EUVD-2024-35428

Malicious code in bioql PyPI...

EUVD-2024-34496

Malicious code in bioql PyPI...

EUVD-2022-48267

Malicious code in bioql PyPI...

EUVD-2023-27960

Malicious code in bioql PyPI...

EUVD-2025-10608

Malicious code in bioql PyPI...

EUVD-2024-37503

Malicious code in bioql PyPI...

CVE-2025-59932

Flag Forge is a Capture The Flag CTF platform. From versions 2.0.0 to before 2.3.1, the /api/resources endpoint previously allowed POST and DELETE requests without proper authentication or authorization. This could have enabled unauthorized users to create, modify, or delete resources on the...

CVE-2025-59932

Flag Forge is a Capture The Flag CTF platform. From versions 2.0.0 to before 2.3.1, the /api/resources endpoint previously allowed POST and DELETE requests without proper authentication or authorization. This could have enabled unauthorized users to create, modify, or delete resources on the...

CVE-2025-59932 FlagForgeCTF Unauthenticated Resource Modification/Deletion

Flag Forge is a Capture The Flag CTF platform. From versions 2.0.0 to before 2.3.1, the /api/resources endpoint previously allowed POST and DELETE requests without proper authentication or authorization. This could have enabled unauthorized users to create, modify, or delete resources on the...

PT-2025-39700

Name of the Vulnerable Software and Affected Versions Flag Forge versions 2.0.0 through 2.3.0 Description The Flag Forge platform contained a security issue where the /api/resources API endpoint permitted POST and DELETE requests without appropriate authentication or authorization. This allowed...

CVE-2025-59841

Flag Forge is a Capture The Flag CTF platform. In versions from 2.2.0 to before 2.3.1, the FlagForge web application improperly handles session invalidation. Authenticated users can continue to access protected endpoints, such as /api/profile, even after logging out. CSRF tokens are also still...

CVE-2025-59841

Flag Forge is a Capture The Flag CTF platform. In versions from 2.2.0 to before 2.3.1, the FlagForge web application improperly handles session invalidation. Authenticated users can continue to access protected endpoints, such as /api/profile, even after logging out. CSRF tokens are also still...

CVE-2025-59841

Flag Forge CT F’s CVE-2025-59841 describes a flaw in session invalidation for versions 2.2.0 through 2.3.0, allowing authenticated users to access protected endpoints (e.g., /api/profile) after logout and leaving CSRF tokens valid post-logout. The issue is mitigated by upgrading to version 2.3.1,...

CVE-2025-57981

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in catchsquare WP Social Widget wp-social-widget allows Stored XSS.This issue affects WP Social Widget: from n/a through = 2.3.1...

CVE-2025-57981

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in catchsquare WP Social Widget wp-social-widget allows Stored XSS.This issue affects WP Social Widget: from n/a through = 2.3.1...

CVE-2025-57981

CVE-2025-57981 is a stored cross-site scripting vulnerability in the WordPress plugin WP Social Widget. The attached description and corroborating Wordfence data identify the issue as Improper Neutralization of Input During Web Page Generation (Stored XSS) affecting WP Social Widget versions up t...

CVE-2025-57981 WordPress WP Social Widget Plugin <= 2.3.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in catchsquare WP Social Widget wp-social-widget allows Stored XSS.This issue affects WP Social Widget: from n/a through = 2.3.1...

PT-2025-38831

Name of the Vulnerable Software and Affected Versions catchsquare WP Social Widget versions through 2.3.1 Description The WP Social Widget software contains a flaw related to improper input handling during web page generation, which can lead to Cross-site Scripting XSS. This allows for the...

CVE-2025-59424

CVE-2025-59424: LinkAce contains a Stored XSS on the /system/audit page prior to version 2.3.1. An authenticated attacker can set a malicious payload in the username field; when actions (e.g., API token generation/revocation) are logged, the payload is stored and later executed in the browser of ...

PT-2025-38477

Name of the Vulnerable Software and Affected Versions LinkAce versions prior to 2.3.1 Description LinkAce is a self-hosted archive to collect website links. A Stored Cross-Site Scripting XSS vulnerability exists on the /system/audit page. The application does not properly sanitize the username...