-widget allows Stored XSS.This issue affects Podcast Feed Player Widget and Shortcode: from n/a through = 2.2.0...
PT-2025-27201 · Unknown · Douglaskarr Podcast Feed Player Widget/Shortcode
Name of the Vulnerable Software and Affected Versions: douglaskarr Podcast Feed Player Widget and Shortcode versions 2.2.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This...
CVE-2025-52792
Cross-Site Request Forgery CSRF vulnerability in vgstef WP User Stylesheet Switcher wp-user-stylesheet-switcher allows Stored XSS.This issue affects WP User Stylesheet Switcher: from n/a through = v2.2.0...
Malicious code in eyeblue1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d152785a33262aef07792faf0e6affc3c4b0272ea937b56cb3707f5e4286b9b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2025-29011
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CHR Designer YouTube Simple Gallery youtube-simple-gallery allows Stored XSS.This issue affects YouTube Simple Gallery: from n/a through = 2.2.0...
WordPress plugin YouTube Simple Gallery 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
CVE-2024-31584
Pytorch before v2.2.0 has an Out-of-bounds Read vulnerability via the component torch/csrc/jit/mobile/flatbufferloader.cpp...
CVE-2024-31454
PsiTransfer is an open source, self-hosted file sharing solution. Prior to version 2.2.0, the absence of restrictions on the endpoint, which is designed for uploading files, allows an attacker who received the id of a file distribution to change the files that are in this distribution. The...
CVE-2024-29765
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Alireza Sedghi Aparat for WordPress allows Stored XSS.This issue affects Aparat for WordPress: from n/a through 2.2.0...
CVE-2024-1282
The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This make...
CVE-2024-51677
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ajay Knowledge Base knowledgebase allows Stored XSS.This issue affects Knowledge Base: from n/a through = 2.2.0...
CVE-2024-31453
PsiTransfer is an open source, self-hosted file sharing solution. Prior to version 2.2.0, the absence of restrictions on the endpoint, which allows users to create a path for uploading a file in a file distribution, allows an attacker to add arbitrary files to the distribution. The vulnerability...
CVE-2024-12635
The WP Docs plugin for WordPress is vulnerable to time-based SQL Injection via the 'dirid' parameter in all versions up to, and including, 2.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...